Challenge Catalog
65 challenges + 12 skill-aligned scenarios across 7 domains and 4 difficulty levels
65 challenges
beginner11intermediate22advanced23expert9multi-turn7
Search(15)
| ID | Challenge | Difficulty | Description |
|---|
| fts-1-basic-match | Find the Articles | beginner | Multi-field match query to find articles mentioning "elasticsearch" |
| fts-2-simple-term | Exact Category Match | beginner | Term query on keyword field for exact author matching |
| fts-3-match-with-operator | Match All Terms | beginner | Match query with AND operator requiring all terms present |
| fts-4-bool-query | Filtered Search | intermediate | Bool query with must, should, and filter clauses |
| fts-5-must-not | Exclusion Query | intermediate | Bool query with must_not to exclude specific tags |
| fts-6-multi-match-boosting | Field Boosting | intermediate | Multi-match with field boosting (title^3) |
| fts-7-phrase-and-range | Precise Phrase + Date Range | advanced | Combine match_phrase with range query on dates |
| fts-8-wildcard-exists | Wildcard and Exists | advanced | Wildcard on SKU patterns combined with exists check |
| fts-9-complex-bool | Complex Multi-Condition Search | expert | Multi-clause bool with must/must_not/should/filter on job listings |
| fts-10-fuzzy | Fuzzy Search for Typos | intermediate | Fuzzy query with edit distance for typo tolerance |
| fts-11-dis-max | Best-Field with dis_max | advanced | dis_max query for best single field match with tie_breaker |
| fts-12-boosting | Demote Without Excluding | advanced | Boosting query to reduce score of beginner articles |
| fts-13-nested | Nested Object Query | expert | Nested query to match conditions within same array element |
| fts-14-function-score | Custom Relevance | expert | function_score with field_value_factor to boost by rating |
| mt-1-discover-and-search | Discover Schema, Then SearchMULTI-TURN | intermediate | Explore unknown index schema, then find matching documents |
Ingest(6)
| ID | Challenge | Difficulty | Description |
|---|
| ingest-1-mapping-query | Field Type Queries | beginner | Bool filter with term, range, and boolean field matching |
| ingest-2-sort-pagination | Sort and Pagination | intermediate | Sort by price desc, limit to top 3, _source filtering |
| ingest-3-date-filter | Date Range Filtering | intermediate | Range query on dates with ascending sort |
| ingest-4-terms-query | Multi-Value Matching | intermediate | Terms query to match multiple status values at once |
| ingest-5-pagination | Deep Pagination | advanced | Page 2 of results using from/size with sort |
| ingest-6-count-and-filter | Conditional Counting | advanced | Count documents matching criteria with size:0 |
Aggs(11)
| ID | Challenge | Difficulty | Description |
|---|
| aggs-1-basic-terms | Category Breakdown | beginner | Terms aggregation to count documents per category |
| aggs-2-simple-avg | Average Value | beginner | Avg metric aggregation on a numeric field |
| aggs-3-filtered-agg | Filtered Aggregation | intermediate | Sum aggregation with query filter on category |
| aggs-4-cardinality | Count Unique Values | intermediate | Cardinality aggregation for approximate distinct count |
| aggs-5-nested-stats | Revenue by Region | advanced | Terms agg with nested stats sub-aggregation |
| aggs-6-date-histogram | Monthly Sales Trend | advanced | Date histogram with revenue sum sub-aggregation |
| aggs-7-multi-level | Three-Level Aggregation | expert | Triple nested: region -> category -> avg amount |
| aggs-8-percentiles | Latency Percentiles | advanced | p50/p95/p99 percentiles on response times |
| aggs-9-filters | Named Filters | advanced | Filters aggregation for HTTP status code categorization |
| aggs-10-percentile-ranks | SLO Compliance | expert | Percentile ranks to check what % of requests meet SLO |
| mt-2-explore-and-aggregate | Explore Data, Then AggregateMULTI-TURN | advanced | Discover non-obvious field names, then compute revenue per region |
Observability(14)
| ID | Challenge | Difficulty | Description |
|---|
| obs-1-log-filtering | Filter Error Logs | beginner | Term query to find all ERROR-level logs |
| obs-2-service-errors | Service Error Investigation | intermediate | Bool + range + sort for time-windowed service errors |
| obs-3-error-rate | Error Rate by Service | advanced | Nested terms aggs: service -> level distribution |
| obs-4-status-code-range | HTTP 5xx Analysis | intermediate | Range query on status_code field for server errors |
| obs-5-log-text-search | Log Pattern Search | advanced | Combined text match + level filter for error investigation |
| obs-6-latency-percentiles | Service Latency Percentiles | advanced | APM-style: terms on service -> percentiles p50/p95/p99 |
| obs-7-error-spike | Error Spike Detection | intermediate | date_histogram (1h) on ERROR logs to find incident window |
| obs-8-multi-service | Cross-Service Trace Errors | advanced | Terms on trace_id -> cardinality on service.name |
| obs-9-top-errors | Top Error Messages | intermediate | Terms agg on message.keyword for most common errors |
| obs-10-uptime | SLO Uptime Calculation | expert | Filters agg with success (2xx) vs failure (5xx) per service |
| mt-3-unknown-logs | Unknown Log SchemaMULTI-TURN | advanced | Investigate logs with non-standard field names (ts, severity, svc) |
| obs-esql-1-error-investigation | Log Error Investigation (ES|QL)SCENARIO | intermediate | Error timeline across 2500 microservice logs |
| obs-esql-2-error-breakdown | Service Error Breakdown (ES|QL)SCENARIO | intermediate | Count by service and log level |
| obs-esql-3-root-cause | Root Cause Investigation (ES|QL)MULTI-TURNSCENARIO | advanced | Multi-turn: funnel through noise to find upstream failure |
Vector(4)
| ID | Challenge | Difficulty | Description |
|---|
| vec-1-knn-basic | Basic kNN Search | beginner | kNN nearest neighbor search on dense vector field |
| vec-2-knn-with-filter | kNN with Filter | intermediate | kNN with category filter to restrict candidates |
| vec-3-hybrid | Hybrid Text + Vector | advanced | Combine kNN similarity with keyword text matching |
| vec-4-semantic-category | Semantic + Aggregation | expert | kNN results aggregated by category for classification |
Security(9)
| ID | Challenge | Difficulty | Description |
|---|
| sec-1-ip-range | Denied Traffic from Subnet | beginner | Wildcard/prefix on source IP + action filter |
| sec-2-failed-logins | Brute Force Detection | intermediate | Bool filter + terms agg to find IPs with most failed logins |
| sec-3-rare-domains | DNS Threat Hunting | intermediate | Rare terms aggregation to find unusual domain queries |
| sec-4-alert-triage | Alert Severity Triage | advanced | Filters aggregation to categorize alerts by severity range |
| sec-5-correlation | Compromised Accounts | advanced | Terms + sub-agg to find users with both failed and successful logins |
| mt-4-investigate | Security InvestigationMULTI-TURN | expert | Discover auth schema, find IPs with 3+ failed login attempts |
| sec-esql-1-brute-force | Brute Force Detection (ES|QL)SCENARIO | intermediate | Find IPs with 3+ failed auths in 1500 events |
| sec-esql-2-post-compromise | Post-Compromise Analysis (ES|QL)SCENARIO | advanced | Timeline of attacker activity after successful login |
| sec-esql-3-attack-chain | Full Attack Chain (ES|QL)MULTI-TURNSCENARIO | expert | Multi-turn: classify events into attack phases |
Search(6)
| ID | Challenge | Difficulty | Description |
|---|
| esql-1-basic-filter | ES|QL Basic FilteringSCENARIO | beginner | FROM + WHERE + SORT + LIMIT on 600 articles |
| esql-2-stats-aggregation | ES|QL Stats AggregationSCENARIO | beginner | STATS with COUNT/AVG grouped BY category |
| esql-3-eval-computed | ES|QL Computed Fields with EVALSCENARIO | intermediate | EVAL + CASE for conditional classification |
| esql-4-log-error-analysis | ES|QL Log Error AnalysisSCENARIO | intermediate | Error counting with COUNT_DISTINCT across 2500 logs |
| esql-5-time-bucket | ES|QL Time-Bucketed Log AnalysisSCENARIO | advanced | BUCKET(@timestamp, 5 min) with log.level breakdown |
| esql-6-discover-and-query | ES|QL Discovery and QueryMULTI-TURNSCENARIO | advanced | Multi-turn: discover schema then aggregate top authors |