Percolate queries (reverse search) in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this percolate query count?

Given an index with percolator queries registered, what will be the count of matching queries for the document below?

{"query": {"match": {"message": "quick brown fox"}}}

Assume the percolator index has two queries: one matching "quick" and another matching "lazy".

Elasticsearch

{
  "query": {
    "percolate": {
      "field": "query",
      "document": {
        "message": "quick brown fox"
      }
    }
  }
}

A 2

B 1

C 0

D Query syntax error

💡 Hint

Think about which registered queries match the document text.

The document contains the word "quick" which matches one registered query. The other query matches "lazy" which is not in the document, so only one query matches.

🧠 Conceptual

intermediate

Which field type is required to store percolator queries?

In Elasticsearch, to register queries for percolation, which field type must be used in the mapping?

A "text"

B "keyword"

C "percolator"

D "nested"

💡 Hint

It's a special field type designed for storing queries.

The "percolator" field type is specifically designed to store queries for reverse search in Elasticsearch.

🔧 Debug

advanced

Why does this percolate query fail with a parsing error?

Consider this percolate query:

{
  "query": {
    "percolate": {
      "field": "query",
      "document": {
        "message": "fox jumps"
      },
      "index": "my_index"
    }
  }
}

It returns a parsing error. What is the cause?

A The "field" value must be the name of a "percolator" field, not "query"

B The "document" field must be replaced with "documents" array

C The "index" parameter is not allowed inside the percolate query

D The "message" field is missing from the mapping

💡 Hint

Check the field name used for percolate queries in the mapping.

The "field" parameter must point to the field of type "percolator" in the index mapping. Using "query" if that is not the percolator field causes parsing errors.

📝 Syntax

advanced

Which option correctly registers a percolator query in Elasticsearch?

You want to register a percolator query that matches documents containing "error" in the "message" field. Which JSON is correct?

A { "query": { "match": { "message": "error" } } }

B { "query": { "percolate": { "field": "query", "document": { "message": "error" } } } }

C { "query": { "match": { "query": "error" } } }

D { "query": { "term": { "message": "error" } } }

💡 Hint

Registering a percolator query requires a valid query JSON, not a percolate query.

When registering a percolator query, you store a normal query (like match) inside the percolator field. Option A is the correct query to store.

🚀 Application

expert

How many queries match this document using percolate query?

Assume you have registered these percolator queries:

1. Match "error" in "message"
2. Match "warning" in "message"
3. Match phrase "disk failure" in "message"

What is the number of matching queries for this document?

{"message": "disk failure error detected"}

A 0

B 3

C 1

D 2

💡 Hint

Check which registered queries match the document text.

The document contains "disk failure" phrase and the word "error". So queries 1 and 3 match, but not query 2.

Practice

1.

What is the main purpose of a percolate query in Elasticsearch?

easy

A. To find stored queries that match a new document

B. To update documents in an index

C. To delete documents based on a condition

D. To aggregate data by terms

Solution

1. Step 1: Understand percolate query concept

   A percolate query is used to find stored queries that match a new document, reversing the usual search direction.

2. Step 2: Compare options with concept

   The other options describe other Elasticsearch operations, not percolate queries.

3. Final Answer:

   To find stored queries that match a new document -> Option A

4. Quick Check:

   Percolate query = find matching stored queries [OK]

Hint: Percolate queries match queries to documents, not documents to queries [OK]

Common Mistakes:

• Confusing percolate query with regular search
• Thinking it updates or deletes documents
• Mixing it with aggregation queries

2.

Which mapping type must be included in an Elasticsearch index to use percolate queries?

{
  "mappings": {
    "properties": {
      "query": {
        "type": "???"
      }
    }
  }
}

easy

A. "percolator"

B. "text"

C. "keyword"

D. "nested"

Solution

1. Step 1: Identify required field type for percolate queries

   Elasticsearch requires a special field type called "percolator" to store queries for percolate queries.

2. Step 2: Match options with required type

   Only "percolator" uses "percolator" type; others are for different purposes.

3. Final Answer:

   "percolator" -> Option A

4. Quick Check:

   Percolate field type = "percolator" [OK]

Hint: Use "percolator" type for storing queries in mapping [OK]

Common Mistakes:

• Using "text" or "keyword" instead of "percolator"
• Confusing nested type with percolator
• Omitting the percolator field in mapping

3.

Given the following percolate query, what will it return?

{
  "query": {
    "percolate": {
      "field": "query",
      "document": {
        "message": "Elasticsearch alerting"
      }
    }
  }
}

Assuming the index has stored queries matching documents containing "alerting".

medium

A. Documents containing the word "alerting"

B. An error because "document" is missing an ID

C. All documents in the index

D. Stored queries that match the document with message "Elasticsearch alerting"

Solution

1. Step 1: Understand percolate query behavior

   The percolate query matches stored queries against the provided document, returning matching stored queries.

2. Step 2: Analyze the given query

   The query uses "document" with a message field; it will find stored queries matching this document's content.

3. Final Answer:

   Stored queries that match the document with message "Elasticsearch alerting" -> Option D

4. Quick Check:

   Percolate query returns matching stored queries [OK]

Hint: Percolate queries return stored queries matching the input document [OK]

Common Mistakes:

• Thinking it returns documents instead of queries
• Assuming document ID is required for percolate query
• Confusing percolate with regular search

4.

Identify the error in this percolate query:

{
  "query": {
    "percolate": {
      "field": "query"
      "document": {
        "content": "Test document"
      }
    }
  }
}

medium

A. "field" should be "query_field"

B. Missing comma between "field" and "document" fields

C. "document" must include an "id" field

D. Percolate query cannot use 'content' field in document

Solution

1. Step 1: Check JSON syntax in query

   Between "field" and "document" keys, a comma is missing, causing invalid JSON.

2. Step 2: Validate other parts

   "field" name is correct, "document" can omit "id", and "content" is valid as document content.

3. Final Answer:

   Missing comma between "field" and "document" fields -> Option B

4. Quick Check:

   JSON syntax error = missing comma [OK]

Hint: Check commas between JSON fields carefully [OK]

Common Mistakes:

• Forgetting commas between JSON keys
• Assuming document must have an ID
• Changing field names unnecessarily

5.

You want to build an alert system that triggers when new documents match any stored queries. Which steps are necessary to implement this using percolate queries?

hard

A. Use aggregation queries on documents to find alerts

B. Store documents in a normal index, then run a regular search for alerts

C. Create an index with a percolator field, store queries, then percolate new documents against stored queries

D. Create a nested field for queries and filter documents manually

Solution

1. Step 1: Setup index with percolator field

   Define an index mapping with a "percolator" type field to store queries for reverse matching.

2. Step 2: Store queries and percolate new documents

   Index the alert queries into the percolator field, then use percolate queries to check if new documents match any stored queries.

3. Final Answer:

   Create an index with a percolator field, store queries, then percolate new documents against stored queries -> Option C

4. Quick Check:

   Percolate queries enable alerting by matching docs to stored queries [OK]

Hint: Store queries in percolator field, then percolate new docs [OK]

Common Mistakes:

• Using regular search instead of percolate queries
• Not defining percolator field in mapping
• Trying to use aggregations for alerting