Logstash overview in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Logstash filter configuration?

Given the following Logstash filter configuration, what will be the value of the message field after processing?

Elasticsearch

filter {
  mutate {
    add_field => { "message" => "Hello" }
  }
  mutate {
    update => { "message" => "%{message} World" }
  }
}

A "Hello World"

B "Hello"

C "%{message} World"

D "World"

💡 Hint

Remember that update replaces the field value and supports field references.

The first mutate adds the field message with value "Hello". The second mutate updates message by appending " World" using the field reference %{message}. So the final value is "Hello World".

🧠 Conceptual

intermediate

Which Logstash plugin type is responsible for sending data to Elasticsearch?

In Logstash, which plugin type is used to send processed data to Elasticsearch?

A filter

B input

C output

D codec

💡 Hint

Think about the plugin that handles where data goes after processing.

Output plugins in Logstash send data to destinations like Elasticsearch, files, or other systems.

❓ Predict Output

advanced

What error does this Logstash configuration produce?

Consider this Logstash filter snippet. What error will Logstash raise when processing?

Elasticsearch

filter {
  if [nonexistent_field] == "value" {
    mutate {
      add_field => { "new_field" => "test" }
    }
  }
}

A ConfigurationError: mutate plugin missing required parameter

B SyntaxError: unexpected token 'if'

C RuntimeError: field [nonexistent_field] not found

D No error, condition evaluates to false and filter skips

💡 Hint

Logstash conditions on missing fields usually do not cause errors.

If the field does not exist, the condition evaluates to false and the block is skipped without error.

🚀 Application

advanced

How many events will be generated by this Logstash configuration?

Given this Logstash filter configuration, how many events will be output for one input event?

Elasticsearch

filter {
  split {
    field => "tags"
  }
}

A One event per tag in the tags field

B No events, split filter drops events

C Two events always

D One event total, tags remain as an array

💡 Hint

The split filter creates one event per element in the specified field array.

The split filter breaks an array field into multiple events, one per element.

🔧 Debug

expert

Why does this Logstash pipeline fail to start?

Examine this Logstash pipeline configuration snippet. Why will Logstash fail to start?

Elasticsearch

input {
  stdin {}
}
filter {
  mutate {
    add_field => { "field1" => "value1" }
  }
}
output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "myindex"
    user => "elastic"
  }
}

A Invalid host URL format in Elasticsearch output

B Missing password for Elasticsearch output user causes startup failure

C Syntax error in mutate plugin configuration

D stdin input plugin is not supported

💡 Hint

Check required authentication parameters for Elasticsearch output plugin.

The Elasticsearch output plugin requires both user and password if authentication is enabled. Missing password causes startup failure.