Elastic Certified Analyst key terms

A fixed-length numeric array produced by an embedding model that captures the semantic meaning of text or other content. Similarity is measured by distance, so nearby vectors indicate related meaning even without shared keywords.

A representation where each dimension maps to a token and most values are zero, with weights expressing token importance. It supports lexical matching with learned term weights rather than fixed-length dense embeddings.

A vector query that returns the k documents whose vectors are closest to the query vector under a chosen similarity metric. Approximate variants trade a small amount of recall for much faster search on large indices.

Hierarchical Navigable Small World, a graph-based approximate nearest neighbor index structure. It links vectors in layered graphs so queries can traverse quickly, controlled by parameters such as m and ef_construction.

The function used to compare two vectors, commonly cosine similarity, dot product, or Euclidean distance. The metric must match how the embedding model was trained, otherwise ranking quality degrades.

A machine learning model that converts text, images, or other input into vectors. In Elasticsearch it is deployed as an inference service endpoint, and the same model must be used for ingestion and query time.

A named Elasticsearch service that hosts a trained model, such as an embedding or reranking model, and exposes it for ingest pipelines and search queries. It can run on ML nodes or be backed by an external provider.

A field type that automatically generates embeddings at index time and embeds the query at search time, so users avoid managing vectors manually. It relies on a configured inference endpoint for the embedding model.

A query strategy that combines lexical relevance scoring with vector similarity and merges the two ranked result sets. It typically improves recall for both exact-term and meaning-based queries compared with either method alone.

A rank aggregation method that scores each document as the sum of one divided by a constant plus its rank in each result list. It merges lexical and vector rankings without needing comparable raw scores.

A second-stage step that rescores a small set of top candidates with a more expensive model, such as a cross-encoder, to improve ordering. It runs after retrieval and is limited to a configurable window of documents.

The default probabilistic lexical relevance algorithm in Elasticsearch, balancing term frequency, inverse document frequency, and document length. Tuning its k1 and b parameters changes how strongly repetition and length affect scores.

Elastic Learned Sparse EncodeR, a retrieval model that expands text into weighted tokens stored as sparse vectors. It enables semantic matching while keeping the inverted index and avoiding a separate vector index.

A pattern where relevant documents are retrieved from a search index and supplied as context to a large language model, which then answers the question. Grounding responses in retrieved evidence reduces hallucination.

Splitting long source documents into smaller passages before embedding and indexing. Chunk size and overlap affect retrieval precision, because each chunk becomes an independently searchable unit.

A data structure, such as HNSW, stored alongside fields to make nearest neighbor queries efficient. It is built at index time and consumes memory and disk proportional to vector count and dimensions.

The numeric value assigned to each hit expressing how well it matches the query. It is computed by the query type in use and drives default sorting when no explicit sort is specified.

A collection of hidden backing indices that share one name and are appended to over time, with older indices rolled over. It suits time-series data such as logs and metrics and requires a matching index template.

Policies that move indices through hot, warm, cold, frozen, and delete phases based on age or size. They automate rollover, tier migration, force merging, and retention for time-series data.

Creating a new write index when the current one reaches a size, age, or document threshold, then redirecting new writes to it. It keeps individual shards manageable and enables lifecycle automation.

A computation that reduces a set of documents to a single number per bucket, such as average, percentile, or cardinality. Metrics summarize numeric fields and can be nested inside bucket aggregations.

A computation that groups documents into buckets by a criterion such as value ranges, terms, or time intervals. Each bucket can hold sub-aggregations, including metric calculations.

A bucket aggregation that groups documents into fixed or calendar time intervals. It is the standard building block for time-series charts, often combined with metric aggregations per interval.

A library installed inside an application that instruments requests, database calls, and errors, then ships performance data to the APM server. It captures traces and metrics with minimal code change.

The complete record of a single request as it flows through distributed services, composed of one or more transactions and their child spans. Traces reveal latency contributions across service boundaries.

In APM, the top-level unit of work representing an inbound request or background job, with duration, result, and context. Spans nest beneath it to describe downstream operations.

A timed operation within a transaction, such as a database query or external HTTP call. Spans record start time, duration, and type, allowing slow dependencies to be isolated.

A visualization of how instrumented services communicate, derived from trace data. It shows call direction, throughput, and error or latency indicators between nodes.

An alerting rule that counts documents matching a query over a time window and fires when the count crosses a threshold. It is commonly used to detect error spikes in log data.

A saved condition evaluated on a schedule that triggers actions when met, such as sending notifications or opening cases. Rules can query logs, metrics, or uptime data and support grouping and throttling.

A configured integration that delivers alert notifications or case updates to an external system such as email, Slack, or a ticketing tool. Rules reference connectors when defining their actions.

A SIEM rule that evaluates incoming events against a query or sequence and produces alerts when activity matches. Rules can be custom or prebuilt and run on a defined schedule with lookback windows.

A condition attached to a detection rule that suppresses alerts for specified field values, such as a known scanner IP. Exceptions reduce false positives without disabling the rule.

An investigation workspace in the SIEM app where events from multiple queries are aligned chronologically. Analysts annotate events and add notes to build a narrative of an incident.

A container for an investigation that collects alerts, comments, and attached evidence, and can push updates to external ticketing systems. Cases track status and assignees through resolution.

Associating detection rules with adversary tactics and techniques from the ATT&CK knowledge base. It helps analysts understand coverage gaps and classify what behavior a rule is intended to catch.

An Elastic integration that collects malware, process, file, and network events from endpoint agents and enables response actions. It feeds host telemetry into detection rules and investigations.

A remediation task sent from Kibana to enrolled endpoint agents, such as isolating a host or killing a process. Actions are queued, tracked by status, and recorded for audit.

A fully managed deployment model where Elastic manages infrastructure and scaling, and projects are organized by solution type such as search, observability, or security. Capacity scales automatically without node configuration.

A managed deployment where Elastic provisions dedicated clusters on cloud providers, and users choose hardware profiles, tiers, and topology. It offers more control over nodes than serverless while removing host maintenance.

A deployment topology that assigns active indexing and search to hot nodes and older, less-queried data to warm nodes with larger, cheaper storage. It is expressed through index lifecycle policies and node roles.

A snapshot repository mount that makes indices queryable directly from object storage without full local restoration. It lowers storage cost for older data, at the price of higher query latency.

An indicator of shard allocation: green means all primary and replica shards are assigned, yellow means replicas are unassigned, and red means at least one primary is unassigned. It signals availability, not query performance.

A unit of index storage and search parallelism. Each index is split into primary shards, and the shard count is fixed at index creation, so sizing decisions affect performance and future growth.

A copy of a primary shard that provides redundancy and can serve search requests. Replicas increase read throughput and allow recovery if a node holding a primary fails.

A registered storage location, such as object storage or a shared filesystem, where cluster snapshots are written and restored from. Repositories are required for backups and searchable snapshot mounts.