Application performance monitoring in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to query APM data for transactions.

Elasticsearch

{
  "query": {
    "match": {
      "[1]": "transaction"
    }
  }
}

Drag options to blanks, or click blank then click option'

Aevent.type

Buser.id

Chost.name

Dservice.name

Attempts:

3 left

💡 Hint

Common Mistakes

Using user.id instead of event.type causes no matching transactions.

Using host.name or service.name filters by host or service, not event type.

The field event.type is used to filter APM transaction events.

2fill in blank

medium

Complete the code to aggregate average transaction duration.

Elasticsearch

{
  "aggs": {
    "avg_duration": {
      "[1]": {
        "field": "transaction.duration.us"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Amin

Bavg

Cmax

Dterms

Attempts:

3 left

💡 Hint

Common Mistakes

Using terms aggregation instead of avg causes a bucket aggregation, not a metric.

Using max or min returns wrong statistics.

The avg aggregation calculates the average value of the specified field.

3fill in blank

hard

Fix the error in the filter to select transactions longer than 1 second.

Elasticsearch

{
  "query": {
    "range": {
      "transaction.duration.us": {
        "[1]": 1000000
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Agte

Blt

Clte

Dgt

Attempts:

3 left

💡 Hint

Common Mistakes

Using lt or lte filters for shorter transactions.

Using gte includes transactions equal to 1 second, which may be acceptable but not the exact fix.

The gt operator filters for values greater than the given threshold.

4fill in blank

hard

Fill both blanks to create a filter for errors with status code 500.

Elasticsearch

{
  "query": {
    "bool": {
      "must": [
        { "term": { "[1]": "error" } },
        { "term": { "[2]": 500 } }
      ]
    }
  }
}

Drag options to blanks, or click blank then click option'

Aevent.type

Btransaction.status

Cerror.status_code

Dhttp.response.status_code

Attempts:

3 left

💡 Hint

Common Mistakes

Using transaction.status instead of event.type misses error events.

Using http.response.status_code may not be present in error documents.

event.type filters for error events, and error.status_code filters for HTTP 500 errors.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that maps service names to average transaction durations over 2 seconds.

Elasticsearch

result = { [1]: [2] for [3] in services if [2] > 2000000 }

Drag options to blanks, or click blank then click option'

Aservice.name

Bavg_duration

Cservice

Dtransaction.duration.us

Attempts:

3 left

💡 Hint

Common Mistakes

Using transaction.duration.us as key or loop variable causes errors.

Using service as key instead of service.name results in wrong dictionary keys.

This comprehension maps each service.name to its avg_duration for services where the average duration is greater than 2,000,000 microseconds (2 seconds).