Elastic Certified Analyst case studies
Elastic Certified Analyst · Put your knowledge to work in context.
The Elastic Certified Analyst credential is a professional certification for practitioners who work hands-on with the Elastic Stack, typically analysts, detection engineers, observability specialists, and search developers who need to prove they can investigate data and produce answers rather than simply configure clusters. This page is an independent study guide; it is not affiliated with, endorsed by, or operated by Elastic. The Elastic Certified Analyst case studies are 5 cases and about 4,833 words.
1Hybrid search regression on a 3.2M-SKU catalogue, plus a RAG assistant on the same index
A B2B distributor runs product search on Elastic Cloud Hosted (Elasticsearch 8.x, three 8 GB hot nodes, one index of 3.2 million SKUs, 2 primary shards, 1 replica). The existing query is a bool query with multi match over description plus a boosted match on part number.
1,033 words, about 5 min2Halving APM and log ingest on a 180-service estate without losing incident explainability
An online retailer instruments 180 services with Elastic APM on Elastic Cloud Hosted. Ingest is 34 TB/month of traces and 61 TB/month of logs, Observability spend grew 40% quarter over quarter, and the platform team has been asked to cut ingest roughly in half without losing the ability to explain customer-facing incidents.
961 words, about 5 min3Noisy PowerShell rule, a missed shadow-copy deletion, and authorised auto-isolation
A financial services firm runs Elastic Security on Elastic Cloud Hosted. Elastic Defend is deployed to 4,200 Windows endpoints and 260 Linux servers; endpoint telemetry is about 6 TB/day.
903 words, about 5 min4Serverless versus Hosted versus lift-and-shift for a self-managed 8 TB/day estate
A 700-person logistics company self-manages a three-node Elasticsearch cluster and two Kibana nodes on ageing hardware in its own data centre. It ingests about 8 TB/day of application and network logs, runs 12 machine-learning anomaly detection jobs on shipment events, uses cross-cluster search against a partner's cluster for consignment tracking, and keeps snapshots in an NFS repository.
945 words, about 5 min5Vector memory, quantisation and filtered recall on a 60M-chunk similarity index
A media company runs a visual similarity feature: 60 million image and document chunks embedded at 1024 dimensions in a dense vector field, element type float, indexed into an Elastic Cloud Hosted deployment of three 64 GB hot nodes with 30 primary shards and one replica. Queries use the knn option with k: 10, num candidates: 100 and a filter on tenant id; the largest tenant owns 9 million chunks.
991 words, about 5 min