Cluster, node, and shard architecture in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Elasticsearch cluster health API call?

Consider an Elasticsearch cluster with 3 nodes and 5 primary shards per index. You run the following API call:

GET /_cluster/health

What key value will the status field most likely show if all nodes and shards are functioning correctly?

Elasticsearch

GET /_cluster/health

A "status": "green"

B "status": "blue"

C "status": "red"

D "status": "yellow"

💡 Hint

Think about what the cluster health colors mean in Elasticsearch.

In Elasticsearch, green means all primary and replica shards are allocated and the cluster is fully functional. Yellow means all primary shards are allocated but some replicas are not. Red means some primary shards are unallocated. Blue is not a valid status.

🧠 Conceptual

intermediate

How many shards will an index have if it is created with 4 primary shards and 2 replicas?

You create an index in Elasticsearch with 4 primary shards and set the number of replicas to 2. How many total shards will this index have?

A 8

B 6

C 4

D 12

💡 Hint

Remember that replicas are copies of primary shards.

Total shards = primary shards + (primary shards × number of replicas). Here, 4 + (4 × 2) = 12 shards.

🔧 Debug

advanced

Identify the error in this node allocation setting

Given the following Elasticsearch node setting snippet, what error will occur when starting the node?

node.attr.zone: us-east-1a
node.attr.zone: us-east-1b

A RuntimeError: Invalid zone attribute value

B Node will start normally with zone set to 'us-east-1b'

C SyntaxError: Duplicate key 'node.attr.zone' in configuration

D Warning: Multiple zones assigned, node will be assigned to first zone

💡 Hint

Check if the same key is repeated in the configuration file.

YAML or properties files do not allow duplicate keys. Defining 'node.attr.zone' twice causes a syntax error during parsing.

❓ Predict Output

advanced

What is the output of this shard allocation filtering query?

Assume you have a cluster with nodes tagged by zone attribute. You run this allocation filtering query:

GET /_cluster/allocation/explain
{
  "index": "myindex",
  "shard": 0,
  "primary": true
}

The node has node.attr.zone: us-west-2a but the index has allocation filtering set to include.zone: us-east-1a. What will the explanation say about shard allocation?

A Shard cannot be allocated to node because node zone 'us-west-2a' is excluded by allocation filtering

B Shard allocation failed due to missing primary shard

C Shard allocation delayed due to node overload

D Shard allocated successfully to node in zone 'us-west-2a'

💡 Hint

Think about how allocation filtering works with node attributes.

Allocation filtering restricts shards to nodes with matching attributes. Since the node's zone does not match the include filter, the shard cannot be allocated there.

🧠 Conceptual

expert

How does Elasticsearch handle shard rebalancing when a new node joins the cluster?

When a new node joins an Elasticsearch cluster, how does the cluster decide to rebalance shards across nodes?

A Shards remain on original nodes until manually moved by the administrator

B Elasticsearch automatically moves shards to the new node to balance disk usage and shard count

C New shards are created on the new node but existing shards stay put

D The cluster shuts down and restarts to redistribute shards evenly

💡 Hint

Consider Elasticsearch's automatic cluster management features.

Elasticsearch automatically rebalances shards to spread load and disk usage evenly when nodes join or leave the cluster.

Practice

1. What is a node in Elasticsearch cluster architecture?

easy

A. A single machine that is part of the cluster

B. A group of machines working together

C. A piece of data stored in the index

D. A backup copy of data

Solution

1. Step 1: Understand the definition of a node

   A node is one machine or server that joins the Elasticsearch cluster to share work.

2. Step 2: Differentiate node from cluster and shard

   A cluster is many nodes working together; shards are parts of data inside nodes.

3. Final Answer:

   A single machine that is part of the cluster -> Option A

4. Quick Check:

   Node = single machine [OK]

Hint: Node means one machine in the cluster [OK]

Common Mistakes:

• Confusing node with cluster
• Thinking node is a data piece
• Mixing node with shard

2. Which of the following is the correct way to describe a shard in Elasticsearch?

easy

A. A part of an index that stores data

B. A node in the cluster

C. A full copy of the entire index

D. A cluster of nodes

Solution

1. Step 1: Define what a shard is

   A shard is a smaller piece or partition of an index that holds part of the data.

2. Step 2: Compare with other options

   It is not a full copy (that's a replica), not a node or cluster.

3. Final Answer:

   A part of an index that stores data -> Option A

4. Quick Check:

   Shard = index part [OK]

Hint: Shard means a data part of an index [OK]

Common Mistakes:

• Thinking shard is a full index copy
• Confusing shard with node
• Mixing shard with cluster

3. Consider an Elasticsearch cluster with 3 nodes and an index configured with 5 primary shards and 1 replica per shard. How many total shards will be in the cluster?

medium

A. 5 shards

B. 10 shards

C. 6 shards

D. 15 shards

Solution

1. Step 1: Calculate total shards per primary and replica

   Each primary shard has 1 replica, so total shards = primary shards + replicas = 5 + 5 = 10 shards.

2. Step 2: Understand shard distribution across nodes

   Since there are 3 nodes, shards are distributed but total shards remain 10. However, the question asks total shards in cluster, including replicas.

3. Step 3: Re-check options

   15 shards says 15 shards, which is incorrect. The correct total is 10 shards.

4. Final Answer:

   10 shards -> Option B

5. Quick Check:

   Total shards = primary + replica = 5 + 5 = 10 [OK]

Hint: Total shards = primary shards x (1 + replicas) [OK]

Common Mistakes:

• Counting only primary shards
• Adding nodes to shard count incorrectly
• Confusing replicas with nodes

4. You have an Elasticsearch cluster with 2 nodes and an index with 4 primary shards and 1 replica. You try to assign 2 replicas per shard. What is the problem with this configuration?

medium

A. Replicas must be zero for cluster to work

B. Primary shards must be equal to replica shards

C. Number of nodes must be equal to number of shards

D. You cannot have more replicas than nodes minus one

Solution

1. Step 1: Understand replica shard limits

   Replicas cannot exceed the number of nodes minus one because replicas cannot be on the same node as primary.

2. Step 2: Apply to given cluster

   With 2 nodes, max replicas per shard = 1 (2 - 1). Trying 2 replicas is invalid.

3. Final Answer:

   You cannot have more replicas than nodes minus one -> Option D

4. Quick Check:

   Replicas ≤ nodes - 1 [OK]

Hint: Replicas max = nodes minus one [OK]

Common Mistakes:

• Setting replicas more than nodes - 1
• Confusing primary and replica counts
• Assuming replicas can be zero always

5. You want to design an Elasticsearch cluster for high availability with 4 nodes. You plan to create an index with 6 primary shards and 2 replicas per shard. What is the best shard and replica configuration to avoid shard allocation errors?

hard

A. 6 primary shards and 3 replicas per shard, total 24 shards

B. 6 primary shards and 2 replicas per shard, total 18 shards

C. 6 primary shards and 1 replica per shard, total 12 shards

D. 4 primary shards and 2 replicas per shard, total 12 shards

Solution

1. Step 1: Check replica limit based on nodes

   With 4 nodes, max replicas per shard = nodes - 1 = 3. So 2 replicas is allowed.

2. Step 2: Consider shard allocation rules

   Each shard copy must be on a different node. 6 primary shards + 2 replicas = 18 shards total, but 18 shards on 4 nodes means some nodes hold multiple shards.

3. Step 3: Avoid allocation errors by balancing shards

   Too many shards per node can cause performance issues. 1 replica (total 12 shards) is safer and avoids errors.

4. Final Answer:

   6 primary shards and 1 replica per shard, total 12 shards -> Option C

5. Quick Check:

   Replicas ≤ nodes - 1 and balanced shards [OK]

Hint: Replicas max = nodes - 1; balance shards per node [OK]

Common Mistakes:

• Setting replicas more than nodes - 1
• Ignoring shard distribution limits
• Choosing fewer shards than needed