Cross-cluster search in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the remote cluster name in the search request.

Elasticsearch

{
  "query": {
    "match_all": {}
  },
  "index": "[1]:logs-*"
}

Drag options to blanks, or click blank then click option'

Acluster1

Blocal

Cdefault

Dremote_cluster

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting the remote cluster prefix causes the search to run only on the local cluster.

Using an incorrect cluster name that is not configured.

The remote cluster name must be prefixed before the index pattern with a colon, e.g., 'remote_cluster:logs-*'.

2fill in blank

medium

Complete the code to configure the remote cluster seed nodes in the elasticsearch.yml file.

Elasticsearch

cluster.remote.remote_cluster.seeds: ["[1]:9300"]

Drag options to blanks, or click blank then click option'

A127.0.0.1

Blocalhost

C192.168.1.10

Dremotehost

Attempts:

3 left

💡 Hint

Common Mistakes

Using HTTP port 9200 instead of transport port 9300.

Using localhost or 127.0.0.1 which points to the local machine.

The seed node IP address must be the remote cluster's IP with the transport port 9300.

3fill in blank

hard

Fix the error in the search request to correctly query across clusters.

Elasticsearch

{
  "query": {
    "match": {
      "message": "error"
    }
  },
  "index": "[1]logs-*"
}

Drag options to blanks, or click blank then click option'

Aremote_cluster:

Bremote_cluster

Cremote_cluster-

D:remote_cluster

Attempts:

3 left

💡 Hint

Common Mistakes

Missing the colon causes the search to fail or run locally.

Using a dash or no separator instead of a colon.

The remote cluster name must be followed by a colon before the index pattern to indicate cross-cluster search.

4fill in blank

hard

Fill both blanks to create a cross-cluster search query that filters documents from the remote cluster with status 'error'.

Elasticsearch

{
  "query": {
    "bool": {
      "filter": [
        { "term": { "status": "[1]" } },
        { "term": { "cluster": "[2]" } }
      ]
    }
  },
  "index": "remote_cluster:logs-*"
}

Drag options to blanks, or click blank then click option'

Aerror

Bremote_cluster

Cwarning

Dlocal_cluster

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong status values like 'warning'.

Using local cluster name instead of remote cluster.

The filter must check for status 'error' and cluster name 'remote_cluster' to target the remote cluster logs with errors.

5fill in blank

hard

Fill all three blanks to build a dictionary comprehension that maps each index name from the remote cluster to its document count, filtering indices with more than 1000 docs.

Elasticsearch

index_counts = { [1]: [2] for [3] in indices if stats[[3]]['docs']['count'] > 1000 }

Drag options to blanks, or click blank then click option'

Aindex

Bstats[index]['docs']['count']

Dindices

Attempts:

3 left

💡 Hint

Common Mistakes

Using different variable names for key and loop variable.

Incorrectly accessing the document count in stats.

The comprehension iterates over 'index' in 'indices', maps 'index' to its doc count from stats, filtering counts > 1000.

Practice

1. What is the main purpose of cross-cluster search in Elasticsearch?

easy

A. To monitor cluster health status remotely

B. To backup data from one cluster to another

C. To merge two clusters into one

D. To search data across multiple Elasticsearch clusters using a single query

Solution

1. Step 1: Understand cross-cluster search concept

   Cross-cluster search allows querying data from multiple clusters in one search request.

2. Step 2: Differentiate from other cluster operations

   It does not merge clusters, backup data, or monitor health but focuses on searching data.

3. Final Answer:

   To search data across multiple Elasticsearch clusters using a single query -> Option D

4. Quick Check:

   Cross-cluster search = search across clusters [OK]

Hint: Cross-cluster search = one query, many clusters [OK]

Common Mistakes:

• Confusing search with backup or monitoring
• Thinking it merges clusters
• Assuming it manages cluster health

2. Which syntax correctly specifies a remote cluster alias in a cross-cluster search query?

easy

A. GET /remote_cluster:index/_search

B. GET /index@remote_cluster/_search

C. GET /index/remote_cluster/_search

D. GET /remote_cluster/_search/index

Solution

1. Step 1: Recall remote cluster alias syntax

   The correct syntax uses remote_cluster:index to specify the cluster alias and index.

2. Step 2: Check each option format

   Only GET /remote_cluster:index/_search matches the correct pattern: GET /remote_cluster:index/_search.

3. Final Answer:

   GET /remote_cluster:index/_search -> Option A

4. Quick Check:

   Alias:index/_search = correct syntax [OK]

Hint: Use alias:index/_search to target remote cluster data [OK]

Common Mistakes:

• Placing alias after index
• Using slashes instead of colon
• Misordering parts of the URL

3. Given this cross-cluster search query:

GET /clusterA:logs-2023/_search
{
  "query": { "match_all": {} }
}

What data will this query return?

medium

A. All documents from the local cluster's logs-2023 index

B. All documents from the logs-2023 index in clusterA

C. Documents matching "clusterA" in the logs-2023 index

D. An error because cluster alias is missing

Solution

1. Step 1: Identify cluster alias usage

   The query uses clusterA:logs-2023, meaning it targets the logs-2023 index on remote cluster named clusterA.

2. Step 2: Understand the query body

   The match_all query returns all documents from that index on clusterA.

3. Final Answer:

   All documents from the logs-2023 index in clusterA -> Option B

4. Quick Check:

   Alias:index with match_all = all remote docs [OK]

Hint: Alias:index means search that index on remote cluster [OK]

Common Mistakes:

• Assuming it searches local cluster
• Thinking it filters by cluster name in data
• Believing alias is optional

4. You run this cross-cluster search query:

GET /remoteCluster:products/_search
{
  "query": { "term": { "category": "electronics" } }
}

But get an error: no such remote cluster. What is the likely cause?

medium

A. The query syntax is invalid for cross-cluster search

B. The index 'products' does not exist on the remote cluster

C. The remote cluster alias 'remoteCluster' is not configured in the local cluster

D. The term query cannot be used in cross-cluster search

Solution

1. Step 1: Analyze the error message

   The error no such remote cluster means the alias 'remoteCluster' is unknown to the local cluster.

2. Step 2: Check configuration requirements

   Remote clusters must be configured before use; missing alias causes this error.

3. Final Answer:

   The remote cluster alias 'remoteCluster' is not configured in the local cluster -> Option C

4. Quick Check:

   Missing alias config = no such remote cluster error [OK]

Hint: Configure remote cluster alias before querying [OK]

Common Mistakes:

• Assuming index absence causes this error
• Blaming query syntax for alias errors
• Thinking term queries are unsupported

5. You want to search the sales-2023 index across two remote clusters named clusterX and clusterY. Which query correctly searches both clusters and returns combined results?

hard

A. GET /clusterX:sales-2023,clusterY:sales-2023/_search
{ "query": { "match_all": {} } }

B. GET /sales-2023/_search
{ "query": { "match_all": {} }, "clusters": ["clusterX", "clusterY"] }

C. GET /clusterX:clusterY:sales-2023/_search
{ "query": { "match_all": {} } }

D. GET /sales-2023/_search
{ "query": { "match_all": {} }, "remote_clusters": ["clusterX", "clusterY"] }

Solution

1. Step 1: Recall syntax for multiple remote clusters

   To search multiple clusters, use comma-separated list of <code>cluster_alias:index</code>, like <code>clusterX:sales-2023,clusterY:sales-2023</code>.

2. Step 2: Evaluate each option

   GET /clusterX:sales-2023,clusterY:sales-2023/_search { "query": { "match_all": {} } } uses <code>clusterX:sales-2023,clusterY:sales-2023</code> which is correct syntax for cross-cluster search across multiple clusters.

3. Final Answer:

   GET /clusterX:sales-2023,clusterY:sales-2023/_search { "query": { "match_all": {} } } -> Option A

4. Quick Check:

   clusterX:sales-2023,clusterY:sales-2023/_search = multi-cluster search [OK]

Hint: comma-separate alias:index for multi-cluster search [OK]

Common Mistakes:

• Using multiple colons instead of commas
• Adding cluster names inside query body
• Assuming local index searches multiple clusters