Beats (Filebeat, Metricbeat) in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Filebeat configuration snippet?

Given this Filebeat input configuration, what will Filebeat do when started?

Elasticsearch

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/syslog
  multiline.pattern: '^\['
  multiline.negate: true
  multiline.match: after

A Filebeat reads /var/log/syslog and combines lines not starting with '[' into the previous line

B Filebeat reads /var/log/syslog and combines lines starting with '[' into the previous line

C Filebeat reads /var/log/syslog but does not combine any lines because multiline is disabled

D Filebeat reads /var/log/syslog and combines all lines into a single event

💡 Hint

Look at multiline.negate and multiline.match values carefully.

The multiline.pattern '^\[' matches lines starting with '['. With multiline.negate: true and multiline.match: after, lines NOT starting with '[' are appended to the previous line, combining multiline messages correctly.

❓ Predict Output

intermediate

What metric does Metricbeat collect with this module config?

Given this Metricbeat module configuration, what metric will be collected?

Elasticsearch

metricbeat.modules:
- module: system
  metricsets:
    - cpu
    - memory
  period: 10s
  enabled: true

A CPU and memory usage metrics every 10 seconds

B Only CPU usage metrics every 10 seconds

C Only memory usage metrics every 10 seconds

D Disk usage metrics every 10 seconds

💡 Hint

Check the metricsets list carefully.

The configuration enables the system module with cpu and memory metricsets, so both CPU and memory metrics are collected every 10 seconds.

🔧 Debug

advanced

Why does Filebeat fail to start with this config?

This Filebeat config snippet causes Filebeat to fail on startup. What is the cause?

Elasticsearch

filebeat.inputs:
- type: log
  enabled: true
  paths: /var/log/*.log
output.elasticsearch:
  hosts: ["localhost:9200"]

A enabled must be false to start Filebeat

B paths should be a list, not a string

C output.elasticsearch hosts must be a string, not a list

D type: log is invalid, should be type: file

💡 Hint

Check the YAML syntax for paths.

The paths field expects a list of strings, but here it is given as a single string, causing a config error.

❓ Predict Output

advanced

What is the output of this Metricbeat processor configuration?

Given this Metricbeat config snippet, what will be the value of the 'host.name' field in the event?

Elasticsearch

processors:
- add_host_metadata:
    netinfo.enabled: false
- add_cloud_metadata:
- add_fields:
    target: host
    fields:
      name: custom-hostname

A The cloud provider hostname

B The system hostname from the OS

C An empty string

D "custom-hostname"

💡 Hint

Look at the add_fields processor target and fields.

The add_fields processor adds a 'name' field under 'host' with value 'custom-hostname', overriding default host.name.

🧠 Conceptual

expert

Which option best describes the role of Filebeat and Metricbeat in the Elastic Stack?

Choose the most accurate description of Filebeat and Metricbeat roles.

A Both Filebeat and Metricbeat collect logs but from different sources

B Filebeat collects metrics; Metricbeat collects logs

C Filebeat collects and ships log files; Metricbeat collects and ships system and service metrics

D Filebeat and Metricbeat are used to store data in Elasticsearch

💡 Hint

Think about what logs and metrics mean.

Filebeat is designed to collect and ship log files, while Metricbeat collects system and service metrics. They do not store data themselves; Elasticsearch stores data.