Elastic Certified Engineer case studies
Elastic Certified Engineer · Put your knowledge to work in context.
The Elastic Certified Engineer (ECE) is Elastic's professional certification for practitioners who build and operate solutions on Elasticsearch. Elastic introduced the credential in 2018, describing it as "a rigorous, performance-based exam that challenges people on a full range of Elasticsearch skills across operations, development, and more." Rather than testing recall, the exam presents real-world scenarios: candidates must complete a series of challenging, hands-on tasks within three hours, all performed on a collection of Elasticsearch clusters. The Elastic Certified Engineer case studies are 6 cases and about 5,541 words.
1Heap sizing, memory locking and a yellow cluster on a six-node cluster
You run a six-node cluster on 96 GB / 16-core hosts. Three nodes are node.roles: [master, data hot] with -Xms48g -Xmx48g ; the other three are node.roles: [data content] .
750 words, about 4 min2ILM rollover, warm-tier migration and a read-only index
logs- is written through the alias logs-write by 40 application pods; indices follow logs-000001 numbering, 1 primary / 1 replica, rolled over at 50 GB or 1 day. There are three hot nodes (NVMe, 91% used) with node.attr.box type: hot and two warm nodes (spinning disk, 10% used) with node.attr.box type: warm .
824 words, about 4 min3Reindexing 220M legacy documents through a failing ingest pipeline
You must reindex 220M documents from legacy-events into events-v2 ; the original source system is gone, so this is a one-shot migration. An ingest pipeline parse-legacy runs: grok on message , then date with formats: ["dd/MMM/yyyy:HH:mm:ss Z"] targeting @timestamp , then convert on bytes to long , then geoip .
857 words, about 4 min4Mapping explosion, unaggregatable tags and cross-object false matches
products is an 8M-document catalog. The mapping has title (text), tags (text), variants as an array of objects with color , size , price , and specs - a free-form object into which suppliers add arbitrary keys.
940 words, about 5 min5Time zone bucketing, distinct-count accuracy and shard-approximate terms
orders holds 40M documents on 12 shards with 1 replica: order date (date, stored UTC), total (double), customer id (keyword), category (keyword). A finance dashboard needs revenue per calendar day in Europe/Berlin, distinct buyers per week, and the top 10 categories by revenue.
1,059 words, about 5 min6An anomaly detection job that is too noisy to be useful
You deploy an ML anomaly detection job over logs- (150M docs/day) with a date histogram -style datafeed on @timestamp , bucket span: 5m , and a single high mean detector on response time ms partitioned by service.name . There are 40 services, and service.name was also added as an influencer along with host.name (1,200 hosts) and url.path (30,000 distinct paths).
1,111 words, about 6 min