An airline operations group is preparing for an Elastic Certified Engineer hands-on task in an Elastic Cloud deployment. The target data set is fleet-metrics; hot shards spiked after a zone failure and a restore drill is scheduled. The task centers on searching or retrieving values computed by a runtime field. Existing aliases and dashboards must keep returning consistent results. The first attempted fix passed a small sample and then failed on a high-cardinality field. The cluster is green at the start of the task, so the issue is not an outage symptom. Which approach best satisfies the requirement while avoiding the failure mode the exam is likely to test?
