Elastic Certified Engineer key terms

The primary YAML configuration file for a node, holding settings such as cluster name, node name, network host, discovery seed hosts, and data and log paths. It is read at startup, and most changes require a restart.

The memory allocated to the Elasticsearch Java process, set with Xms and Xmx in jvm.options. Both values should match, stay under roughly 31 GB to keep compressed oops, and leave memory for the filesystem cache.

Startup validations that run only when a node binds to a non-loopback address. They stop startup when critical settings such as memory locking, file descriptors, or discovery configuration are unsafe, so production nodes must satisfy them.

Settings such as node.roles that decide which responsibilities a node accepts: cluster coordination, holding data shards, running ingest pipelines, or running machine learning tasks. Dedicated roles let each tier be sized and scaled independently.

The _cluster/health report. Green means all primary and replica shards are active, yellow means all primaries are active but some replicas are unassigned, and red means at least one primary shard is unassigned.

Index settings such as index.routing.allocation.include and exclude that restrict which nodes may hold an index's shards, based on node attributes like zone or machine type. Used to move data between tiers or drain nodes.

A policy-driven feature that moves indices through hot, warm, cold, frozen, and delete phases based on age or size, applying actions such as rollover, force merge, shrink, and deletion automatically.

A registered storage location, such as a shared filesystem or an S3 bucket, where snapshot API backups of indices and cluster state are written. It must be registered on every node that can hold data before snapshots succeed.

Human-readable tabular REST endpoints such as _cat/indices, _cat/nodes, and _cat/shards that report cluster state quickly. They accept a v parameter for headers and format=json for scripting.

A stored template that matches new index names by pattern and applies settings, mappings, and aliases at creation time, optionally composed with component templates. It replaces the older legacy template API.

An ordered list of processors, stored through the _ingest/pipeline API, that transform documents before indexing, for example parsing, renaming, or adding fields. Pipelines run on ingest nodes or during index and bulk requests.

A single _bulk request performing many index, create, update, or delete actions, each written as a metadata line followed by an optional source line in newline-delimited JSON. Far more efficient than individual requests.

The _reindex endpoint copies documents from a source index, optionally filtered by a query, into a destination index, optionally applying a pipeline or script. It is the standard way to change mappings or move data.

A named pointer that can refer to one or more indices and be used in place of an index name in search and write requests. Aliases enable zero-downtime reindexing and filtered or read-only views.

Automatic field type detection applied when a document contains fields that the mapping does not define. Elasticsearch infers types from the first values seen, which is convenient but can produce unwanted types such as text instead of keyword.

A mapping declared by the user before or during indexing that states each field's type and parameters. It gives predictable indexing and search behavior and is required for features such as nested objects and custom analyzers.

Two string field types. text is analyzed into tokens and used for full-text search; keyword is stored whole and used for exact matching, sorting, and aggregations. Indexing a value as both is a common pattern.

A named chain of a character filter, exactly one tokenizer, and optional token filters that turns text into terms at index time and query time. Standard and keyword are built in; custom analyzers are defined in index settings.

A restricted analysis chain, limited to character filters and token filters, applied to keyword fields so values such as emails or tags can be lowercased or normalized identically at index time and query time.

A field whose value is computed by a script at query time instead of being stored on disk, defined in the mapping or in a single search request. Useful for derived values, though slower and not usable everywhere.

A mapping type for arrays of objects that keeps each object's fields together, so a query cannot match fields from different objects. Searching requires nested queries, and each object is stored as a separate hidden document.

The compound query that combines clauses: must and filter are required, should is optional scoring, and must_not excludes. It is the standard structure for building multi-clause search requests.

In query context Elasticsearch computes relevance and clauses contribute to _score. In filter context a clause only includes or excludes documents, scores are ignored, and results can be cached. Use filters for exact criteria.

A full-text query that analyzes the input text and matches documents containing its terms, with options such as operator, minimum_should_match, and fuzziness. It is the usual choice for analyzed text fields.

An exact-value query that does not analyze its input, matching only documents whose field contains exactly that term. It is the right choice for keyword, numeric, and other non-analyzed fields.

A query requiring the analyzed terms to appear in the same order and positions as the input. The slop parameter permits a limited number of term moves, tolerating small differences in wording.

A query that alters relevance using functions such as field_value_factor, decay functions, random_score, or script_score, combined through boost_mode and score_mode. Typically used to blend text relevance with popularity or recency.

Ordering hits by one or more fields, such as a date or keyword, rather than by relevance score. Sorting a field requires doc_values, and the sort values are returned with each hit for pagination.

Bucket aggregations group documents into buckets, for example by terms or ranges; metric aggregations compute a single number from documents, such as an average or cardinality. Metrics nested in buckets summarize each group.

A bucket aggregation that groups documents by the distinct values of a field and returns the top buckets, ordered by count or a metric. It works on keyword and numeric fields and supports a size limit.

A bucket aggregation that groups documents into time intervals set by calendar_interval or fixed_interval, such as day or 1h, optionally adjusted by a time zone. A core building block for time-series analysis.

Aggregations declared inside another aggregation's aggs block and evaluated per bucket, producing per-group metrics or deeper breakdowns. They let one request compute multi-level summaries, such as a daily average per host.

Aggregations that consume the output of other aggregations rather than documents, for example derivative, moving_fn, or bucket_script. They compute values such as changes between buckets, ratios, or cumulative sums.

Retrieving result pages with from and size, bounded by index.max_result_window, or with search_after, which uses the last hit's sort values for efficient deep pagination. Scroll serves large exports instead.

A search option that returns fragments of matched fields with matching terms wrapped in configurable tags so applications can show context. It can read from _source, stored fields, or a separate highlight field.

A prefix-based autocomplete feature backed by the completion field type, which stores suggestions in a finite state transducer for fast lookup. It supports weights, filtering contexts, and fuzzy matching.

A machine learning job that models a time series built from one or more fields and flags unusual values by comparing actual results with predicted bounds. It writes results and an anomaly score per bucket.

The part of a machine learning job that pulls data from Elasticsearch indices using a query and an interval and passes it to the job. It remembers its position so analysis can resume without re-reading everything.

The time interval, such as 15m or 1h, into which an anomaly detection job aggregates input data before modeling. Choosing a span that matches the data's natural rhythm improves detection quality.