I85PREP
⌘ K
Elastic Certified Analyst study materials
Elastic Certified Analyst study resources

Elastic Certified Analyst: Search and AI: lexical, vector, hybrid, reranking, and RAG

Elastic Certified Analyst · Work through your exam, one topic at a time.

All guide sections

Search and AI: lexical, vector, hybrid, reranking, and RAG

What this domain covers

The Search and AI domain checks that you can build and inspect retrieval in Kibana and Elasticsearch: lexical BM25, dense and sparse vector search, hybrid fusion, reranking, and retrieval-augmented generation (RAG) in Playground. Questions tend to probe which setting changes recall versus latency, and whether you can read a retriever tree and predict what it returns.

Core rules

  • BM25 scores text fields through match; the analyzer chosen at mapping time decides what is searchable. keyword fields match exactly or via prefix/wildcard, not by relevance.
  • dense_vector requires dims and similarity (cosine, dot_product, euclidean, max_inner_product). dot_product expects unit-length vectors; cosine ignores magnitude.
  • Approximate kNN runs through the knn clause of _search with field, query_vector, k, and num_candidates. num_candidates is the per-shard candidate pool and must be at least k; raising it improves recall and costs latency. k is the number of nearest neighbours considered, bounded by size.
  • HNSW settings m and ef_construction are fixed at mapping time; changing them means reindexing.
  • semantic_text declares an inference endpoint in the mapping, chunks and embeds at ingest, and is queried with the semantic query. It removes manual vector plumbing but pins the field to that model, so switching models requires reindexing.
  • ELSER is a learned sparse encoder stored in a sparse_vector field: strong on lexical-semantic overlap and easier to explain than dense vectors.
  • Hybrid search fuses two retrievers. RRF scores each document as 1/(rank_constant + rank) per result list (default rank_constant 60) and ignores raw scores, so no score normalization is needed. The linear retriever instead combines normalized scores with weights.
  • Reranking wraps a first stage: text_similarity_reranker reorders the top rank_window_size documents using an inference endpoint such as Elastic Rerank.

Worked example

A support index has body (text) and body_vector. A user searches for reset password INC-4471. Pure kNN returns paraphrases but drops the exact ticket ID; BM25 does the opposite. Build an rrf retriever with a standard child (match on body) and a knn child (k: 50, num_candidates: 200). RRF merges by rank, so the BM25 ticket hit and the kNN paraphrase both survive. Then wrap the result in text_similarity_reranker with rank_window_size 50 to fix ordering inside that window. The reasoning: fusion repairs recall, the reranker repairs precision, and neither can rescue a document the first stage never returned.

Traps

Reading num_candidates as the result count, or setting it below k. Expecting a reranker to promote documents outside its window. Assuming RRF respects a very high BM25 score - it only sees rank. Forgetting that semantic_text ingestion fails when the inference endpoint is missing or unhealthy. Confusing Playground, which is query-time RAG over existing indices, with an ingest pipeline.