Elasticsearch Interview Questions

1. What is Elasticsearch and what problems does it solve?

2. What is the difference between Elasticsearch and a relational database?

3. What is an inverted index and how does it power Elasticsearch search?

4. What is a document, index, and shard in Elasticsearch?

5. What is the difference between a primary shard and a replica shard in Elasticsearch?

6. How does Elasticsearch achieve near real-time search?

7. What is the difference between a term query and a match query in Elasticsearch?

8. What is analysis in Elasticsearch and how do analyzers, tokenizers, and filters work?

9. What is mapping in Elasticsearch and why does it matter?

10. What is the difference between keyword and text field types in Elasticsearch?

11. What is the difference between filter context and query context in Elasticsearch?

12. How does relevance scoring work in Elasticsearch with BM25?

13. What are aggregations in Elasticsearch and what can they do?

14. What is the difference between a bucket aggregation and a metric aggregation in Elasticsearch?

15. How does Elasticsearch handle full-text search vs exact matching?

16. What is a bool query in Elasticsearch and how do must, should, must_not, and filter work?

17. How does sharding and routing work in Elasticsearch?

18. How does Elasticsearch handle scaling and cluster health (green, yellow, red)?

19. What is the role of the coordinating node in an Elasticsearch query?

20. What is the query then fetch process in Elasticsearch search?

21. How does Elasticsearch handle updates and why are documents immutable?

22. What is a refresh and a flush in Elasticsearch?

23. What is the difference between Elasticsearch and Apache Solr?

24. What is the ELK stack and how do the components fit together?

25. How do you handle pagination in Elasticsearch and why is deep pagination a problem?

26. What is an alias in Elasticsearch and how does it help with reindexing?

27. How does Elasticsearch handle nested objects and the nested data type?

28. What is index lifecycle management (ILM) in Elasticsearch?

29. How do you improve indexing and search performance in Elasticsearch?

30. What is a fuzzy query in Elasticsearch and how does it handle typos?

31. How do you size shards in Elasticsearch, and what goes wrong when a cluster is oversharded?

32. What is a mapping explosion in Elasticsearch, and how do you stop dynamic mapping from causing one?

33. How does refresh_interval affect indexing throughput, and what would you tune for a large bulk load?

34. How do search_after and point-in-time replace from/size for deep pagination, and when would you still use scroll?

35. Why do BM25 relevance scores often surprise people, and how do you tune relevance in production?

36. How do you stop aggregations from exhausting heap in Elasticsearch, and what do circuit breakers tell you?

37. An Elasticsearch cluster has gone red in production — how do you diagnose and recover it?

38. How do Elasticsearch snapshots and restores actually work, and how would you plan disaster recovery around them?

39. How does Elasticsearch handle concurrent updates, and what causes a version_conflict_engine_exception?

40. How do you debug a slow Elasticsearch query in production without guessing?

41. How do data tiers and searchable snapshots change the cost of keeping old data queryable in Elasticsearch?

42. What causes es_rejected_execution_exception in Elasticsearch, and how should a client handle it?

43. How do you size JVM heap for an Elasticsearch node, and how do you diagnose heap pressure and long GC pauses?

44. How do you plan and execute a rolling upgrade of an Elasticsearch cluster without downtime?

45. How do you harden an Elasticsearch cluster: authentication, TLS, roles and least-privilege access?

46. When would you use cross-cluster search versus cross-cluster replication in Elasticsearch?

47. How does Elasticsearch elect a master node and avoid split brain, and what goes wrong in a network partition?

48. How do you run a very large reindex in production Elasticsearch without disrupting live traffic?

49. How do Elasticsearch ingest pipelines work, and how do you handle processor failures without losing documents?

50. Which caches does Elasticsearch use for search, and when does each one get invalidated?

51. When should you use runtime fields in Elasticsearch instead of indexed fields, and what do they cost?

52. What do you need to get right to run kNN vector search in production Elasticsearch?

53. A user searches for a word that is plainly in the document and gets nothing back. How do you debug it?

54. An aggregation on a text field fails and tells you to enable fielddata. What is actually going on, and what should you do?

55. For time-series data, when do you use a data stream rather than managing a rollover alias yourself?

56. What does the profile API actually tell you about a slow query, and what does it not show?

57. In a multi_match query, how do you choose between best_fields, most_fields and cross_fields?

58. How do you model a one-to-many relationship in Elasticsearch — nested, join field, or denormalisation?

59. How do you manage a synonym list in Elasticsearch without reindexing every time it changes?

60. Why can the same document score differently depending on which shard it lands on, and what does dfs_query_then_fetch do about it?

61. How would you build search-as-you-type autocomplete in Elasticsearch, and what are the trade-offs of each approach?