Elastic Certified Analyst study guide
Elastic Certified Analyst · Work through your exam, one topic at a time.
The Elastic Certified Analyst credential is a professional certification for practitioners who work hands-on with the Elastic Stack, typically analysts, detection engineers, observability specialists, and search developers who need to prove they can investigate data and produce answers rather than simply configure clusters. This page is an independent study guide; it is not affiliated with, endorsed by, or operated by Elastic. The Elastic Certified Analyst study guide has 4 sections and about 2,114 words.
01Search and AI: lexical, vector, hybrid, reranking, and RAG
The Search and AI domain checks that you can build and inspect retrieval in Kibana and Elasticsearch: lexical BM25, dense and sparse vector search, hybrid fusion, reranking, and retrieval-augmented generation (RAG) in Playground. Questions tend to probe which setting changes recall versus latency, and whether you can read a retriever tree and predict what it returns.
586 words, about 3 min02Observability: logs, metrics, traces, APM, and SLOs
Observability tests whether you can move between logs, metrics, and traces in Kibana, read APM data correctly, and convert a service-level objective into alerting that on-call engineers trust instead of mute. Logs arrive through Elastic Agent integrations managed by Fleet and land in data streams such as logs-nginx.access-default .
509 words, about 3 min03Security: SIEM detection, endpoint protection, and native automation
Security tests the detection pipeline in Elastic Security: getting data in and normalized, writing and tuning rules, investigating alerts, and using endpoint and automation features without turning a detection into an outage. Ingestion runs through Elastic Agent integrations managed in Fleet.
530 words, about 3 min04Platform and deployment: Serverless, Cloud Hosted, and self-managed
Platform and deployment tests whether you know which capabilities exist in Elastic Cloud Serverless, Elastic Cloud Hosted, and self-managed deployments, and how the deployment model changes what an analyst can do in Kibana. Elastic Cloud Serverless runs as projects: Search, Observability, and Security.
489 words, about 2 min