mohclips / elastic-certified-engineer-exam-notes

Elastic Certified Engineer exam notes

My exam notes

You may find this useful, or not 😕

These notes are my work towards the Elastic Certified Engineer exam. The exam is hands on, thus no multiple choice senarios. You actually need to know it and be able to walk the walk. :D

Elastic are up front with the exam content with a large topic list you can see below. Thus this enables candidates to be able to work on senarios that are close to what will be in the exam. 😂

I passed on 14th October 2021. 😂 😂 😂

I had 10 questions with two clusters to work on in 3 hours.

Docker images

There are a number of docker images to use in the DockerComposeExamples folder in this repo. The Clustering will be useful.

Exam prep guide from Elastic

⭐ Video By Rich Raposa https://www.youtube.com/watch?v=hsaLZSKCkF0

✨ Certification FAQ https://www.elastic.co/training/certification/faq

⚠️ Pay particular attention to the version of ElasticSearch used in the exam. (this changes 1st July 2021) Currently, it is v7.13.

⭐ What is in the exam? https://www.elastic.co/training/elastic-certified-engineer-exam

Other exercises

I found the following to be very useful, but slightly out of date. I have linked to my own copies of the questions ad answers, and to the original blog posts. All kudos to them. :)

• The George Bridgeman Exercises at https://georgebridgeman.com/exercises/
• The Kreuzwerker at https://medium.com/kreuzwerker-gmbh/exercises-for-the-elastic-certified-engineer-exam-search-and-aggregations-1eefcfb6e992

Also.

• Linux Academy (now owned by A Cloud Guru) has an out of date course, but it is mainly very good. Here https://acloudguru.com/course/the-linux-academy-elastic-certification-preparation-course (I'd not pay for this until they have updated it to the v7.13 requirements, but if you get it for free from your Company, then it's worth the time)

Using the elastic.co docs

⚠️ It is very important you start to use the elastic.co website instead of google to search for solutions. The website is available to you in the exam (google is not 😊).

Use the Search icon at the right hand top of the site (highlighted in Yellow)

Elastic webinairs

Elastic have a lot of free webinars, you should check these out. Youtube.com holds a lot and are easier to look through/search than the elastic.co site.

Topics (post-July 2021 for v7.13)

❓ Based on https://www.elastic.co/training/elastic-certified-engineer-exam

I have also added the previous (pre-July 2021) exam topics in the headers and marked the new topics. As you can see most have been renamed or shuffled around. There are only a few new items and knowing how to build an ELK stack is now removed!?

Each topic below will have example questions and solutions. Click on the Link to follow to that topic.

💡 I should point out that if you are learing ElasticSearch then doing both the pre v7.2 and post 7.13 work is recommended, as it contains many things that are still very useful and probably required in daya to day support of ElasticSearch. But, if you are just looking to pass the exam, then you can do the post v7.13 work. Personally. i'd do both anyway.

What is not in here, that is in the exam?

⚠️ I didn't do any revision on boosting and scoring. But encountered a question on it in the exam. You have been warned. At present we are not doing this at work, thus i missed it.

PRs on this or anything else will be greatly accepted. 😄

Data Management (previously Indexing Data)

👉 Link (pre July 2021) v7.2

👉 Link (post July 2021) v7.13

• Define an index that satisfies a given set of requirements
• 🆕 Use the Data Visualizer to upload a text file into Elasticsearch
• Define and use an index template for a given pattern that satisfies a given set of requirements
• Define and use a dynamic template that satisfies a given set of requirements
• 🆕 Define an Index Lifecycle Management policy for a time-series index
• 🆕 Define an index template that creates a new data stream

Searching Data (Previously Queries/Aggregations)

👉 Link (pre July 2021) 👉 Link (pre july 2021) v7.2

👉 Link (post July 2021) v7.13

• Write and execute a search query for terms and/or phrases in one or more fields of an index
• Write and execute a search query that is a Boolean combination of multiple queries and filters
• 🆕 Write an asynchronous search
• Write and execute metric and bucket aggregations
• Write and execute aggregations that contain sub-aggregations
• Write and execute a query that searches across multiple clusters

Developing Search Applications (previously part of Queries/Indexing Data)

👉 Link (pre July 2021) v7.2 :point_right: Link (pre July 2021) v7.2

👉 Link (post July 2021) v7.13

• Highlight the search terms in the response of a query
• Sort the results of a query by a given set of requirements
• Implement pagination of the results of a search query
• Define and use index aliases
• Define and use a search template

Data Processing (previously Mappings and Text Analysis)

👉 Link (pre July 2021) v7.2

👉 Link (post July 2021) v7.13

• Define a mapping that satisfies a given set of requirements
• Define and use a custom analyzer that satisfies a given set of requirements
• Define and use multi-fields with different data types and/or analyzers
• Configure an index so that it properly maintains the relationships of nested arrays of objects (the following were previously part of the Indexing Data topic)
• Use the Reindex API and Update By Query API to reindex and/or update documents
• Define and use an ingest pipeline that satisfies a given set of requirements, including the use of Painless to modify documents
• Configure an index so that it properly maintains the relationships of nested arrays of objects

Cluster Management

👉 Link (pre July 2021) v7.2

👉 Link (post July 2021) v7.13

• Diagnose shard issues and repair a cluster's health
• Backup and restore a cluster and/or specific indices
• 🆕 Configure a snapshot to be searchable
• Configure a cluster for cross cluster search
• 🆕 Implement cross-cluster replication

elastic-certified-engineer-exam-notes's Issues

update-George-exercise-solution#20

Please correct the solution on your question #20 under georgebridgeman.md as I see the aggregation by gender is not taken into consideration.

It should be something similar like this,

GET /olympic_events-fixed/_search
{
"size": 0,
"query": {
"match": {
"event": "Gymnastics"
}
},
"aggs": {
"Male-Female-bucketization": {
"terms": {
"field": "gender",
"size": 10
},
"aggs": {
"avg-weight-of-Male-Female": {
"avg": {
"field": "weight"
}
}
}
}
}
}

Simple solution to the issue with Data management > Dynamic template task

Hi!

Many thanks for making this resource available for the rest of us! It's a goldmine.

Your example for the dynamic template works, it's just that the copy_to field does not show up in the _source part of the response. The documentation states that "The original _source field will not be modified to show the copied values".

The copy_to field still exists outside of _source and is searchable. To verify this with the example taken from the documentation:

POST my_index/_search
{
  "query": {
    "wildcard": {
      "full_name": {
        "value": "*John*",
        "case_insensitive": true
      }
    }
  }
}
# Returns the one document

My solution to the task focusing on the accounts data:

DELETE /_index_template/accounts-tmpl
DELETE accounts-fullname
# Then import the data with curl

PUT /_index_template/accounts-tmpl
{
  "index_patterns": [
    "accounts-*"
  ],
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0
    },
    "mappings": {
      "dynamic_templates": [
        {
          "fullname": {
            "path_match": "*name",
            "mapping": {
              "type": "text",
              "copy_to": "fullname"
            }
          }
        }
      ],
      "properties": {
        "account_number": {
          "type": "integer"
        },
        "balance": {
          "type": "long"
        },
        "firstname": {
          "type": "text",
          "copy_to": "fullname"
        },
        "lastname": {
          "type": "text",
          "copy_to": "fullname"
        },
        "gender": {
          "type": "keyword"
        },
        "address": {
          "type": "text"
        },
        "employer": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword"
            }
          }
        },
        "email": {
          "type": "keyword"
        },
        "city": {
          "type": "keyword"
        },
        "state": {
          "type": "keyword"
        }
      }
    }
  }
}

GET accounts-fullname/_mappings
# A mapping has been created for the fullname field

GET accounts-fullname/_search
{
  "query": {
    "wildcard": {
      "fullname": {
        "value": "*Duke*",
        "case_insensitive": true
      }
    }
  }
}
# This returns 2 documents
# Again, the copy_to field is searchable, but not visible through _source

Cheers / Erik

Wrong solution for a task at Data Management section

At the task Part 1 of Define and use an index template for a given pattern that satisfies a given set of requirements, I notice that the question ask to Create an index template called accounts-tmpl with a a field "employer" with both text and keyword type. But the solution only create a template with keyword type only as "employer" : { "type": "keyword" }.