Infrastructure monitoring in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Elasticsearch cluster health status output

What is the output of the following command when the cluster is fully operational with no issues?

Elasticsearch

curl -X GET "localhost:9200/_cluster/health?pretty"

A

{
  "cluster_name" : "my_cluster",
  "status" : "green",
  "number_of_nodes" : 3,
  "active_primary_shards" : 10
}

B

{
  "cluster_name" : "my_cluster",
  "status" : "red",
  "number_of_nodes" : 3,
  "active_primary_shards" : 10
}

C

{
  "cluster_name" : "my_cluster",
  "status" : "yellow",
  "number_of_nodes" : 3,
  "active_primary_shards" : 10
}

D curl: (7) Failed to connect to localhost port 9200: Connection refused

💡 Hint

The cluster health status 'green' means all primary and replica shards are active.

The status field shows the cluster health. 'green' means everything is fine. 'yellow' means some replicas are not allocated. 'red' means some primary shards are missing.

🧠 Conceptual

intermediate

Purpose of Elasticsearch node stats API

What is the main purpose of the Elasticsearch /_nodes/stats API in infrastructure monitoring?

A To create new indices in the cluster.

B To retrieve detailed statistics about nodes such as CPU, memory, and disk usage.

C To delete documents from an index.

D To update cluster settings dynamically.

💡 Hint

Think about what kind of node information helps monitor resource usage.

The /_nodes/stats API provides detailed metrics about each node's resource usage, which is essential for monitoring infrastructure health.

❓ Troubleshoot

advanced

Diagnosing Elasticsearch cluster yellow status

You run curl -X GET "localhost:9200/_cluster/health?pretty" and see the status is 'yellow'. What is the most likely cause?

A The cluster has lost primary shards and is not functional.

B The Elasticsearch service is not running on the node.

C The cluster is fully healthy with no issues.

D Some replica shards are not allocated, but all primary shards are active.

💡 Hint

Yellow means partial issues, not complete failure.

A 'yellow' status means primary shards are fine but some replicas are missing, which can happen if there are not enough nodes for replicas.

🔀 Workflow

advanced

Steps to monitor Elasticsearch disk usage

Which sequence correctly describes the steps to monitor disk usage of Elasticsearch nodes using the API?

A 1,3,2,4

B 2,1,3,4

C 1,2,3,4

D 3,1,2,4

💡 Hint

Think about the logical order: get data, analyze, alert, then review.

First, you get disk stats from the API, then parse them, set alerts if needed, and regularly review to maintain health.

✅ Best Practice

expert

Best practice for alerting on Elasticsearch node failures

Which option describes the best practice for setting up alerts to detect Elasticsearch node failures promptly?

A Configure alerts on node availability using heartbeat monitoring and cluster health status changes.

B Only check disk usage once a month and alert if above 90%.

C Ignore node failures if the cluster status is green.

D Manually check logs daily without automated alerts.

💡 Hint

Effective alerting combines availability checks and cluster health monitoring.

Best practice is to automate alerts for node availability and cluster health changes to react quickly to failures.

Practice

1. What is the primary purpose of infrastructure monitoring in Elasticsearch?

easy

A. To create user accounts and manage permissions

B. To store large amounts of data permanently

C. To watch system health and detect issues early

D. To design the user interface of Kibana dashboards

Solution

1. Step 1: Understand infrastructure monitoring

   Infrastructure monitoring means watching your systems to keep them healthy and catch problems early.

2. Step 2: Relate to Elasticsearch context

   Elasticsearch provides APIs to check cluster and node status, which helps monitor system health.

3. Final Answer:

   To watch system health and detect issues early -> Option C

4. Quick Check:

   Infrastructure monitoring = watch health early [OK]

Hint: Monitoring means watching system health regularly [OK]

Common Mistakes:

• Confusing monitoring with data storage
• Thinking monitoring manages user accounts
• Mixing monitoring with UI design

2. Which Elasticsearch API command correctly checks the cluster health status?

easy

A. GET /_cluster/health

B. POST /_cluster/status

C. GET /_nodes/stats

D. PUT /_cluster/health

Solution

1. Step 1: Identify the correct HTTP method and endpoint

   The cluster health API uses GET method and the endpoint is /_cluster/health.

2. Step 2: Eliminate incorrect options

   POST and PUT are not used for checking health; /_nodes/stats gives node stats, not cluster health.

3. Final Answer:

   GET /_cluster/health -> Option A

4. Quick Check:

   Cluster health API = GET /_cluster/health [OK]

Hint: Use GET method with /_cluster/health to check status [OK]

Common Mistakes:

• Using POST or PUT instead of GET
• Confusing node stats with cluster health
• Using wrong endpoint paths

3. What will be the output status field when you run GET /_cluster/health on a healthy Elasticsearch cluster?

medium

A. { \"status\": \"red\" }

B. { \"status\": \"green\" }

C. { \"status\": \"yellow\" }

D. { \"status\": \"blue\" }

Solution

1. Step 1: Understand cluster health status colors

   Green means all primary and replica shards are active, so cluster is healthy.

2. Step 2: Match output with healthy cluster

   Healthy cluster returns status as "green" in the JSON response.

3. Final Answer:

   { "status": "green" } -> Option B

4. Quick Check:

   Healthy cluster status = green [OK]

Hint: Green status means cluster is fully healthy [OK]

Common Mistakes:

• Confusing yellow or red as healthy
• Expecting blue status which does not exist
• Misreading JSON output format

4. You run GET /_nodes/stats but get a 404 error. What is the most likely cause?

medium

A. The API endpoint is incorrect or misspelled

B. You used POST instead of GET method

C. The cluster is down and unreachable

D. The node stats API requires authentication

Solution

1. Step 1: Understand 404 error meaning

   404 means the requested URL or endpoint does not exist on the server.

2. Step 2: Check API endpoint correctness

   If the endpoint is misspelled or wrong, 404 occurs. The correct endpoint is /_nodes/stats.

3. Final Answer:

   The API endpoint is incorrect or misspelled -> Option A

4. Quick Check:

   404 error = wrong endpoint [OK]

Hint: 404 means wrong URL or endpoint [OK]

Common Mistakes:

• Assuming cluster down causes 404 (usually connection error)
• Confusing 404 with authentication errors
• Using wrong HTTP method but expecting 404

5. You want to monitor Elasticsearch nodes for CPU and memory usage continuously. Which approach is best?

hard

A. Restart nodes frequently to reset CPU and memory usage

B. Use GET /_cluster/health to check CPU and memory

C. Install Kibana and create dashboards without data collection

D. Run GET /_nodes/stats regularly and parse CPU/memory fields

Solution

1. Step 1: Identify API for node resource stats

   The /_nodes/stats API provides detailed CPU and memory usage per node.

2. Step 2: Understand monitoring approach

   Regularly running this API and parsing results allows continuous monitoring of resource usage.

3. Final Answer:

   Run GET /_nodes/stats regularly and parse CPU/memory fields -> Option D

4. Quick Check:

   Node stats API for CPU/memory monitoring [OK]

Hint: Use /_nodes/stats API for detailed resource monitoring [OK]

Common Mistakes:

• Using cluster health API which lacks CPU/memory details
• Assuming Kibana dashboards work without data
• Restarting nodes does not monitor usage