Alerting and notifications in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define an alert condition that triggers when the CPU usage is above 80%.

Elasticsearch

{
  "trigger": {
    "name": "High CPU Usage",
    "condition": {
      "script": {
        "source": "return ctx.payload.cpu > [1];"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A90

B100

C80

D70

Attempts:

3 left

💡 Hint

Common Mistakes

Using a threshold lower than 80 causes false alerts.

Using a threshold higher than 80 delays alerting.

The alert triggers when CPU usage is greater than 80%, so the correct value is 80.

2fill in blank

medium

Complete the code to send an email notification when the alert triggers.

Elasticsearch

{
  "actions": {
    "send_email": {
      "email": {
        "to": "[e-mail]",
        "subject": "Alert: CPU Usage High",
        "body": {
          "text": "CPU usage has exceeded [1]%."
        }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A80

B70

C90

D100

Attempts:

3 left

💡 Hint

Common Mistakes

Mismatching the threshold in the email message.

Using an incorrect percentage in the notification.

The email body should mention the threshold that triggers the alert, which is 80% CPU usage.

3fill in blank

hard

Fix the error in the alert condition script to correctly check if memory usage is below 30%.

Elasticsearch

{
  "trigger": {
    "name": "Low Memory Usage",
    "condition": {
      "script": {
        "source": "return ctx.payload.memory [1] 30;"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A<

B==

C>

D>=

Attempts:

3 left

💡 Hint

Common Mistakes

Using > instead of < causes the alert to trigger incorrectly.

Using equality operator == does not cover below threshold.

The condition should check if memory usage is less than 30%, so the operator is <.

4fill in blank

hard

Fill both blanks to create a dictionary alert that maps each server to its disk usage percentage, but only include servers with usage above 75%.

Elasticsearch

{
  "disk_alerts": {
    [1]: [2] for server, usage in servers.items() if usage > 75
  }
}

Drag options to blanks, or click blank then click option'

Aserver

Busage

Cserver.upper()

Dusage + 5

Attempts:

3 left

💡 Hint

Common Mistakes

Using transformed keys or values that don't match the original data.

Including servers with usage below or equal to 75%.

The dictionary comprehension maps each server name to its usage, filtering for usage above 75%.

5fill in blank

hard

Fill all three blanks to create an alert action that logs the alert name, the triggered condition, and the timestamp.

Elasticsearch

{
  "actions": {
    "log_alert": {
      "logging": {
        "text": "Alert [1] triggered because [2] at [3]"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Actx.trigger.name

Bctx.condition.name

Cctx.execution_time

Dctx.payload.value

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect context variables that do not exist.

Mixing up the order of variables in the log message.

The log message includes the alert name, the condition name, and the execution timestamp from the context.