ELK Stack Interview Questions

Elasticsearch (ES)

• How to install Elasticsearch on bare metal?
• How to install Elasticsearch in k8s cluster?
• What is an index in RDBMS world and what it is in ES?
• If hierarchy in RDBMS is RDBMS => Databases => Tables => Columns/Rows, what is a hierarchy in ES?
• Does ES require upfront schema definition for storing a new data? Why?
• In which data format ES stores documents in?
• How is index created?
• How is index used?
• Explain process of indexing.
• What is an Elasticsearch index? | Elastic Blog
• 
  
• What are shards? Primary shards?
• What is the difference between index, shard and node?
• Index Shard Node Explained
• What is data stream?
• What are index templates (what is their purpose)?
• What is their purpose in the context of data streams?
• Explain index patterns - what determines which pattern will be used during creation of indices or data streams?
• Is it possible to see them in Kibana? How?
• What are component templates?
• What do they configure? (3)
• Is it possible to see them in Kibana? How?
• What are mappings?
• What are settings?
• Explain index lifecycle
• Explain default pipeline
• Explain number of shards
• Explain number of replicas
• Explain routing allocation 
• What are aliases?
• Can index templates contain mappings, settings and aliases directly?
• Index templates | Elasticsearch Guide [8.16] | Elastic
• What are index lifecycle management (ILM) policies used for?
• Which actions can be triggered by Index lifecycle policies?
• Explain Rollover
• Explain Shrink
• Explain Force merge
• Explain Delete
• Explain hot-warm-cold architecture
• Explain the following phases of the index lifecycle:
• hot
• warm
• cold
• frozen
• delete
• give an example of ILM policy for such architecture
• How are actions defined for each phase (elasticstack_elasticsearch_index_lifecycle | Resources | elastic/elasticstack | Terraform | Terraform Registry)? 
• Index lifecycle | Elasticsearch Guide [8.16] | Elastic
• Implementing Hot-Warm-Cold in Elasticsearch with Index Lifecycle Management | Elastic Blog
• Is it possible to see ILM policies in Kibana? How?
• ILM: Manage the index lifecycle | Elasticsearch Guide [8.16] | Elastic
• ILM overview | Elasticsearch Guide [8.16] | Elastic
• What are snapshots?
• Snapshot and restore | Elasticsearch Guide [8.16] | Elastic
• What is mapping?
• What is each document made of?
• What 2 types of fields are in mapping definition? 
• What's the purpose of metadata fields?
• What are the 2 types of mapping?
• What is Dynamic Mapping?
• What is Explicit Mapping?
• What is a field data type (field type)?
• What are text field values used for? 
• What are keyword field values used for?
• Mapping | Elasticsearch Guide [8.16] | Elastic
• What are Ingest Pipelines? 
• What do they do and when?
• What do ingest pipelines consist of?
• What tasks do processors do? (3)
• Do processors run sequentially or in parallel?
• Can Ingest Pipelines be added/editet in Kibana? How?
• Ingest pipelines | Elasticsearch Guide [8.16] | Elastic
• Node types
• The role of master node
• What is shard rebalancing?
• What impacts the success of shard rebalancing?
• How to control on which node can a shard be allocated?

Kibana

• How to install Kibana on bare metal?
• How to install Kibana in k8s cluster?
• What are Dashboards?
• What are Alerts?
• How to back up and Elastic objects like dashboards and alerts? How to restore them in another Elastic instance?
• TBC