Elasticsearch - ELK Stack Integration
You want to monitor the average response time for your app but only for transactions with errors. Which Elasticsearch query snippet correctly filters and calculates this?
You want to monitor the average response time for your app but only for transactions with errors. Which Elasticsearch query snippet correctly filters and calculates this?
hard📝 Best Practice Q15 of Q15
Step-by-Step Solution
Solution:
Step 1: Identify filter for transactions with errors
Transactions with errors have a non-empty "error.id" field, so we use "exists" query on "error.id".Step 2: Confirm aggregation on filtered data
The aggregation calculates average response time only on filtered documents, which is correct.Final Answer:
{ "size": 0, "query": { "exists": { "field": "error.id" } }, "aggs": { "avg_response_time": { "avg": { "field": "transaction.duration.us" } } } } -> Option BQuick Check:
Filter errors with exists + avg aggregation = { "size": 0, "query": { "exists": { "field": "error.id" } }, "aggs": { "avg_response_time": { "avg": { "field": "transaction.duration.us" } } } } [OK]
Quick Trick: Use exists query to filter error transactions [OK]
Common Mistakes:
MISTAKES- Using empty term query instead of exists
- Calculating average without filtering errors
- Filtering for success instead of errors
Master "ELK Stack Integration" in Elasticsearch
Want More Practice?
15+ quiz questions · All difficulty levels · Free
Free Signup - Practice All QuestionsMore Elasticsearch Quizzes