Elastic Certified Engineer study plan

Install Elasticsearch from the binary tarball and via Docker, then start a single node with a corrected JVM heap setting

Configure elasticsearch.yml for a three-node cluster: cluster.name, node.roles, discovery.seed_hosts, and initial master nodes

Enable security with TLS on the transport and HTTP layers, then create a custom role and user and verify access with curl

Inspect the running cluster using _cluster/health, _cat/nodes, _cat/shards, and _nodes/stats to confirm a green status

Compose a component template plus an index template with settings, mappings, and aliases, and apply it to rollover-ready indices

Register a filesystem snapshot repository, take a snapshot of two indices, delete one locally, and restore it

Build an ILM policy with hot, warm, and delete phases and attach it to an index using rollover alias

Diagnose and fix a yellow or red cluster by inspecting unassigned shards and adjusting allocation or disk watermark settings

Write explicit mappings with correct types (keyword, text, date, scaled_float, ip) for a realistic product dataset

Define three custom analyzers with character filters, tokenizers, and token filters, and compare their _analyze output

Model one relation three ways: nested objects, join field parent-child, and denormalized documents, and state the trade-offs

Add runtime fields and a dynamic template, then verify that new documents map the way you intended

Build an ingest pipeline with grok, date, convert, rename, and set processors that parses three different log formats

Bulk index 10,000 documents and inspect every item-level error until the bulk response reports zero failures

Reindex a legacy index into a new mapping using a Painless script and an ingest pipeline

Ship data with Logstash or Filebeat into the new index and verify document counts with _count

Compose compound bool queries mixing must, filter, should, must_not, and minimum_should_match

Tune relevance with function_score, boost, and a rescore phase, comparing results before and after

Paginate a large result set with search_after plus point-in-time, and contrast it with from/size limits

Debug slow or wrong queries using the _explain, _validate/query, and _profile APIs

Run and interpret bucket aggregations: terms with size and order, date_histogram with calendar and fixed intervals, and range

Aggregate nested documents with nested plus reverse_nested and verify counts against raw queries

Chain metric and pipeline aggregations such as avg_bucket, derivative, and cumulative_sum over a date_histogram

Use filter, filters, and global aggregations together so filtered and unfiltered counts appear in one response

Page deep aggregation results with the composite aggregation plus after_key

Implement an index-and-search client in Python or Java that handles connection pooling, retries, and 4xx versus 5xx errors

Add highlighting, a completion suggester, and search_after pagination to the application

Use the async search API for a long-running query and poll for partial results

Write integration tests that index a fixture and assert exact hit order and snippet contents

Start a trial license, then create a single-metric anomaly detection job with a datafeed and review the bucket results

Create a multi-metric job with a split field and explain why a given bucket was flagged as anomalous

Configure an inference ingest pipeline that runs an NLP model on documents at index time

Take a timed 60-question mock exam across all eight domains and review every missed item