Cross-cluster search in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Output of a basic cross-cluster search query

What is the output of the following Elasticsearch cross-cluster search query when searching for documents with status:active across two clusters named clusterA and clusterB?

Elasticsearch

GET clusterA:logs-2023,clusterB:logs-2023/_search
{
  "query": {
    "term": { "status": "active" }
  }
}

A Raises an error because cross-cluster search requires a special plugin

B Returns documents only from clusterA because clusterB is not included in the query

C Returns documents from clusterB only because clusterA is ignored in cross-cluster search

D Returns all documents with status 'active' from both clusterA and clusterB indices named logs-2023

💡 Hint

Cross-cluster search allows querying multiple clusters by prefixing the index name with the cluster alias.

The query targets indices named logs-2023 in both clusterA and clusterB. The term query filters documents with status 'active'. Cross-cluster search merges results from both clusters transparently.

🧠 Conceptual

intermediate

Understanding remote cluster configuration

Which statement correctly describes how to configure a remote cluster for cross-cluster search in Elasticsearch?

A You must add the remote cluster's seed nodes in the local cluster's settings under <code>cluster.remote.<cluster_name>.seeds</code>

B Remote clusters are automatically discovered without any configuration

C You need to install a plugin on both clusters to enable remote cluster communication

D Remote clusters must share the same cluster name to be searchable

💡 Hint

Think about how the local cluster knows where to find the remote cluster nodes.

To enable cross-cluster search, the local cluster must be configured with the remote cluster's seed nodes using the cluster.remote..seeds setting. This allows the local cluster to connect and query the remote cluster.

🔧 Debug

advanced

Identify the error in cross-cluster search query

Given the following cross-cluster search query, what error will Elasticsearch return?

Elasticsearch

GET clusterX:logs-2023/_search
{
  "query": {
    "match": { "message": "error" }
  }
}

A "No such remote cluster [clusterX]" error because clusterX is not configured

B SyntaxError due to missing curly braces around the query

C Returns empty results because no documents contain 'error' in message

D Timeout error because cross-cluster search is disabled by default

💡 Hint

Check if the remote cluster alias is configured in the local cluster.

If the remote cluster alias (clusterX) is not configured in the local cluster's settings, Elasticsearch will return a "No such remote cluster" error when attempting cross-cluster search.

📝 Syntax

advanced

Correct syntax for cross-cluster search index pattern

Which option shows the correct syntax to search across indices named logs-2023 in remote clusters east and west simultaneously?

A GET logs-2023@east,logs-2023@west/_search

B GET east:logs-2023,west:logs-2023/_search

C GET logs-2023:east,logs-2023:west/_search

D GET east.logs-2023,west.logs-2023/_search

💡 Hint

Remember the format is cluster_alias:index_name.

The correct syntax prefixes the index name with the cluster alias separated by a colon. Comma separates multiple indices or clusters.

🚀 Application

expert

Result count from cross-cluster search with filters

You run this cross-cluster search query to count documents with status:failed in clusters alpha and beta. Cluster alpha has 5 matching documents, beta has 3. What is the value of hits.total.value in the response?

Elasticsearch

GET alpha:app-logs,beta:app-logs/_search
{
  "query": {
    "term": { "status": "failed" }
  }
}

A 5

B 3

C 8

D 0

💡 Hint

Cross-cluster search merges results from all targeted clusters.

The total hits count sums matching documents from all clusters queried. Here, 5 from alpha plus 3 from beta equals 8.