Elastic Certified Analyst study plan

Explain how dense_vector fields, kNN search, and the approximate nearest neighbor settings num_candidates and k work together, and describe when to prefer exact brute-force search over ANN

Configure an index with a dense_vector field and a semantic_text or sparse vector field, ingest sample documents, and run both a pure kNN query and a lexical BM25 query

Distinguish ELSER sparse vectors from dense embedding models and state which query types each one supports

Write down the default similarity metrics and dimensionality constraints that apply to dense_vector fields

Build a hybrid search request that combines lexical and semantic retrieval using RRF and separately using linear score combination, then compare the ranked outputs

Tune RRF rank_constant and window_size, and explain how each changes the fused ranking

Deploy and query an Elastic Inference Service or ML model endpoint for text embedding, and capture the pipeline that writes vectors at ingest time

Implement a reranking step with a cross-encoder or the built-in rerank capability and measure the effect on top-5 precision

Assemble a retrieval-augmented generation flow that retrieves chunks, passes them to a completion endpoint, and returns citations to the source documents

Chunk a long document set with sensible overlap and evaluate retrieval quality with a small labeled query set

Compare observability data models for logs, metrics, and traces and identify which index or data stream type each uses

Ingest sample logs and metrics through an Elastic Agent or API and confirm they are queryable in Discover

Write ES|QL and KQL queries that filter logs by field, aggregate by service, and compute error rates over time windows

Create a dashboard combining a log rate chart, a latency percentile metric, and a top-services breakdown

Configure an alert rule on a metric threshold and on a log count, and verify both fire against synthetic data

Explain how data streams, index lifecycle management, and rollover affect retention for observability indices

Instrument a small sample application with APM and trace a request across at least two services in the service map

Correlate a trace with its logs and host metrics using the trace ID and service name

Interpret span duration breakdowns to identify the slowest dependency in a transaction

Set an anomaly or latency SLO-style alert on APM data and describe the tradeoff between threshold and machine-learning detection

Ingest endpoint and network telemetry into detection rules and confirm ECS field mappings align with rule expectations

Write custom detection rules in both KQL and EQL, including a sequence rule for process ancestry

Build a detection rule that uses a threat intelligence indicator match and explain its performance implications

Configure a response action such as isolate host or kill process and describe the prerequisites that must be met

Map a simulated attack chain to MITRE ATT&CK techniques and show which rules cover which techniques

Explain how Elastic Defend policy settings, malware protection, and ransomware protection differ across deployment models

Compare Elastic Cloud Serverless, Elastic Cloud Hosted, and self-managed on scaling, upgrade responsibility, and feature availability for security use cases

Describe how API keys, roles, and spaces isolate access in a multi-tenant deployment

Deploy a cluster or serverless project, apply a snapshot or restore procedure, and verify data integrity after restore

Configure index lifecycle policies and snapshot repository settings for a production-like retention target

Run a timed full-length practice set across all four domains and review every missed item to its source documentation

Re-derive the weakest two domain summaries from memory and correct them against the docs