Cross-cluster search in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the remote cluster name in the search request.

Elasticsearch

{
  "query": {
    "match_all": {}
  },
  "index": "[1]:logs-*"
}

Drag options to blanks, or click blank then click option'

Acluster1

Blocal

Cdefault

Dremote_cluster

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting the remote cluster prefix causes the search to run only on the local cluster.

Using an incorrect cluster name that is not configured.

The remote cluster name must be prefixed before the index pattern with a colon, e.g., 'remote_cluster:logs-*'.

2fill in blank

medium

Complete the code to configure the remote cluster seed nodes in the elasticsearch.yml file.

Elasticsearch

cluster.remote.remote_cluster.seeds: ["[1]:9300"]

Drag options to blanks, or click blank then click option'

A127.0.0.1

Blocalhost

C192.168.1.10

Dremotehost

Attempts:

3 left

💡 Hint

Common Mistakes

Using HTTP port 9200 instead of transport port 9300.

Using localhost or 127.0.0.1 which points to the local machine.

The seed node IP address must be the remote cluster's IP with the transport port 9300.

3fill in blank

hard

Fix the error in the search request to correctly query across clusters.

Elasticsearch

{
  "query": {
    "match": {
      "message": "error"
    }
  },
  "index": "[1]logs-*"
}

Drag options to blanks, or click blank then click option'

Aremote_cluster:

Bremote_cluster

Cremote_cluster-

D:remote_cluster

Attempts:

3 left

💡 Hint

Common Mistakes

Missing the colon causes the search to fail or run locally.

Using a dash or no separator instead of a colon.

The remote cluster name must be followed by a colon before the index pattern to indicate cross-cluster search.

4fill in blank

hard

Fill both blanks to create a cross-cluster search query that filters documents from the remote cluster with status 'error'.

Elasticsearch

{
  "query": {
    "bool": {
      "filter": [
        { "term": { "status": "[1]" } },
        { "term": { "cluster": "[2]" } }
      ]
    }
  },
  "index": "remote_cluster:logs-*"
}

Drag options to blanks, or click blank then click option'

Aerror

Bremote_cluster

Cwarning

Dlocal_cluster

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong status values like 'warning'.

Using local cluster name instead of remote cluster.

The filter must check for status 'error' and cluster name 'remote_cluster' to target the remote cluster logs with errors.

5fill in blank

hard

Fill all three blanks to build a dictionary comprehension that maps each index name from the remote cluster to its document count, filtering indices with more than 1000 docs.

Elasticsearch

index_counts = { [1]: [2] for [3] in indices if stats[[3]]['docs']['count'] > 1000 }

Drag options to blanks, or click blank then click option'

Aindex

Bstats[index]['docs']['count']

Dindices

Attempts:

3 left

💡 Hint

Common Mistakes

Using different variable names for key and loop variable.

Incorrectly accessing the document count in stats.

The comprehension iterates over 'index' in 'indices', maps 'index' to its doc count from stats, filtering counts > 1000.