Dashboard creation in Elasticsearch - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a basic search query in Elasticsearch.

Elasticsearch

{
  "query": {
    "match": {
      "message": "[1]"
    }
  }
}

Drag options to blanks, or click blank then click option'

Auser

Bstatus

Cerror

Dtimestamp

Attempts:

3 left

💡 Hint

Common Mistakes

Using a field name instead of a search term inside the match query.

Leaving the search term blank.

The match query searches for the term inside the specified field. Here, we want to find documents where the message field contains the word error.

2fill in blank

medium

Complete the code to filter documents where the status is 'active'.

Elasticsearch

{
  "query": {
    "bool": {
      "filter": {
        "term": { "status": "[1]" }
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Aactive

Binactive

Cpending

Ddeleted

Attempts:

3 left

💡 Hint

Common Mistakes

Using a value that does not exist in the data.

Confusing filter with query for partial matches.

The term filter matches documents where the status field exactly equals active.

3fill in blank

hard

Fix the error in the aggregation to count documents by user.

Elasticsearch

{
  "aggs": {
    "users_count": {
      "terms": { "field": "[1]" }
    }
  }
}

Drag options to blanks, or click blank then click option'

Auser

Buser.keyword

Cusers

Dusername

Attempts:

3 left

💡 Hint

Common Mistakes

Using the analyzed text field which causes aggregation errors.

Using a field name that does not exist.

To aggregate by a keyword field (exact value), use the .keyword subfield. This ensures the aggregation counts exact user names.

4fill in blank

hard

Fill both blanks to create a date histogram aggregation for monthly data.

Elasticsearch

{
  "aggs": {
    "sales_over_time": {
      "date_histogram": {
        "field": "[1]",
        "interval": "[2]"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

Asale_date

Bmonth

Cday

Dtimestamp

Attempts:

3 left

💡 Hint

Common Mistakes

Using a non-date field for the histogram.

Setting an invalid interval value.

The date_histogram aggregation groups data by time intervals. Use the date field sale_date and set the interval to month to group sales monthly.

5fill in blank

hard

Fill all three blanks to create a filtered aggregation counting errors in the last 7 days.

Elasticsearch

{
  "query": {
    "bool": {
      "filter": [
        { "term": { "level": "[1]" } },
        { "range": { "timestamp": { "gte": "now-[2]d/d" } } }
      ]
    }
  },
  "aggs": {
    "error_count": {
      "value_count": { "field": "[3]" }
    }
  }
}

Drag options to blanks, or click blank then click option'

Aerror

B7

Cmessage

Dwarning

Attempts:

3 left

💡 Hint

Common Mistakes

Using the wrong level value like 'warning'.

Setting the wrong date range.

Counting a field that does not exist.

This query filters logs where the level is error and the timestamp is within the last 7 days. The aggregation counts the number of message fields, representing error occurrences.