Elastic Certified Analyst
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The Elastic Certified Analyst credential is a professional certification for practitioners who work hands-on with the Elastic Stack, typically analysts, detection engineers, observability specialists, and search developers who need to prove they can investigate data and produce answers rather than simply configure clusters. This page is an independent study guide; it is not affiliated with, endorsed by, or operated by Elastic.
The published exam blueprint splits coverage evenly across four domains: Search and AI (vector, hybrid search, reranking, RAG), Observability (logs, metrics, traces, APM), Security (SIEM, endpoint protection, native automation), and Platform and deployment (Elastic Cloud Serverless, Elastic Cloud Hosted, self-managed). That even split matters for planning: candidates who live in one solution area must still be fluent in the other three, including how data is ingested via Elastic Agent, Beats, or Logstash, and how Kibana is shared as the visualization and management UI across solutions.
Preparation should be task-driven. Work in a live deployment rather than reading only. Elastic documents three deployment models, and the 14-day Elastic Cloud free trial covers both Elastic Cloud Serverless and Elastic Cloud Hosted, so you can evaluate managed options without a credit card. Build investigations end to end: ingest data, query it, visualize it, and explain the conclusion. Practice reading relevance results, correlating telemetry, triaging alerts, and reasoning about where a workload should run. Time yourself, since analyst work is judged on speed and accuracy together.
What you'll study
About Elastic Certified Analyst preparation
What is the Elastic Certified Analyst exam actually testing?
Per the published blueprint, four domains weighted 25% each: Search and AI, Observability, Security, and Platform and deployment. Expect tasks that require interpreting data and justifying a conclusion, not just recalling menu locations. Practice investigating across all four areas rather than specializing in one.
How hard is it compared with other Elastic certifications?
The even domain weighting is the difficulty. Most candidates are strong in one solution and weak in three. If you only work in Security, you still need vector and hybrid search fluency and deployment-model reasoning. Budget study time proportional to your weakest domains, not your strongest.
Is there a free way to practice the platform?
Yes. Elastic documents a 14-day Elastic Cloud free trial with no credit card required, and it includes access to both Elastic Cloud Serverless and Elastic Cloud Hosted. That lets you rehearse managed workflows. For self-managed practice, Elasticsearch, Kibana, Elastic Agent, Logstash, and Beats ship as packages, Docker images, and Helm charts.
What should my study order be?
Start with Platform and deployment so you understand where your lab runs, then Observability for ingestion and correlation habits, then Security for triage and automation, then Search and AI for retrieval and reranking. Finish with mixed drills that force you to switch domains under time pressure, which mirrors real analyst work.
How should I think about search and AI topics as an analyst?
Focus on retrieval quality, not model training. Elastic documents vector and hybrid search, combining BM25 keyword retrieval with vector retrieval plus reranking, and RAG pipelines that ground LLM output in retrieved documents. Practice judging whether returned context is relevant and token-efficient.
What are the most common failure modes?
Three recur: over-investing in a familiar domain and neglecting the other three; memorizing UI steps instead of reasoning about data; and running out of time because practice was untimed. Also common is confusing deployment models, so be ready to explain the tradeoffs among Serverless, Hosted, and self-managed.
Do I need to know licensing and open source details?
Know the basics. Elasticsearch is dual-licensed under AGPL v3 and the Elastic License 2.0, and it is built on Apache Lucene, which is Apache 2.0 licensed. Most developers can use it under the AGPL at no cost; the Elastic License 2.0 covers deployments outside the AGPL's permitted use cases.
How do I prepare if I have no work experience with Elastic?
Build a small end-to-end project in a trial deployment: ingest logs and metrics with Elastic Agent, build a Kibana dashboard, run a detection-style investigation, then index documents and compare keyword versus hybrid retrieval with reranking. Write up each conclusion in a few sentences, which is the skill the exam rewards.
Where can I confirm exam logistics like duration, fee, and retakes?
Those details are not published in the source material used for this page, so they are not stated here rather than guessed. Confirm current duration, fee, passing score, retake policy, and validity directly with Elastic's official certification pages before you book or budget.