Infrastructure monitoring in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Elasticsearch cluster health status output

What is the output of the following command when the cluster is fully operational with no issues?

Elasticsearch

curl -X GET "localhost:9200/_cluster/health?pretty"

A

{
  "cluster_name" : "my_cluster",
  "status" : "green",
  "number_of_nodes" : 3,
  "active_primary_shards" : 10
}

B

{
  "cluster_name" : "my_cluster",
  "status" : "red",
  "number_of_nodes" : 3,
  "active_primary_shards" : 10
}

C

{
  "cluster_name" : "my_cluster",
  "status" : "yellow",
  "number_of_nodes" : 3,
  "active_primary_shards" : 10
}

D curl: (7) Failed to connect to localhost port 9200: Connection refused

💡 Hint

The cluster health status 'green' means all primary and replica shards are active.

The status field shows the cluster health. 'green' means everything is fine. 'yellow' means some replicas are not allocated. 'red' means some primary shards are missing.

🧠 Conceptual

intermediate

Purpose of Elasticsearch node stats API

What is the main purpose of the Elasticsearch /_nodes/stats API in infrastructure monitoring?

A To create new indices in the cluster.

B To retrieve detailed statistics about nodes such as CPU, memory, and disk usage.

C To delete documents from an index.

D To update cluster settings dynamically.

💡 Hint

Think about what kind of node information helps monitor resource usage.

The /_nodes/stats API provides detailed metrics about each node's resource usage, which is essential for monitoring infrastructure health.

❓ Troubleshoot

advanced

Diagnosing Elasticsearch cluster yellow status

You run curl -X GET "localhost:9200/_cluster/health?pretty" and see the status is 'yellow'. What is the most likely cause?

A The cluster has lost primary shards and is not functional.

B The Elasticsearch service is not running on the node.

C The cluster is fully healthy with no issues.

D Some replica shards are not allocated, but all primary shards are active.

💡 Hint

Yellow means partial issues, not complete failure.

A 'yellow' status means primary shards are fine but some replicas are missing, which can happen if there are not enough nodes for replicas.

🔀 Workflow

advanced

Steps to monitor Elasticsearch disk usage

Which sequence correctly describes the steps to monitor disk usage of Elasticsearch nodes using the API?

A 1,3,2,4

B 2,1,3,4

C 1,2,3,4

D 3,1,2,4

💡 Hint

Think about the logical order: get data, analyze, alert, then review.

First, you get disk stats from the API, then parse them, set alerts if needed, and regularly review to maintain health.

✅ Best Practice

expert

Best practice for alerting on Elasticsearch node failures

Which option describes the best practice for setting up alerts to detect Elasticsearch node failures promptly?

A Configure alerts on node availability using heartbeat monitoring and cluster health status changes.

B Only check disk usage once a month and alert if above 90%.

C Ignore node failures if the cluster status is green.

D Manually check logs daily without automated alerts.

💡 Hint

Effective alerting combines availability checks and cluster health monitoring.

Best practice is to automate alerts for node availability and cluster health changes to react quickly to failures.