Discover for data exploration in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Elasticsearch query in Discover?

Given the following Elasticsearch query used in Discover to filter documents, what will be the count of returned documents if the index contains 100 documents with field status values distributed as 40 'open', 30 'closed', and 30 'pending'?

Elasticsearch

{
  "query": {
    "term": {
      "status": "open"
    }
  }
}

A 100

B 30

C 40

D 0

💡 Hint

The term query matches documents where the field exactly matches the given value.

The term query filters documents where the field 'status' is exactly 'open'. Since there are 40 such documents, the output count is 40.

🧠 Conceptual

intermediate

Which aggregation type is best to explore the distribution of a numeric field in Discover?

You want to explore how values of a numeric field price are distributed in your data using Discover. Which aggregation type should you use?

A Histogram aggregation

B Range aggregation

C Date histogram aggregation

D Terms aggregation

💡 Hint

Think about grouping numeric values into buckets of equal size.

Histogram aggregation groups numeric values into buckets of fixed intervals, which helps explore the distribution of numeric fields like price.

🔧 Debug

advanced

Why does this Discover query return zero results?

You run this query in Discover but get zero results, even though you know matching documents exist. What is the cause?

Elasticsearch

{
  "query": {
    "match": {
      "message": "Error occurred"
    }
  }
}

A The index does not contain the 'message' field.

B The field 'message' is analyzed and the phrase 'Error occurred' does not match exactly.

C The query syntax is invalid and causes an error.

D The query should use a term query instead of match.

💡 Hint

Consider how analyzed text fields are searched with match queries.

Match queries analyze the input text. If the field is analyzed, searching for the exact phrase 'Error occurred' may not match documents because the phrase is split into tokens.

📝 Syntax

advanced

Which option correctly filters documents with a date range in Discover?

You want to filter documents where the timestamp field is between 2023-01-01 and 2023-01-31. Which query syntax is correct?

A { "range": { "timestamp": { "from": "2023-01-01", "to": "2023-01-31" } } }

B { "match": { "timestamp": "2023-01-01 TO 2023-01-31" } }

C { "term": { "timestamp": { "gte": "2023-01-01", "lte": "2023-01-31" } } }

D { "range": { "timestamp": { "gte": "2023-01-01", "lte": "2023-01-31" } } }

💡 Hint

Range queries use 'gte' and 'lte' to specify boundaries.

The correct syntax for a range query uses 'gte' (greater than or equal) and 'lte' (less than or equal) inside the range object for the field.

🚀 Application

expert

How many unique user IDs are returned by this aggregation in Discover?

Given this aggregation query in Discover, what is the number of unique user IDs if the index contains 500 documents with 200 unique user IDs?

Elasticsearch

{
  "aggs": {
    "unique_users": {
      "cardinality": {
        "field": "user_id"
      }
    }
  }
}

A 200

B 500

C 0

D Cannot determine from query

💡 Hint

Cardinality aggregation counts unique values of a field.

The cardinality aggregation returns the count of unique values for the specified field. Since there are 200 unique user IDs, the result is 200.