Hot-warm-cold architecture in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this hot-warm-cold node allocation query?

Given an Elasticsearch cluster with hot, warm, and cold nodes, what will this query return?

Elasticsearch

GET /_cat/allocation?v

# Assume the cluster has 3 hot nodes, 2 warm nodes, and 1 cold node.
# The query shows disk usage per node.

A Returns an error because _cat/allocation does not support node tiers.

B Lists all nodes with their disk usage, showing hot nodes with highest disk usage.

C Returns only cold nodes with zero disk usage.

D Returns only hot nodes with their disk usage.

💡 Hint

The _cat/allocation API shows allocation info for all nodes by default.

The _cat/allocation API lists all nodes in the cluster with their disk usage and shard allocation. It does not filter by node tier unless specified.

🧠 Conceptual

intermediate

Which node tier is best suited for storing frequently updated data?

In a hot-warm-cold Elasticsearch architecture, which node tier should store data that is updated frequently and requires fast access?

A Hot nodes, because they provide the fastest access and indexing.

B Warm nodes, because they balance storage and performance.

C Cold nodes, because they have the most storage capacity.

D Any node tier, because Elasticsearch automatically balances updates.

💡 Hint

Think about which nodes handle indexing and fast queries.

Hot nodes are designed for fast indexing and search of recent data that changes frequently.

🔧 Debug

advanced

Why does this index not move to the warm tier as expected?

An index lifecycle policy is set to move indices from hot to warm after 7 days, but indices remain on hot nodes. What is the likely cause?

Elasticsearch

PUT _ilm/policy/my_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_age": "7d"
          }
        }
      },
      "warm": {
        "actions": {
          "allocate": {
            "require": {
              "data": "warm"
            }
          }
        }
      }
    }
  }
}

A The warm nodes are not tagged with the attribute 'data=warm'.

B The rollover max_age is too short, causing indices to stay hot.

C The allocate action is missing the 'include' key.

D The policy is missing a cold phase, so warm phase is ignored.

💡 Hint

Check node attributes and allocation filtering.

If warm nodes lack the required attribute 'data=warm', allocation cannot move shards there.

📝 Syntax

advanced

Identify the syntax error in this ILM policy snippet for cold phase allocation

Which option contains the correct syntax to allocate indices to cold nodes in the cold phase?

Elasticsearch

PUT _ilm/policy/cold_policy
{
  "policy": {
    "phases": {
      "cold": {
        "min_age": "30d",
        "actions": {
          "allocate": {
            "require": {
              "data": "cold"
            }
          }
        }
      }
    }
  }
}

A { "allocate": { "require": [ "data": "cold" ] } }

B { "allocate": { "include": { "data": "cold" } } }

C { "allocate": { "require": { "data": "cold" } } }

D { "allocate": { "require": { data: "cold" } } }

💡 Hint

JSON keys must be strings and use curly braces for objects.

Option C uses correct JSON object syntax with string keys and nested objects.

🚀 Application

expert

How many shards will be on cold nodes after 60 days with this ILM policy?

An index has 10 primary shards and 1 replica. The ILM policy moves data from hot to warm at 7 days, then to cold at 30 days. After 60 days, how many shards (primary + replica) are allocated on cold nodes?

Elasticsearch

ILM policy phases:
- hot: 0-7 days
- warm: 7-30 days
- cold: 30+ days

Index settings:
- number_of_shards: 10
- number_of_replicas: 1

A 30 shards (10 primary + 10 replica + 10 from warm nodes) on cold nodes

B 10 shards (only primary) on cold nodes

C 0 shards on cold nodes because replicas stay on warm nodes

D 20 shards (10 primary + 10 replica) on cold nodes

💡 Hint

Replicas move with primaries during ILM phase transitions.

Both primary and replica shards move to cold nodes after 30 days, so total shards are 10 primaries + 10 replicas = 20.