Discover for data exploration in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Elasticsearch query in Discover?

Given the following Elasticsearch query used in Discover to filter documents, what will be the count of returned documents if the index contains 100 documents with field status values distributed as 40 'open', 30 'closed', and 30 'pending'?

Elasticsearch

{
  "query": {
    "term": {
      "status": "open"
    }
  }
}

A 100

B 30

C 40

D 0

💡 Hint

The term query matches documents where the field exactly matches the given value.

The term query filters documents where the field 'status' is exactly 'open'. Since there are 40 such documents, the output count is 40.

🧠 Conceptual

intermediate

Which aggregation type is best to explore the distribution of a numeric field in Discover?

You want to explore how values of a numeric field price are distributed in your data using Discover. Which aggregation type should you use?

A Histogram aggregation

B Range aggregation

C Date histogram aggregation

D Terms aggregation

💡 Hint

Think about grouping numeric values into buckets of equal size.

Histogram aggregation groups numeric values into buckets of fixed intervals, which helps explore the distribution of numeric fields like price.

🔧 Debug

advanced

Why does this Discover query return zero results?

You run this query in Discover but get zero results, even though you know matching documents exist. What is the cause?

Elasticsearch

{
  "query": {
    "match": {
      "message": "Error occurred"
    }
  }
}

A The index does not contain the 'message' field.

B The field 'message' is analyzed and the phrase 'Error occurred' does not match exactly.

C The query syntax is invalid and causes an error.

D The query should use a term query instead of match.

💡 Hint

Consider how analyzed text fields are searched with match queries.

Match queries analyze the input text. If the field is analyzed, searching for the exact phrase 'Error occurred' may not match documents because the phrase is split into tokens.

📝 Syntax

advanced

Which option correctly filters documents with a date range in Discover?

You want to filter documents where the timestamp field is between 2023-01-01 and 2023-01-31. Which query syntax is correct?

A { "range": { "timestamp": { "from": "2023-01-01", "to": "2023-01-31" } } }

B { "match": { "timestamp": "2023-01-01 TO 2023-01-31" } }

C { "term": { "timestamp": { "gte": "2023-01-01", "lte": "2023-01-31" } } }

D { "range": { "timestamp": { "gte": "2023-01-01", "lte": "2023-01-31" } } }

💡 Hint

Range queries use 'gte' and 'lte' to specify boundaries.

The correct syntax for a range query uses 'gte' (greater than or equal) and 'lte' (less than or equal) inside the range object for the field.

🚀 Application

expert

How many unique user IDs are returned by this aggregation in Discover?

Given this aggregation query in Discover, what is the number of unique user IDs if the index contains 500 documents with 200 unique user IDs?

Elasticsearch

{
  "aggs": {
    "unique_users": {
      "cardinality": {
        "field": "user_id"
      }
    }
  }
}

A 200

B 500

C 0

D Cannot determine from query

💡 Hint

Cardinality aggregation counts unique values of a field.

The cardinality aggregation returns the count of unique values for the specified field. Since there are 200 unique user IDs, the result is 200.

Practice

1. What is the main purpose of the Discover feature in Elasticsearch?

easy

A. To explore and filter raw data in indexes

B. To create visual dashboards

C. To manage Elasticsearch cluster settings

D. To write complex aggregation queries

Solution

1. Step 1: Understand Discover's role

   Discover is designed to let users explore raw data quickly and easily.

2. Step 2: Compare with other features

   Dashboard creation and cluster management are separate features, not Discover's focus.

3. Final Answer:

   To explore and filter raw data in indexes -> Option A

4. Quick Check:

   Discover = Data exploration [OK]

Hint: Discover = explore raw data quickly [OK]

Common Mistakes:

• Confusing Discover with Dashboard
• Thinking Discover manages cluster settings
• Assuming Discover creates complex queries

2. Which of the following is the correct syntax to filter data in Discover using a simple query?

easy

A. filter(status=200, extension=jpg)

B. WHERE status=200 AND extension=jpg

C. status:200 AND extension:jpg

D. SELECT * FROM index WHERE status=200

Solution

1. Step 1: Identify Discover query syntax

   Discover uses Lucene query syntax like field:value and logical operators like AND.

2. Step 2: Eliminate SQL and function syntax

   Options A, C, and D use SQL or function style, which is not valid in Discover queries.

3. Final Answer:

   status:200 AND extension:jpg -> Option C

4. Quick Check:

   Lucene syntax = status:200 AND extension:jpg [OK]

Hint: Use field:value with AND/OR in Discover queries [OK]

Common Mistakes:

• Using SQL syntax instead of Lucene
• Using function calls for filtering
• Mixing query languages

3. Given the following Discover query: response:404 OR response:500, what data will be shown?

medium

A. All documents except those with response 404 or 500

B. Only documents with response code 404

C. Documents with response code 404 and 500 at the same time

D. Documents with response code 404 or 500

Solution

1. Step 1: Understand OR operator in query

   The OR operator returns documents matching either condition, not both simultaneously.

2. Step 2: Apply to response codes

   Documents with response 404 or response 500 will be included in results.

3. Final Answer:

   Documents with response code 404 or 500 -> Option D

4. Quick Check:

   OR means either condition matches [OK]

Hint: OR returns either condition matches [OK]

Common Mistakes:

• Thinking OR means both conditions together
• Confusing OR with AND
• Assuming exclusion of matching documents

4. You wrote this Discover query: status:200 AND extension=jpg. Why does it cause an error?

medium

A. Because '=' is not valid; use ':' for field-value pairs

B. Because AND cannot be used between conditions

C. Because 'status' is not a valid field name

D. Because 'jpg' should be in quotes

Solution

1. Step 1: Check field-value syntax

   Discover uses field:value syntax, not field=value.

2. Step 2: Validate operators and values

   AND is valid, 'status' is a common field, and quotes are optional for simple values.

3. Final Answer:

   Because '=' is not valid; use ':' for field-value pairs -> Option A

4. Quick Check:

   Use ':' not '=' in queries [OK]

Hint: Use colon ':' for field-value, not equals '=' [OK]

Common Mistakes:

• Using '=' instead of ':'
• Misunderstanding AND operator usage
• Adding unnecessary quotes

5. You want to explore documents where the field user exists and the bytes field is greater than 1000. Which Discover query achieves this?

hard

A. _exists_:user AND bytes >1000

B. _exists_:user AND bytes:{1000 TO *}

C. _exists_:user AND bytes:>=1000

D. user:* AND bytes:>1000

Solution

1. Step 1: Check existence syntax

   Use _exists_:user to find documents where 'user' field exists.

2. Step 2: Use range query for bytes > 1000

   Range syntax bytes:{1000 TO *} means bytes greater than 1000 (exclusive).

3. Step 3: Verify other options

   _exists_:user AND bytes:>1000 and C have invalid range syntax; user:* AND bytes:>1000 uses wildcard incorrectly for existence.

4. Final Answer:

   _exists_:user AND bytes:{1000 TO *} -> Option B

5. Quick Check:

   Existence + range query = _exists_:user AND bytes:{1000 TO *} [OK]

Hint: Use _exists_ for field and range syntax for > value [OK]

Common Mistakes:

• Using wildcard * for existence check
• Incorrect range syntax for greater than
• Confusing inclusive and exclusive ranges