Elastic Certified Analyst flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

dense_vector dims parameter

The dims parameter on a dense_vector field declares the vector length and must equal the embedding model's output dimension. A mismatch causes indexing to fail with a mapping exception.

num_candidates in kNN

num_candidates sets how many approximate nearest neighbors each shard considers before merging results. Higher values improve recall but increase latency and memory use during the search.

Reciprocal rank fusion (RRF)

RRF merges ranked result lists by summing 1 divided by rank_constant plus each document's rank. It uses ranks rather than raw scores, so BM25 and vector scores need no normalization.

text_similarity_reranker retriever

This retriever re-scores the top documents returned by an inner retriever using a cross-encoder model deployed through the inference API. It improves ranking precision at the cost of extra latency.

semantic_text field type

A semantic_text field stores text and automatically generates embeddings at index and query time using a configured inference endpoint. Chunking behavior is controlled by the endpoint's chunking settings.

int8_hnsw quantization

int8_hnsw stores vectors as 8-bit integers instead of floats, cutting memory roughly fourfold. Search typically oversamples candidates and rescores with full-precision vectors to preserve accuracy.

RAG retrieval step

In retrieval-augmented generation, the retriever first fetches the top-k relevant chunks from an index. Those chunks are inserted into the prompt as context for the language model.

Inference endpoint

An inference endpoint registers a model, such as an embedding or completion model, for use by ingest pipelines, semantic_text fields, and search retrievers. It is created before dependent mappings.

Observability data stream naming

Observability data streams follow the pattern type-dataset-namespace, for example logs-nginx.access-default or traces-apm-default. The type determines the data stream's lifecycle and index template.

ILM frozen phase

The frozen phase mounts indices as searchable snapshots, drastically reducing local disk usage. Queries against frozen data are slower and rely on the shared cache for performance.

Time series data stream

A TSDS uses index mode time_series and requires time_series_dimension fields plus at least one time_series_metric field. It enables rate aggregation and automatic downsampling of older metrics.

ES|QL pipes

ES|QL chains commands with pipe characters, such as FROM logs-* | STATS count() BY host.name | SORT count DESC. It supports filtering, aggregation, enrichment, and LOOKUP JOIN.

APM transaction and span

A transaction represents a single service request, while spans are the individual operations within it. Together they form traces used by the service map and latency breakdowns.

SLO error budget

An SLO defines a target, such as 99.9 percent availability over 30 days. The error budget is the allowed failure portion, and burn rate alerts fire when it is consumed too quickly.

Kibana alerting rule

A rule evaluates a query or condition on a schedule and triggers actions through connectors. Rule types include Elasticsearch query, index threshold, APM, and machine learning anomaly detection.

Synthetic monitor

Synthetic monitoring runs scheduled HTTP, TCP, ICMP, or browser checks from public or private locations. Results are stored in heartbeat data streams and shown in the Uptime app.

Detection rule types

Elastic Security detection rules include custom query, threshold, indicator match, new terms, event correlation, and machine learning rules. Each produces alerts written to the alerts security index.

EQL sequence query

EQL sequence queries match ordered events sharing a join key within a maxspan. They are used to detect process ancestry and multi-step attack behavior across event categories.

Indicator match rule

This rule joins incoming events against threat intelligence indices using indicator fields such as file hashes or IP addresses. Matches generate alerts tagged with the matched indicator.

Endpoint host isolation

Isolation applies a network policy that blocks most traffic to and from a host while keeping the Elastic Agent connection. It is issued from the endpoint response actions menu.

Elastic Defend protections

Elastic Defend offers malware, ransomware, memory threat, and behavior protection layers. Behavior protection watches process and file activity for suspicious patterns beyond signature matching.

Alert status values

Security alerts carry a status of open, acknowledged, or closed. Analysts update status during triage, and status changes are tracked in the alert's activity history.

Elastic Security cases

Cases collect alerts, comments, and attachments for investigation. Connectors push case data to external systems such as Jira or ServiceNow, and templates standardize case fields.

Fleet and Elastic Agent

Fleet centrally manages Elastic Agents and their policies. A policy lists integrations, such as endpoint or system metrics, that determine which data streams each agent collects.

Serverless project types

Elastic Cloud Serverless offers Search, Observability, and Security project types. Each exposes a tailored Kibana experience, and capacity scales automatically without node-level configuration.

Elastic Cloud Hosted topology

ECH clusters let you choose availability zones and data tiers such as hot, warm, cold, and frozen. You control ILM policies, snapshots, and version upgrades within platform limits.

ECK custom resources

Elastic Cloud on Kubernetes deploys Elasticsearch, Kibana, and Beats through Kubernetes custom resources. The operator reconciles desired state, handling scaling, upgrades, and certificate rotation.

Snapshot repository

A snapshot repository is registered storage, such as S3, GCS, Azure, or a shared filesystem, where cluster backups are written. Restores require the repository to be registered on the target cluster.

Cross-cluster search

Cross-cluster search lets one cluster query indices on remote clusters using a cluster-name:index pattern. Remote clusters are configured with the cluster remote settings API or project settings.

Serverless data lifecycle

Serverless projects manage data retention through data stream lifecycle rather than user-configured ILM. Retention is set per data stream, and the platform handles rollover and deletion.

Rolling upgrade procedure

During a self-managed rolling upgrade, disable shard allocation, upgrade nodes one at a time, then re-enable allocation. This avoids unnecessary shard relocation and reduces recovery time.