Elastic Certified Engineer study guide
Elastic Certified Engineer · Work through your exam, one topic at a time.
The Elastic Certified Engineer (ECE) is Elastic's professional certification for practitioners who build and operate solutions on Elasticsearch. Elastic introduced the credential in 2018, describing it as "a rigorous, performance-based exam that challenges people on a full range of Elasticsearch skills across operations, development, and more." Rather than testing recall, the exam presents real-world scenarios: candidates must complete a series of challenging, hands-on tasks within three hours, all performed on a collection of Elasticsearch clusters. The Elastic Certified Engineer study guide has 8 sections and about 2,709 words.
01Installation and Configuration
Configuration lives under $ES HOME/config : elasticsearch.yml for node and cluster settings, jvm.options (plus anything dropped into jvm.options.d/ ) for heap and GC, log4j2.properties for logging, and the elasticsearch.keystore for secrets. Capabilities are declared with node.roles ( master , data , data hot , ingest , ml , remote cluster client , and so on); a node with an empty role list is coordinating-only.
324 words, about 2 min02Cluster Administration
cluster/health returns green when every primary and replica shard is allocated, yellow when primaries are allocated but replicas are not, and red when at least one primary is unassigned. Allocation is shaped by cluster.routing.allocation.
324 words, about 2 min03Data Ingestion
Documents enter through the single-document APIs, bulk , reindex , or external shippers such as Logstash and Beats. bulk is NDJSON: an action line ( index , create , update , delete ), an optional source line, Content-Type: application/x-ndjson , and a trailing newline.
321 words, about 2 min04Data Modeling
Mappings decide how fields are indexed and queried. text is analyzed for full-text search; keyword is stored verbatim for exact matching, sorting and aggregations.
332 words, about 2 min05Search
Query DSL splits into full-text queries ( match , match phrase , multi match , query string ) and term-level queries ( term , terms , range , exists , prefix , wildcard , fuzzy ). bool composes them with must , filter , should and must not ; filter and must not contribute no score and are cacheable.
339 words, about 2 min06Aggregations
Aggregations fall into three families. Metric aggregations ( avg , sum , min , max , stats , value count , cardinality , percentiles , top hits , geo variants) compute numbers.
327 words, about 2 min07Developing Search Applications
An application talks to Elasticsearch over the REST API or a client library: index, update and delete documents, then search them. Core mechanics: writes become visible to search only after a refresh (near-real-time, default 1s), while a GET by ID is real-time - use refresh=wait for when a test must observe its own write.
360 words, about 2 min08Machine Learning
ML in Elasticsearch means anomaly detection jobs and data frame analytics. An anomaly detection job has an analysis config containing a bucket span , one or more detectors (a function such as count , mean , high mean , rare , plus field name and optional by field name , over field name , partition field name ), and influencers .
382 words, about 2 min