Elastic Certified Engineer flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

cluster.initial_master_nodes

Setting listing the names of master-eligible nodes used to bootstrap a brand-new cluster's voting configuration. It must be removed after the cluster forms and never used on joining nodes.

vm.max_map_count requirement

Kernel setting that must be at least 262144 or Elasticsearch fails a production bootstrap check. Set it with sysctl -w vm.max_map_count=262144 and persist it in /etc/sysctl.conf.

elasticsearch-keystore

Command-line tool that stores secure settings such as bootstrap.password and TLS key passwords in an obfuscated keystore file rather than plain text in elasticsearch.yml. Use the add, list, and remove subcommands.

JVM heap sizing rule

Set Xms equal to Xmx and keep total heap at or below 50% of physical RAM, capped near 31 GB so the JVM keeps compressed ordinary object pointers.

Yellow cluster health

Every primary shard is assigned but at least one replica is not, so search still works while redundancy is reduced. Typical causes are a single-node cluster or more replicas than nodes.

cluster.routing.allocation.enable

Dynamic setting with values all, primaries, new_primaries, and none that controls shard allocation. Set it to none before a full cluster restart, then restore it to all.

path.repo requirement

elasticsearch.yml setting that lists allowed filesystem paths for shared-file-system snapshot repositories. Every node must mount the same path and the Elasticsearch user must be able to write to it.

ILM phase order

Index lifecycle phases execute hot, warm, cold, frozen, then delete. Each phase can run actions such as rollover, shrink, forcemerge, and allocate, triggered by min_age or size conditions.

Bulk NDJSON format

Newline-delimited JSON where each action line such as index or delete is followed by an optional source line. The request needs Content-Type application/x-ndjson and a trailing newline.

Ingest processor types

Built-in processors include set, remove, rename, convert, date, grok, dissect, geoip, script, append, and foreach. They run in array order and each can define its own on_failure handler.

index.default_pipeline

Index setting naming the ingest pipeline applied to any index or bulk request that specifies none. A request-level pipeline parameter overrides it, and the final_pipeline always runs last.

Reindex conflicts=proceed

Parameter that makes the reindex API continue past version conflicts instead of aborting at the first one. The default is abort, and conflicts are counted in the version_conflicts response field.

text versus keyword

text fields are analyzed into tokens and scored for full-text relevance. keyword fields store the entire value as one term and are used for exact matching, sorting, aggregations, and term queries.

dynamic mapping strict

Mapping parameter value that rejects any document containing an unmapped field with a strict_dynamic_mapping_exception. The value false instead keeps unknown fields in _source without indexing them.

keyword ignore_above

Mapping parameter, default 256, that causes strings longer than the given character count to be stored in _source but not indexed or added to doc values, so they cannot be searched or aggregated.

enabled: false object

Object-level mapping setting that stores the whole JSON subtree in _source while parsing and indexing none of its fields. It suits arbitrary payloads you never intend to query.

match versus term query

match applies the analyzer to the input and builds a boolean query over the resulting terms. term matches the exact stored value, so it belongs on keyword or numeric fields.

filter context

Query clause placed in bool.filter or a constant_score query that answers yes or no without computing a score. Such clauses are cacheable and cheaper than scoring queries.

index.max_result_window

Index setting, default 10000, that caps from plus size pagination. Requests beyond the limit fail, so deep paging should use search_after with a point in time or scroll.

search_after pagination

Stateless deep pagination that passes the sort values of the last hit in the search_after array. It requires a deterministic sort that includes a tiebreaker such as _shard_doc.

composite aggregation

Multi-source bucket aggregation returning an after_key for paging through every bucket deterministically. Its sources include terms, date_histogram, histogram, and geotile_grid.

cardinality approximation

The cardinality aggregation uses HyperLogLog++ and returns an approximate distinct count. precision_threshold, capped at 40000, trades additional memory for lower error.

calendar versus fixed interval

date_histogram calendar_interval aligns buckets to natural units like day and month and respects daylight saving. fixed_interval uses exact durations such as 30m or 7d and never shifts.

bucket_script pipeline aggregation

Parent pipeline aggregation that computes one value per bucket from other metrics named in buckets_path, using a Painless script that reads each path through the params object.

Alias write index

An alias can cover many indices, and exactly one is marked is_write_index true to receive indexing requests. Flipping that flag switches traffic atomically during a reindex.

_msearch API

Multi-search endpoint that accepts alternating header and body NDJSON lines and returns one response per query in a single round trip. Each header may select an index.

_analyze API

Endpoint returning the token stream for text, using a field's analyzer or an explicit analyzer, tokenizer, and filter chain. It validates custom analyzers before documents are indexed.

HTTP 429 handling

Status returned when Elasticsearch rejects a request because a queue or bulk-size limit is exceeded. Clients should retry with exponential backoff and reduce concurrency.

ML bucket_span

Job setting defining the time window over which each anomaly detection bucket is aggregated. It controls analysis granularity and must be compatible with the datafeed's query interval.

ML datafeed

Component that queries a source index with an aggregation over time and feeds results into an anomaly detection job. It is started and stopped separately from the job itself.

Model snapshot

Persisted copy of an anomaly detection job's model state, created automatically or on demand. Restoring a snapshot rewinds the model to that point for reanalysis or forecasting.

model_memory_limit

Job setting capping the memory one anomaly detection job may use for its model. It cannot exceed the cluster-wide xpack.ml.max_model_memory_limit value.