Logstash overview in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define the input plugin in a Logstash configuration.

Elasticsearch

input {
  [1] {
    port => 5044
  }
}

Drag options to blanks, or click blank then click option'

Afile

Binput

Cstdin

Dbeats

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'file' instead of 'beats' for network input.

The beats plugin is used here to listen on port 5044 for Beats input.

2fill in blank

medium

Complete the code to filter logs by adding a grok filter in Logstash.

Elasticsearch

filter {
  [1] {
    match => { "message" => "%{COMMONAPACHELOG}" }
  }
}

Drag options to blanks, or click blank then click option'

Agrok

Bmutate

Cjson

Dcsv

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'mutate' instead of 'grok' for parsing logs.

The grok filter parses unstructured log data into structured fields.

3fill in blank

hard

Fix the error in the output plugin to send data to Elasticsearch.

Elasticsearch

output {
  elasticsearch {
    hosts => ["[1]"]
    index => "weblogs-%{+YYYY.MM.dd}"
  }
}

Drag options to blanks, or click blank then click option'

A"http://localhost"

B"localhost:9200"

C"localhost"

D"9200"

Attempts:

3 left

💡 Hint

Common Mistakes

Providing only host without port or only port without host.

The hosts option requires the host and port in the format "host:port".

4fill in blank

hard

Fill both blanks to create a Logstash configuration that reads from a file and outputs to stdout.

Elasticsearch

input {
  [1] {
    path => "/var/log/syslog"
    start_position => "beginning"
  }
}
output {
  [2] {
    codec => rubydebug
  }
}

Drag options to blanks, or click blank then click option'

Afile

Belasticsearch

Cstdout

Dtcp

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'tcp' instead of 'file' for input or 'elasticsearch' instead of 'stdout' for output.

The file input reads log files, and stdout outputs to the console.

5fill in blank

hard

Fill all three blanks to create a Logstash filter that adds a tag if the response code is 404.

Elasticsearch

filter {
  if [response] [1] 404 {
    [2] {
      add_tag => ["[3]"]
    }
  }
}

Drag options to blanks, or click blank then click option'

A==

Bmutate

Cnot_found

D!=

Attempts:

3 left

💡 Hint

Common Mistakes

Using '!=' instead of '==' or wrong filter name.

The condition checks if the response code equals 404, then the mutate filter adds the tag 'not_found'.