Elasticsearch Interview Questions and Answers

Elasticsearch interviews test whether you can explain how search works inside, and whether you can keep a cluster fast and healthy. This guide gives you 47 Elasticsearch interview questions and answers, from basics to scenario questions, for freshers and experienced engineers.

Every answer begins with a short, direct response you can say aloud, followed by a table or a request you can try in Kibana. The page reflects current Elasticsearch: one primary shard by default, BM25 relevance, a bundled JDK, no mapping types and vector search for AI applications.

The guide has seven parts: 9 on Elasticsearch basics, 8 on mappings and analysis, 6 on queries and aggregations, 10 on architecture and internals, 4 on vector and semantic search, 4 on the Elastic Stack and comparisons and 6 scenario questions. Use the contents list to jump to your level.

Key points

• 47 questions in seven parts, from basics to scenarios.
• Current for Elasticsearch 9.x, with removed features clearly avoided.
• Request examples you can run in Kibana Dev Tools.
• New section on vector, hybrid and semantic search.
• Scenario answers with a first check, a fix and a way to prevent it.

In this guide

Elasticsearch Basics (Freshers)

Start with what Elasticsearch is, how data is organised, and why search is fast. These answers come up in almost every interview.

Q1. What is Elasticsearch, and what is it used for?

Elasticsearch is a distributed search and analytics engine built on Apache Lucene. It stores JSON documents, indexes every field, and returns results in near real time. Common uses are website and application search, log and metrics analysis, security analytics, and, in current versions, vector and semantic search for AI applications.

Q2. What is the difference between an index, a document and a field?

An index is a collection of documents that share a similar structure, like a table in a database. A document is one JSON record, like a row. A field is a key inside a document, like a column. Elasticsearch has no schema requirement up front, but it keeps a mapping that records field types.

Q3. What is an inverted index?

An inverted index maps each term to the list of documents that contain it, the reverse of a normal index that maps a document to its words. To search for a word, Elasticsearch looks up the term and gets the matching documents at once, which makes full text search fast, even across millions of documents.

Lucene builds one inverted index for each text field in each shard segment.

Q4. What are shards and replicas?

An index is split into primary shards, and each shard is a self contained Lucene index that can live on any node. This spreads data and work across the cluster. A replica is a copy of a primary shard on a different node, which gives fault tolerance and extra read capacity. A replica never sits on the same node as its primary.

What the interviewer is listening for: You explain both purposes of replicas, which are failover and read throughput.

Q5. How many primary shards and replicas does an index have by default?

Since Elasticsearch 7.0, a new index gets one primary shard and one replica by default. Earlier versions used five primary shards, which led to many small shards. The primary shard count is fixed when the index is created, though you can use the split or shrink APIs, while the replica count can change at any time.

What the interviewer is listening for: You know that the old default of five shards is gone and that primary shard count cannot simply be edited.

Q6. What is a node, a cluster and a node role?

A node is one running Elasticsearch instance, and a cluster is a group of nodes that share the same cluster name and work together. Nodes have roles, such as master eligible, data, ingest and coordinating. Larger clusters use dedicated master nodes, and tiered data nodes such as hot, warm and cold.

Q7. Does Elasticsearch need Java installed?

No. Packages of Elasticsearch ship with a bundled JDK, and that is the supported and recommended way to run it. You can point it to your own JDK with ES_JAVA_HOME, but only for supported versions. You do not need to install Java first, which is a common mistake in old tutorials.

Q8. What does near real time mean in Elasticsearch?

A new document is not searchable the instant it is indexed. It becomes visible after the next refresh, which happens every second by default on an index that is being searched. The data is safe earlier, because writes also go to the translog. So search is near real time, with a delay of about one second.

Q9. What are the main REST operations, and how do you index and fetch a document?

Elasticsearch has a REST API over HTTP and JSON. Use PUT or POST to index a document, GET to read it, and DELETE to remove it. There are no mapping types in current versions, so the path uses the index name and the document ID, with the underscore doc endpoint.

PUT products/_doc/1

{
  "name": "Insulated gloves",
  "price": 1250,
  "in_stock": true
}

GET products/_doc/1

Mappings, Analysis and Text Search (Intermediate Level)

This is where search quality is decided. Know how text is broken into terms, and how field types change the result.

Q10. What is the difference between the text and keyword field types?

A text field is analysed, meaning it is split into terms and lowercased, so it suits full text search. A keyword field is stored as one exact value, so it suits filtering, sorting and aggregations, for example on an ID, a status or a country code. Use a multi field to have both.

PUT products

{
  "mappings": {
    "properties": {
      "name": {
        "type": "text",
        "fields": { "raw": { "type": "keyword" } }
      },
      "price": { "type": "float" }
    }
  }
}

Search the name field for full text, and use name.raw to sort or aggregate.

Q11. What is an analyzer and what does it consist of?

An analyzer turns text into terms, both when indexing and when searching. It has three parts in order: character filters that clean the text, one tokenizer that splits it into tokens, and token filters that change the tokens, such as lowercasing, removing stop words or stemming. The standard analyzer is the default.

Q12. How do you test what an analyzer does?

Use the analyze API with an analyzer name and a sample text. It returns the tokens that would be indexed. This is the fastest way to debug why a search did or did not match, since a mismatch usually comes from a different analyzer at index time and at search time.

POST _analyze

{
  "analyzer": "standard",
  "text": "Rubber Insulating Mats"
}

The standard analyzer returns three tokens: rubber, insulating and mats, all in lowercase.

Q13. What is the difference between dynamic and explicit mapping?

With dynamic mapping, Elasticsearch guesses a field type from the first value it sees, which is quick but can guess wrongly, for example a text field where you wanted a keyword or a date. With explicit mapping you define the types yourself. Use explicit mapping in production, and set dynamic to strict for sensitive indices.

Q14. Can you change the type of an existing field?

No. A mapping for an existing field cannot be changed, because the data is already indexed under that type. Create a new index with the correct mapping, then copy the data over with the reindex API and switch an alias to the new index. Aliases let applications keep the same name.

Q15. What is a mapping explosion and how do you prevent it?

A mapping explosion happens when dynamic mapping creates too many fields, for example from user supplied keys, which bloats the cluster state and slows the cluster. Prevent it by using explicit mappings, turning dynamic off or to strict, and relying on the index total fields limit, which defaults to 1000. A flattened field type can hold arbitrary keys.

Q16. How does Elasticsearch score and rank results?

Elasticsearch scores each match with BM25, the default relevance algorithm since version 5.0. BM25 rewards terms that are frequent in the document but rare across the index, and it limits the benefit of repeated words and long documents. You can adjust ranking with boosts, function scores and, for AI search, a combined ranking of text and vector results.

What the interviewer is listening for: You say BM25 is the default, and you can explain term frequency and inverse document frequency in plain words.

Q17. What is the difference between match, match_phrase and term queries?

A match query analyses the query text and finds documents containing any of the terms. A match_phrase query needs the terms to appear together in order. A term query does not analyse the input and looks for an exact value, so it is meant for keyword, number and date fields, not analysed text.

Queries, Aggregations and Pagination (Intermediate Level)

Interviewers often ask you to write a query on paper. Practise the bool query until it feels natural.

Q18. How do you combine conditions with the bool query?

A bool query combines clauses. Must clauses have to match and contribute to the score. Filter clauses have to match but do not affect the score, and they are cached. Should clauses are optional and raise the score. Must_not clauses exclude documents. Put exact conditions in filter for speed.

GET products/_search

{
  "query": {
    "bool": {
      "must": [
        { "match": { "name": "insulating mat" } }
      ],
      "filter": [
        { "term": { "in_stock": true } },
        { "range": { "price": { "lte": 5000 } } }
      ],
      "must_not": [
        { "term": { "discontinued": true } }
      ]
    }
  }
}

The old filtered query was removed long ago. A bool query with a filter clause replaces it.

Q19. What is the difference between a query context and a filter context?

In query context, Elasticsearch asks how well a document matches and calculates a relevance score. In filter context, it asks only whether the document matches, with a yes or no answer and no score. Filters are faster, and Elasticsearch can cache them, so use them for exact conditions.

Q20. How do aggregations work?

Aggregations compute summaries over the matching documents. Bucket aggregations group documents, for example by category or by date range. Metric aggregations calculate values such as average, sum or maximum. You can nest metrics inside buckets, which gives results like average price per category. Aggregations use doc values on keyword and numeric fields.

GET products/_search

{
  "size": 0,
  "aggs": {
    "by_category": {
      "terms": { "field": "category" },
      "aggs": { "avg_price": { "avg": { "field": "price" } } }
    }
  }
}

Q21. How do you paginate deep results?

The from and size parameters work for shallow pages but are limited to 10,000 hits by default. For deep paging, use search_after with a stable sort, ideally inside a point in time, which gives a consistent view. The scroll API is no longer recommended for deep pagination in user facing searches.

Q22. What is the difference between a fuzzy query and a prefix or wildcard query?

A fuzzy query matches terms within a set edit distance, so it tolerates spelling mistakes. A prefix query matches terms that start with given letters, and a wildcard query matches patterns. Leading wildcards are slow because they scan many terms. For search as you type, use the completion suggester or the search as you type field.

Q23. What is ES|QL?

ES|QL is the Elasticsearch piped query language. You write a source, then chain commands with the pipe sign to filter, transform and aggregate, much like a shell or SQL. It is executed on the cluster and is suited to analytics and exploration. Recent versions added joins with a lookup index.

FROM logs
| WHERE status >= 500
| STATS errors = COUNT(*) BY service
| SORT errors DESC
| LIMIT 5

Architecture and Internals (Experienced)

Experienced candidates are expected to explain what happens inside a shard and how the cluster stays healthy.

Q24. What happens when you index a document?

The request reaches a coordinating node, which hashes the document ID to pick a primary shard. The primary writes the document to an in memory buffer and the translog, then forwards it to the replicas. When all in sync copies confirm, the client gets a response. A refresh later makes it searchable in a new segment.

Q25. What are segments, refresh, flush and merge?

A shard is made of immutable segments. A refresh writes the memory buffer to a new segment so it can be searched. A flush commits segments to disk and clears the translog. A merge combines small segments into larger ones in the background and removes deleted documents. Updates are a delete plus a new index operation.

Q26. What is the translog?

The translog is a write ahead log kept for each shard. Every operation is recorded in it before it is acknowledged, so if a node crashes before the data is flushed to disk, Elasticsearch replays the translog on restart. It gives durability between refreshes and flushes.

Q27. What do the cluster health colours mean?

Green means all primary and replica shards are assigned. Yellow means all primaries are assigned but some replicas are not, so data is safe but redundancy is reduced. Red means at least one primary shard is not assigned, so some data is unavailable. A single node cluster with replicas set to one stays yellow.

Q28. How does the cluster elect a master, and what happened to split brain?

Master eligible nodes elect a master using a quorum based voting process, which has been automatic since Elasticsearch 7. The cluster manages its own voting configuration, so you no longer set minimum master nodes by hand. Keep an odd number of master eligible nodes, usually three, so a majority always exists.

What the interviewer is listening for: You mention quorum, an odd number of masters and the removal of the old manual setting.

Q29. How do you size shards and the JVM heap?

A common guide is to keep shards between 10 and 50 gigabytes, and to avoid thousands of tiny shards, since each shard costs memory. Give the heap at most half of the machine memory, and keep it below about 31 gigabytes so compressed object pointers stay on. The rest of the memory is used by the file system cache.

Q30. What is index lifecycle management, and what are data streams?

Index lifecycle management, or ILM, automates the life of time series indices through phases: hot, warm, cold, frozen and delete, based on age or size. A data stream is an append only series of backing indices that hides rollover from the application. Together they handle logs and metrics without manual index management.

Q31. How do you back up Elasticsearch?

Use snapshots. A snapshot repository stores copies of the cluster data in shared storage such as object storage, and snapshots after the first are incremental. Automate them with snapshot lifecycle management, and test a restore regularly. Copying data directories from a running node is not a safe backup.

Q32. How do you improve indexing speed?

Use the bulk API with batches of a few megabytes, send from several threads, and raise the refresh interval or turn replicas off during a large initial load. Use explicit mappings, avoid unneeded fields and let Elasticsearch generate document IDs where possible. Monitor bulk rejections as a sign of overload.

Q33. How do you improve search performance?

Put exact conditions in filter context so they are cached, avoid leading wildcards and deep pagination, and keep shard counts sensible. Use routing for tenant based data and force merge on indices that no longer change. Profile slow queries with the profile API, and check that the file system cache has enough memory.

Vector and Semantic Search (Current Features)

Elasticsearch 8 and 9 are heavily used for retrieval in AI applications. Expect at least one question here in a 2026 interview.

Q34. What is vector search in Elasticsearch?

Vector search stores each document as a dense vector of numbers, an embedding that captures meaning, in a dense_vector field. A kNN query finds the stored vectors closest to the vector of the query, so it can find results with similar meaning, even when no words match. It is the base of semantic search and retrieval for AI answers.

PUT docs

{
  "mappings": {
    "properties": {
      "text": { "type": "text" },
      "embedding": { "type": "dense_vector", "dims": 384 }
    }
  }
}

Q35. What is hybrid search?

Hybrid search combines keyword search, such as BM25, with vector search, then merges the two result lists, commonly using reciprocal rank fusion. It beats either method alone, since keywords catch exact names and codes while vectors catch meaning. Elasticsearch offers retrievers to describe such combined searches in one request.

Q36. What is the semantic_text field?

The semantic_text field type simplifies semantic search by handling the chunking and the embedding for you. You map a field as semantic_text, index plain text, and Elasticsearch creates the embeddings through an inference endpoint. You then search with a semantic query. This removes the pipeline code that older versions needed.

Q37. What is BBQ quantization?

Better Binary Quantization, or BBQ, compresses each vector dimension to a single bit, which cuts the memory needed for large vector indices dramatically while keeping good recall, especially when combined with a rescoring step. It reached general availability in the 9.x line and is a key cost control for big vector workloads.

Elastic Stack and Comparisons (All Levels)

Be ready to place Elasticsearch in a wider system and to say when not to use it.

Q38. What is the Elastic Stack?

The Elastic Stack is Elasticsearch for storage and search, Kibana for dashboards and exploration, Logstash for server side data processing, and Beats and Elastic Agent for collecting data from machines. Older material calls it the ELK Stack. Teams may also use Kafka as a buffer in front of the pipeline.

Q39. What is the difference between Elasticsearch and a relational database?

A relational database is built for transactions, joins and strict consistency. Elasticsearch is built for fast full text search, filtering and aggregations over large volumes, with eventual visibility of writes. Do not use it as the only source of truth for transactional data. Keep the record in a database and index a copy for search.

Q40. How do you handle relationships between documents?

Prefer denormalisation, which means storing related data together in one document, because joins are costly. For arrays of objects that must be matched together, use the nested type. Parent and child joins exist but are slower and are rarely the first choice. In ES|QL, a lookup join can enrich results from a small index.

Q41. What is the difference between Elasticsearch and Solr or OpenSearch?

All three use Lucene. Solr is an older Apache project with its own query and configuration style. OpenSearch is a fork of Elasticsearch 7.10 maintained by AWS and a community. The APIs are similar for basic use but have diverged, so check the version and the client library before moving between them.

Scenario Questions (Experienced)

State what you would check first, then the fix, and finish with how you would prevent it.

Q42. Cluster health is yellow after a node restart. What do you do?

Yellow means some replicas are unassigned. Check the allocation explain API to see why, which usually shows the node is still rejoining, a disk watermark is blocking allocation or allocation is disabled. Wait for recovery on a normal restart, free disk space if a watermark was hit, and confirm health returns to green.

GET _cluster/health

GET _cluster/allocation/explain

GET _cat/shards?v&h=index,shard,prirep,state,unassigned.reason

Q43. Search has become slow after the index grew. How do you find the cause?

Use the slow log and the profile API to find the expensive queries. Check shard size and count, heap use, merge pressure and whether filters are cached. Common fixes are moving exact conditions into filters, replacing leading wildcards, reducing deep paging, adding replicas for read load and splitting or rolling over an oversized index.

Q44. You must change a field type on a production index with no downtime. How?

Create a new index with the correct mapping, reindex the data into it, keep applications reading through an alias, and switch the alias to the new index in one atomic call. If writes continue meanwhile, reindex again from a timestamp, or write to both indices briefly, before the switch.

Q45. Logs grow by 200 GB a day and disk cost is rising. What is your design?

Use a data stream with index lifecycle management. Keep recent data on hot nodes, move to warm and cold tiers as it ages, and use searchable snapshots for the frozen tier. Set retention to what compliance needs, drop unneeded fields at ingest, and use best compression. Size shards between 10 and 50 gigabytes.

Q46. A node ran out of heap and the cluster went red. What now?

First restore service: bring the node back, and check that primaries are assigned. Then find the cause, such as too many shards, large aggregations, a mapping explosion or fielddata on text fields. Fix with fewer shards, circuit breaker limits, doc values and query limits. Add heap monitoring and alerts for the future.

Q47. How would you build search for an online product catalogue?

Index products with explicit mappings, a text field with an analyzer suited to the language, keyword fields for facets such as brand and category, and numeric fields for price. Use a bool query with filters for facets, boosts for relevance, and aggregations for the filter counts. Add synonyms and a completion suggester, and measure with click data.

What the interviewer is listening for: You separate text fields from facet fields, and you mention measuring relevance with real user behaviour.

Common questions about Elasticsearch interviews

What topics should I prepare for an Elasticsearch interview?

Prepare indices, shards and replicas, mappings and analyzers, the bool query, aggregations and cluster health first. Then study the indexing path, segments, shard sizing and lifecycle management. In 2026 also learn vector and hybrid search. Be ready to write a query by hand and to explain a slow search.

Is Elasticsearch a database?

It stores and indexes data, but it is a search and analytics engine, not a replacement for a transactional database. It offers near real time visibility of writes and limited joins. Most systems keep the source of truth in a database and use Elasticsearch for search and analysis.

Which Elasticsearch version should I learn?

Learn the current 9.x line, since the basics carry over from 8.x. Know the removed items that older tutorials still show: mapping types, the filtered query, the default of five shards and the need to install Java. Check the official release notes for what is new.

Do I need Kibana for the interview?

You should know Kibana at a basic level, because Dev Tools is the usual place to run queries and Discover and dashboards are the usual tools for logs. Practise reading a query response and building a simple chart.

How can I practise Elasticsearch at home?

Run a single node with the official container or package, load a sample dataset, and try the queries in Kibana Dev Tools. Build a small product search, then break it on purpose by creating a bad mapping, and fix it using reindex and an alias.

A four week plan to prepare

Use this plan if you have about a month before your interview.

Practise with a trainer

If you want to practise these questions with a trainer and work on hands on projects, you can book a free demo class for the Prwatech Big Data course. It covers search and analytics tools, data pipelines and hands on projects.

Contact the learning team for current batch dates and fees.

India’s Leading Big Data Training Institute

Written by Mithun Ray, data engineering trainer at Prwatech. Reviewed by Avishekh Verma. Last updated October,2026.