Logstash overview in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Logstash filter configuration?

Given the following Logstash filter configuration, what will be the value of the message field after processing?

Elasticsearch

filter {
  mutate {
    add_field => { "message" => "Hello" }
  }
  mutate {
    update => { "message" => "%{message} World" }
  }
}

A "Hello World"

B "Hello"

C "%{message} World"

D "World"

💡 Hint

Remember that update replaces the field value and supports field references.

The first mutate adds the field message with value "Hello". The second mutate updates message by appending " World" using the field reference %{message}. So the final value is "Hello World".

🧠 Conceptual

intermediate

Which Logstash plugin type is responsible for sending data to Elasticsearch?

In Logstash, which plugin type is used to send processed data to Elasticsearch?

A filter

B input

C output

D codec

💡 Hint

Think about the plugin that handles where data goes after processing.

Output plugins in Logstash send data to destinations like Elasticsearch, files, or other systems.

❓ Predict Output

advanced

What error does this Logstash configuration produce?

Consider this Logstash filter snippet. What error will Logstash raise when processing?

Elasticsearch

filter {
  if [nonexistent_field] == "value" {
    mutate {
      add_field => { "new_field" => "test" }
    }
  }
}

A ConfigurationError: mutate plugin missing required parameter

B SyntaxError: unexpected token 'if'

C RuntimeError: field [nonexistent_field] not found

D No error, condition evaluates to false and filter skips

💡 Hint

Logstash conditions on missing fields usually do not cause errors.

If the field does not exist, the condition evaluates to false and the block is skipped without error.

🚀 Application

advanced

How many events will be generated by this Logstash configuration?

Given this Logstash filter configuration, how many events will be output for one input event?

Elasticsearch

filter {
  split {
    field => "tags"
  }
}

A One event per tag in the tags field

B No events, split filter drops events

C Two events always

D One event total, tags remain as an array

💡 Hint

The split filter creates one event per element in the specified field array.

The split filter breaks an array field into multiple events, one per element.

🔧 Debug

expert

Why does this Logstash pipeline fail to start?

Examine this Logstash pipeline configuration snippet. Why will Logstash fail to start?

Elasticsearch

input {
  stdin {}
}
filter {
  mutate {
    add_field => { "field1" => "value1" }
  }
}
output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "myindex"
    user => "elastic"
  }
}

A Invalid host URL format in Elasticsearch output

B Missing password for Elasticsearch output user causes startup failure

C Syntax error in mutate plugin configuration

D stdin input plugin is not supported

💡 Hint

Check required authentication parameters for Elasticsearch output plugin.

The Elasticsearch output plugin requires both user and password if authentication is enabled. Missing password causes startup failure.

Practice

1. What is the primary role of Logstash in the Elastic Stack?

easy

A. To store data in a database

B. To visualize data with dashboards

C. To collect, process, and forward data from various sources

D. To secure the Elastic Stack with authentication

Solution

1. Step 1: Understand Logstash's function

   Logstash is designed to collect and process data from many sources before sending it to storage or analysis tools.

2. Step 2: Compare with other Elastic Stack components

   Elasticsearch stores data, Kibana visualizes it, and security features handle authentication, so these are not Logstash's main roles.

3. Final Answer:

   To collect, process, and forward data from various sources -> Option C

4. Quick Check:

   Logstash = Data collection and processing [OK]

Hint: Remember: Logstash handles data input and processing [OK]

Common Mistakes:

• Confusing Logstash with Elasticsearch or Kibana
• Thinking Logstash stores data permanently
• Assuming Logstash manages security

2. Which section in a Logstash configuration file defines where data comes from?

easy

A. filter

B. input

C. output

D. codec

Solution

1. Step 1: Identify configuration sections

   Logstash config files have three main sections: input, filter, and output.

2. Step 2: Match section to purpose

   The input section specifies data sources, filter modifies data, and output sends data elsewhere.

3. Final Answer:

   input -> Option B

4. Quick Check:

   Data source = input section [OK]

Hint: Input section = data source definition [OK]

Common Mistakes:

• Choosing filter or output instead of input
• Confusing codec with input
• Thinking output defines data source

3. Given this Logstash config snippet:

input { stdin { } } filter { mutate { add_field => { "new_field" => "value" } } } output { stdout { codec => rubydebug } }

What will happen when you type 'hello' and press enter?

medium

A. The input 'hello' is printed with an added field 'new_field' set to 'value'

B. The input 'hello' is discarded and nothing is printed

C. An error occurs because 'add_field' is not valid here

D. The input 'hello' is printed without any changes

Solution

1. Step 1: Analyze input and filter

   The input reads from standard input (stdin). The filter adds a new field named 'new_field' with value 'value' to each event.

2. Step 2: Analyze output

   The output prints the event to stdout using rubydebug codec, which shows all fields including added ones.

3. Final Answer:

   The input 'hello' is printed with an added field 'new_field' set to 'value' -> Option A

4. Quick Check:

   Filter adds field, output shows it [OK]

Hint: Filter adds fields; output shows full event [OK]

Common Mistakes:

• Thinking input is discarded
• Believing add_field causes error
• Assuming output prints raw input only

4. Identify the error in this Logstash config snippet:

input { file { path => "/var/log/syslog" } } filter { grok { match => { "message" => "%{SYSLOGTIMESTAMP:timestamp}" } } } output { elasticsearch { hosts => ["localhost:9200"] } }

medium

A. Elasticsearch output hosts must be a string, not an array

B. Missing closing brace in filter section

C. Grok pattern syntax is incorrect

D. File input path should be an array, not a string

Solution

1. Step 1: Check file input syntax

   The 'path' option for file input expects an array of strings, not a single string.

2. Step 2: Verify other sections

   Filter grok syntax and output hosts as array are correct according to Logstash documentation.

3. Final Answer:

   File input path should be an array, not a string -> Option D

4. Quick Check:

   File path = array required [OK]

Hint: File input path must be an array even for one file [OK]

Common Mistakes:

• Using string instead of array for file path
• Misreading grok pattern syntax
• Thinking output hosts must be string

5. You want to collect logs from multiple servers, add a tag with the server name, and send all logs to Elasticsearch. Which Logstash configuration approach is best?

hard

A. Use multiple input sections with file paths and add tags in filter section, then output to Elasticsearch

B. Use one input section with a wildcard path and add tags in output section

C. Use multiple output sections for each server and add tags in input section

D. Use filter section only to read files and add tags, then output to Elasticsearch

Solution

1. Step 1: Understand data collection from multiple servers

   Multiple input sections allow specifying different file paths per server.

2. Step 2: Add tags in filter section

   The filter section is the right place to add tags like server names to enrich data.

3. Step 3: Output all processed logs to Elasticsearch

   The output section sends all enriched logs to Elasticsearch for indexing.

4. Final Answer:

   Use multiple input sections with file paths and add tags in filter section, then output to Elasticsearch -> Option A

5. Quick Check:

   Input for sources + filter for tags + output to ES [OK]

Hint: Input for sources, filter for tags, output to Elasticsearch [OK]

Common Mistakes:

• Adding tags in output section
• Using filter to read files (wrong place)
• Multiple outputs instead of inputs for servers