Elastic Certified Engineer Exam version 9.3

A modular, hands-on learning plan for exam preparation

The Elastic Certified Engineer exam is practical, so preparation should be practical too. This learning plan is designed for analysts and Elasticsearch practitioners who want a structured route from day-to-day search work to exam-style engineering tasks.

The plan uses short, self-paced modules supported by hands-on labs. Each module develops a specific set of skills, then asks you to combine them in a working Elasticsearch environment. The aim is not to memorize isolated commands. It is to become comfortable reading a requirement, choosing the right Elasticsearch feature, implementing it, and checking the result under time pressure.

This is a preparation framework rather than a substitute for Elastic's official exam objectives. Before beginning, compare the plan with the current version 9.3 exam page and adjust your study time if Elastic changes the published blueprint.

Who this learning plan is for

This plan suits learners who already understand the purpose of Elasticsearch but need deeper implementation practice. It is especially useful for:

• analysts moving from dashboards and queries into index design and administration;
• engineers who use Elasticsearch at work but have gaps in specific topic areas;
• previous Elastic learners who need a structured review before the exam;
• self-directed learners who prefer labs over lecture-heavy study.

You should be comfortable using a terminal, working with JSON, and sending requests through Kibana Dev Tools or another API client. Basic familiarity with documents, indices, shards, replicas, mappings, and Query DSL will make the early modules easier.

How to use the plan

Complete the modules in order on your first pass. Later topics depend on choices made in earlier ones, particularly mappings, analysis, and index design.

For each module:

1. Read the objective and review the relevant Elasticsearch documentation. 2. Complete the guided lab without rushing. 3. Repeat the lab from a blank cluster or clean namespace. 4. Complete the checkpoint without copying commands from your notes. 5. Record mistakes, slow steps, and commands you still need to look up.

Use a disposable practice environment. Name indices clearly, save your request history, and reset the environment between larger scenarios. During the final phase, practise with documentation available but without personal notes, saved snippets, or prebuilt templates.

Course 1: Cluster orientation and resource inspection

Start by learning how to inspect an unfamiliar Elasticsearch environment. Exam tasks are easier when you can quickly determine what already exists and avoid changing the wrong resource.

Topics

• cluster health and node information;
• index, alias, data stream, and template discovery;
• shard allocation and replica status;
• reading mappings and settings from existing indices;
• distinguishing cluster-level settings from index-level settings;
• using concise API responses and filters to find relevant information quickly.

Hands-on lab

Open a cluster containing several indices, aliases, and templates. Identify which index receives writes, which resources share a template, and why cluster health has its current status. Produce a short inventory using API requests rather than the graphical interface alone.

Checkpoint

Given only a resource name and a short requirement, locate its mappings, settings, aliases, and shard state without relying on saved commands.

Course 2: Index creation, settings, and lifecycle-aware design

This module covers the decisions made before data is indexed. A strong candidate should be able to translate a workload description into appropriate index settings and reusable configuration.

Topics

• creating indices with explicit settings and mappings;
• primary shard and replica choices;
• index naming and rollover-friendly patterns;
• component templates and index templates;
• template priority and composition;
• aliases and write-index behavior;
• data streams for timestamped, append-oriented data;
• updating settings safely and recognizing settings that cannot be changed in place.

Hands-on lab

Design storage for an application-events workload. Build reusable component templates for mappings and settings, compose them into an index template, create the destination resource, and verify that newly created backing indices inherit the expected configuration.

Checkpoint

Create a second workload with different retention and mapping requirements while reusing only the components that genuinely apply.

Course 3: Mappings and field modeling

Good search results begin with correct field types. This module focuses on modeling documents for search, filtering, sorting, aggregation, and updates.

Topics

• dynamic and explicit mappings;
• text and keyword fields;
• numeric, date, boolean, IP, geo, object, nested, and flattened-style data choices;
• multi-fields for full-text search and exact-value operations;
• field aliases and mapping metadata;
• dynamic templates;
• coercion, malformed values, and date formats;
• mapping conflicts and the limits of changing field types after indexing.

Hands-on lab

Model a service-ticket dataset containing free text, identifiers, labels, timestamps, customer attributes, and arrays of structured objects. Run searches and aggregations that prove each field behaves as intended. Then introduce a mapping mistake, diagnose it, and correct the design through a new index and reindexing.

Checkpoint

Explain why each important field has its chosen type and demonstrate one operation that would fail or produce misleading results with a weaker mapping.

Course 4: Text analysis and relevance foundations

Text fields are useful only when their analysis matches the search experience. This module turns analysis from an abstract concept into a repeatable diagnostic process.

Topics

• character filters, tokenizers, and token filters;
• built-in and custom analyzers;
• separate index and search analyzers;
• normalizers for keyword fields;
• stop words, stemming, synonyms, and case handling;
• testing analysis output with the analyze API;
• recognizing how token positions affect phrase queries.

Hands-on lab

Create a small product or knowledge-base index with exact identifiers, titles, descriptions, and synonym-aware terminology. Test each analysis chain before indexing. Compare tokens and search behavior across several analyzers, then document which one fits each field.

Checkpoint

Diagnose a query that returns too few results because index-time and search-time analysis do not match. Fix it without weakening unrelated exact-match behavior.

Course 5: Document indexing and data modification

This module covers reliable ways to create, replace, update, and remove documents. The emphasis is on choosing the correct operation and verifying what happened.

Topics

• single-document indexing and deterministic document IDs;
• create, index, update, and delete semantics;
• partial updates and scripted updates;
• bulk request structure and per-item error checking;
• update by query and delete by query;
• optimistic concurrency concepts;
• refresh behavior and near-real-time visibility;
• reindexing between resources.

Hands-on lab

Load a dataset with the bulk API, intentionally include several invalid records, and identify failures at the item level. Correct the rejected documents, perform conditional updates, and migrate the final dataset to a revised mapping.

Checkpoint

Repeat the migration while preserving document IDs and prove that the destination contains the expected document count and field behavior.

Course 6: Query DSL and precise retrieval

Search tasks often combine full-text relevance with exact constraints. This module builds the habit of selecting queries by field behavior rather than by trial and error.

Topics

• match, multi-match, match phrase, term, terms, range, exists, and prefix-style retrieval;
• bool queries using must, filter, should, and must_not;
• scoring context versus filter context;
• minimum-should-match behavior;
• nested queries for arrays of objects;
• sorting, source filtering, field retrieval, and pagination;
• named queries and explain-style diagnostics;
• search templates or reusable query structures where appropriate.

Hands-on lab

Build a search endpoint for service tickets. Users must be able to search descriptions, filter by account and status, restrict dates, match nested assignments correctly, and sort by operational priority. Compare a logically correct bool query with a subtly incorrect one.

Checkpoint

Given five requirements in plain language, produce one request that satisfies all of them and explain which clauses affect scores.

Course 7: Aggregations and analytical results

Analysts often know aggregations well, but the exam-style challenge is to combine them accurately and efficiently with filters and nested structures.

Topics

• metric and bucket aggregations;
• terms, date histogram, range, filters, and composite-style grouping;
• sub-aggregations and multi-level summaries;
• cardinality and percentile-style metrics;
• nested and reverse-nested aggregation patterns;
• pipeline aggregations for calculations across buckets;
• controlling bucket size, ordering, and returned hits;
• using queries to define the population before aggregation.

Hands-on lab

Create an operational report showing ticket volume over time, top categories, response-time percentiles, and changes between periods. Add a nested breakdown by assigned team and confirm the numbers against simpler control queries.

Checkpoint

Return only aggregation results, order the requested buckets correctly, and explain any approximation or bucket-limit behavior that could affect interpretation.

Course 8: Ingest pipelines and enrichment

Ingest pipelines let you normalize and enrich documents before storage. This module focuses on processor order, failure handling, and testability.

Topics

• creating and managing ingest pipelines;
• set, rename, remove, convert, date, dissect, grok, script, and related processors;
• conditional processors;
• pipeline-level and processor-level failure handling;
• simulation before deployment;
• default and final pipeline behavior;
• enriching documents from reference data;
• debugging documents that do not follow the expected shape.

Hands-on lab

Build a pipeline that converts raw log-like records into a consistent schema. Parse timestamps, derive fields, convert numeric values, enrich known entities, and route malformed documents through a clear failure path. Use simulation cases for valid, partial, and invalid inputs.

Checkpoint

Modify the pipeline to support a second input format without breaking the first. Demonstrate the result with simulation requests.

Course 9: Aliases, reindexing, rollover, and lifecycle operations

Operational tasks often require changing data structures without interrupting writes. This module develops safe migration habits.

Topics

• filtered and routed aliases;
• write aliases and atomic alias changes;
• reindexing with queries, scripts, and field transformations;
• rollover conditions and generation naming;
• lifecycle concepts for time-series or aging data;
• read-only states and safe cleanup;
• validating a destination before switching an alias;
• rollback planning for migrations.

Hands-on lab

Migrate an application index to a new mapping. Create the destination, reindex and transform the documents, validate counts and sample queries, then switch the alias in one atomic operation. Keep a clear rollback path until validation is complete.

Checkpoint

Perform the same migration with continued writes handled through an explicit cutover plan. Explain how you prevent writes from reaching the wrong index.

Course 10: Shards, replicas, routing, and recovery

This module connects cluster behavior to practical configuration. The goal is to recognize why data is distributed in a certain way and how changes affect resilience and query execution.

Topics

• primary and replica shard roles;
• shard allocation and relocation;
• allocation awareness and filtering concepts;
• manual reroute operations and their risks;
• custom routing and routed searches;
• diagnosing unassigned shards;
• replica changes and cluster health transitions;
• snapshot and restore concepts for recoverable practice environments.

Hands-on lab

Use a multi-node practice cluster or a supplied scenario to diagnose an unassigned replica. Inspect allocation information, correct the underlying setting, and verify recovery. Then index routed documents and compare searches with and without the routing value.

Checkpoint

Given a yellow or red cluster scenario, identify the affected shards and propose the smallest safe corrective action before running it.

Course 11: Security and access-aware operation

Preparation should include working safely in a secured cluster. The required depth may depend on the official blueprint, but every engineer should understand how permissions affect API behavior.

Topics

• authentication and authorization concepts;
• cluster and index privilege boundaries;
• roles and users in a practice environment;
• field- and document-level access concepts;
• API keys and limited credentials;
• separating permission errors from missing-resource or malformed-request errors;
• avoiding unnecessary privilege escalation during troubleshooting.

Hands-on lab

Create a restricted role for an analyst who can search and aggregate selected indices but cannot change mappings or cluster settings. Test allowed and denied operations, then refine the role without granting broad administrative access.

Checkpoint

Diagnose three failed requests: one caused by permissions, one by a missing resource, and one by invalid request syntax.

Course 12: Integrated exam-style scenarios

The final module removes topic boundaries. Real tasks rarely announce which feature to use, so each scenario should combine resource discovery, implementation, and validation.

Scenario A: Search application repair

Inspect an existing index, correct an analysis or mapping problem through a safe migration, and produce a query that meets relevance and filtering requirements.

Scenario B: Analytics pipeline

Normalize raw documents through an ingest pipeline, store them under a reusable template, and return a multi-level analytical summary.

Scenario C: Operational cutover

Create a new generation of an index, reindex selected data, validate the destination, and switch reads and writes through aliases without leaving an ambiguous write target.

Scenario D: Cluster troubleshooting

Investigate unhealthy shard allocation, identify the configuration or capacity issue, apply a limited correction, and prove that recovery completed.

For every scenario, save evidence: the requests used, relevant responses, validation queries, and a short explanation of why the solution meets the requirement.

Suggested study schedule

A six-week schedule gives most working learners enough room to practise without turning every session into a marathon.

Adjust the pace to your starting point. If Query DSL is already part of your daily work but shard troubleshooting is not, move time toward the weaker topic instead of repeating familiar exercises.

Readiness checklist

You are approaching exam readiness when you can:

• inspect unfamiliar cluster resources without searching blindly;
• build mappings, analyzers, templates, aliases, and pipelines from written requirements;
• choose query and aggregation structures based on field behavior;
• use simulation and validation APIs before changing live-style resources;
• reindex data and switch aliases with a clear validation and rollback sequence;
• diagnose mapping conflicts, bulk item failures, permission errors, and unassigned shards;
• complete mixed scenarios without relying on personal snippets;
• explain why your solution is correct, not merely show that one request returned a successful status.

Guided learning option

Self-paced study works well for learners who can diagnose their own mistakes and maintain a regular lab schedule. Learners who want live explanations, instructor feedback, and a fixed pace should consider Elastic's Elasticsearch Engineer instructor-led training. A guided course can also help when several foundational topics are new at once or when access to a suitable lab environment is a barrier.

Whichever route you choose, keep the preparation task-based. Reading builds familiarity; repeated implementation builds exam readiness.

Editorial source note

Before publication, an editor should compare every module with Elastic's current official version 9.3 exam objectives and remove, add, or reprioritize topics as needed. No exam duration, question format, scoring threshold, or objective weighting is asserted in this draft.