40 Elasticsearch interview questions with detailed answers, sorted from basic to advanced. Free to practice, with progress saved automatically.
Elasticsearch is a distributed search and analytics engine built on Lucene, using an inverted index to make full-text queries fast. The bank covers mappings and field types, analyzers, the Query DSL, relevance scoring, aggregations, shards and segments, near-real-time indexing behaviour, deep pagination, changing mappings on a live index, and performance.
and 3 more topics.
An inverted index maps terms to the documents containing them. Finding a word is one lookup returning a posting list, instead of scanning every document like LIKE %keyword% in SQL. That is why full-text search beats LIKE %...%, where a B-tree index cannot help because…
Primary shards split data for horizontal scale; replicas are copies of primaries serving HA and extra read throughput. numberofshards cannot change after index creation — changing it means a reindex. numberofreplicas can change live. Elastic guidance: aim for 10–50 GB per shard and under 200…
text is analyzed (tokenized, lowercased) for full-text search; keyword stores the string as-is for filtering, sorting and aggregations. That is a multi-field, the standard pattern: name to search, name.raw to sort and group. Concrete consequences: - A term query on a text field with "Laptop…
Three stages in order: character filters (fix raw text, e.g. strip HTML), a tokenizer (split into tokens), and token filters (lowercase, stopwords, stemming, asciifolding). You need it because most "why does nothing match" bugs live here. The fastest debugging tool is analyze, showing what tokens…
match analyzes the search value before matching; term matches verbatim against indexed tokens. That is why term on a text field usually returns nothing. name.keyword is the keyword sub-field that dynamic mapping creates for string fields; with an explicit mapping you must declare such a…
Elasticsearch is near real-time, not real-time. A document becomes searchable only after a refresh, which happens every 1 second by default. The mechanism: writes go into an in-memory buffer plus the translog first; a refresh turns the buffer into a Lucene segment, and only then…
Because it has no multi-document transactions, no joins, and favors availability over consistency. Data loss during network partitions is documented behavior. Concrete gaps against an RDBMS: - No ACID transactions across documents. An update is delete plus reindex of the whole document. - No foreign…
Elasticsearch guesses field types for new fields. Convenient while prototyping, but it creates three production problems. 1. Wrong guesses you cannot fix — "1234" becomes text instead of long, "2026-01-15" becomes date when it is really an order code. Field types cannot change once data…
Query context computes relevance scores; filter context answers yes or no and is cached. Putting non-scoring conditions in must is a clear waste. The rule: every hard filter belongs in filter — status, price ranges, date ranges, category IDs. Only user-typed text needs scoring. mustnot…
Three factors: term frequency (more occurrences in a document scores higher), inverse document frequency (rarer terms across the index weigh more), and field length (a short field containing the term scores higher). Compared with older TF-IDF, BM25 adds saturation: repeating a term 100 times does…
Because deep pagination forces every shard to return from + size hits for the coordinating node to re-sort. from=100000 means each shard gathers 100,010 documents — heap cost grows linearly with depth and can OOM the cluster. The default index.maxresultwindow of 10,000 exists to stop…
No. On a multi-shard index a terms agg is approximate: each shard returns its local top N and the coordinating node merges them, so a term ranked 15th on every shard can outrank the reported top yet be missed entirely. The response says so explicitly:…
The default object type flattens arrays, so the relationship between fields inside one element is lost. The consequence: a query for color=red AND size=L still matches this document even though no such variant exists. A hard bug to spot because the results look plausible. The…
Two things: diacritics and compound words. The standard tokenizer splits on Unicode word boundaries. Vietnamese puts spaces between syllables, so "điện thoại" becomes two separate tokens "điện" and "thoại", and unaccented "dien thoai" will not match "điện thoại". Handling diacritics — index both forms with…
You cannot change it in place — create a new index with the correct mapping, reindex into it, then switch the alias. The alias is what makes this zero-downtime, so always point the application at an alias, never an index name. The alias switch is…
Use bulk with 5–15 MB batches, and disable refresh and replicas during the load. Why it works: every refresh creates a segment that later merges, and replicas make each document be written twice. Disabling both during the load and restoring them afterwards makes the load…
Segments are immutable — once written they cannot change. Every refresh creates a new segment, and Lucene merges small ones in the background. Three operational consequences: 1. An update is a delete plus a full reindex of the document. There is no in-place update. The…
Index templates apply mappings and settings automatically to indices matching a pattern, so daily indices never fall back to dynamic mapping. ILM then owns the lifecycle: roll over when an index is big or old enough, move it to cheaper nodes, and eventually delete it.…
Combine the text score with business signals through functionscore, without discarding the text score. log1p matters a lot: without it a product with 10,000 sales crushes every relevance signal and search turns into a bestseller list. Common signals: recent sales, rating, stock availability, and recency…
Three options, chosen by requirements: 1. The completion suggester — fastest, builds an in-memory FST, right when you only need prefix suggestions from a list. 2. searchasyoutype — a built-in field type generating n-grams, matching mid-phrase, easier than completion and still fast. 3. A hand-configured…
Server-side, with Elasticsearch highlight. A client that highlights by string matching only matches the literal typed string. To also highlight matches that come from stemming, synonyms, or accent folding, the client must reimplement the analyzer logic and keep it in sync with the server, which…
Because a text field is analyzed into many tokens, so there is no single value to compare. Sorting reads per-document values (doc values), and text produces none. The error is Fielddata is disabled on text fields by default. The correct approach sorts on the keyword…
Transforming documents before indexing, inside the cluster: parsing strings, converting types, adding fields, dropping sensitive ones, enriching data. The remove processor needs "ignoremissing": true. Without it, any document missing cardnumber or cvv fails and is not indexed. Index a document through the pipeline with the…
Yes. Replicas protect against node loss; snapshots protect against data loss. Delete an index by mistake and its replicas go instantly — a replica is a synchronous copy, not a point-in-time backup. Snapshots are incremental: only segments new since the last one are copied, so…
Because credentials in JavaScript are exposed to everyone, and the query DSL is powerful enough for a curious visitor to read all your data or take the cluster down. What an attacker can do against an open endpoint: - Query other indices (GET /all/search) and…
profile: true to break down query time, and the slow log to catch slow queries in production. Common causes, roughly by frequency: 1. Filters placed in must instead of filter — no cache and wasted scoring. 2. Deep pagination — a large from. 3. Leading-wildcard…
When you need a field computed at query time without reindexing: adding a field to old data, patching a wrong mapping urgently, or experimenting before committing to a real field. It is usable in queries, sorts and aggregations like a normal field, and costs no…
The static group — most importantly numberofshards. Changing it means a new index and a reindex. The analysis section (analyzers, tokenizers, filters) is static too, but less rigid: you can add or change analyzers by closing the index, updating the settings and reopening it. Changing…
Three approaches, in increasing order of reliability: 1. Dual write — the service writes to the database then to Elasticsearch. Simple but offers no guarantee: if the service dies after the database write, Elasticsearch misses that document forever. 2. Polling on updatedat — a periodic…
Two rules: no more than 50% of machine RAM and no more than about 31 GB. Going beyond 50% steals the OS page cache — and since Lucene reads segments from files, page cache largely determines search speed. A cluster with lots of heap and…
