Infrastructure monitoring in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is infrastructure monitoring?

Infrastructure monitoring is the process of continuously checking the health and performance of servers, networks, and other hardware to ensure they work well and problems are detected early.

beginner

How does Elasticsearch help in infrastructure monitoring?

Elasticsearch stores and searches large amounts of log and metric data quickly, helping teams analyze infrastructure health and spot issues by querying and visualizing data.

intermediate

What is a common data shipper used with Elasticsearch for monitoring?

Beats, like Metricbeat and Filebeat, are lightweight data shippers that collect metrics and logs from infrastructure and send them to Elasticsearch for monitoring.

beginner

Explain the role of Kibana in infrastructure monitoring with Elasticsearch.

Kibana is a visualization tool that connects to Elasticsearch. It helps create dashboards and charts to easily see infrastructure status and trends from the collected data.

beginner

What is an alert in infrastructure monitoring?

An alert is a notification triggered when a monitored metric crosses a set limit, like high CPU usage, so teams can quickly fix problems before they get worse.

Which Elasticsearch component is used to visualize infrastructure data?

A Kibana

B Logstash

C Metricbeat

D Elasticsearch SQL

Kibana is the visualization tool that connects to Elasticsearch to create dashboards and charts.

What does Metricbeat do in infrastructure monitoring?

A Collects metrics from servers and sends to Elasticsearch

B Visualizes data in dashboards

C Stores data in Elasticsearch

D Triggers alerts on issues

Metricbeat collects system and service metrics and ships them to Elasticsearch.

What is the main purpose of alerts in monitoring?

A To collect metrics

B To store logs

C To visualize data

D To notify when something needs attention

Alerts notify teams when monitored values cross thresholds indicating potential problems.

Which tool is best for shipping log data to Elasticsearch?

A Metricbeat

B Filebeat

C Kibana

D Elasticsearch

Filebeat is designed to collect and ship log files to Elasticsearch.

Why is infrastructure monitoring important?

A To design websites

B To write code faster

C To detect and fix problems early

D To create databases

Monitoring helps catch issues early to keep systems running smoothly.

Describe how Elasticsearch, Beats, and Kibana work together for infrastructure monitoring.

Think of Beats as data collectors, Elasticsearch as the storage and search engine, and Kibana as the display screen.

Explain why setting alerts is useful in infrastructure monitoring.

Imagine alerts as warning lights on a car dashboard.

Practice

1. What is the primary purpose of infrastructure monitoring in Elasticsearch?

easy

A. To create user accounts and manage permissions

B. To store large amounts of data permanently

C. To watch system health and detect issues early

D. To design the user interface of Kibana dashboards

Solution

1. Step 1: Understand infrastructure monitoring

   Infrastructure monitoring means watching your systems to keep them healthy and catch problems early.

2. Step 2: Relate to Elasticsearch context

   Elasticsearch provides APIs to check cluster and node status, which helps monitor system health.

3. Final Answer:

   To watch system health and detect issues early -> Option C

4. Quick Check:

   Infrastructure monitoring = watch health early [OK]

Hint: Monitoring means watching system health regularly [OK]

Common Mistakes:

• Confusing monitoring with data storage
• Thinking monitoring manages user accounts
• Mixing monitoring with UI design

2. Which Elasticsearch API command correctly checks the cluster health status?

easy

A. GET /_cluster/health

B. POST /_cluster/status

C. GET /_nodes/stats

D. PUT /_cluster/health

Solution

1. Step 1: Identify the correct HTTP method and endpoint

   The cluster health API uses GET method and the endpoint is /_cluster/health.

2. Step 2: Eliminate incorrect options

   POST and PUT are not used for checking health; /_nodes/stats gives node stats, not cluster health.

3. Final Answer:

   GET /_cluster/health -> Option A

4. Quick Check:

   Cluster health API = GET /_cluster/health [OK]

Hint: Use GET method with /_cluster/health to check status [OK]

Common Mistakes:

• Using POST or PUT instead of GET
• Confusing node stats with cluster health
• Using wrong endpoint paths

3. What will be the output status field when you run GET /_cluster/health on a healthy Elasticsearch cluster?

medium

A. { \"status\": \"red\" }

B. { \"status\": \"green\" }

C. { \"status\": \"yellow\" }

D. { \"status\": \"blue\" }

Solution

1. Step 1: Understand cluster health status colors

   Green means all primary and replica shards are active, so cluster is healthy.

2. Step 2: Match output with healthy cluster

   Healthy cluster returns status as "green" in the JSON response.

3. Final Answer:

   { "status": "green" } -> Option B

4. Quick Check:

   Healthy cluster status = green [OK]

Hint: Green status means cluster is fully healthy [OK]

Common Mistakes:

• Confusing yellow or red as healthy
• Expecting blue status which does not exist
• Misreading JSON output format

4. You run GET /_nodes/stats but get a 404 error. What is the most likely cause?

medium

A. The API endpoint is incorrect or misspelled

B. You used POST instead of GET method

C. The cluster is down and unreachable

D. The node stats API requires authentication

Solution

1. Step 1: Understand 404 error meaning

   404 means the requested URL or endpoint does not exist on the server.

2. Step 2: Check API endpoint correctness

   If the endpoint is misspelled or wrong, 404 occurs. The correct endpoint is /_nodes/stats.

3. Final Answer:

   The API endpoint is incorrect or misspelled -> Option A

4. Quick Check:

   404 error = wrong endpoint [OK]

Hint: 404 means wrong URL or endpoint [OK]

Common Mistakes:

• Assuming cluster down causes 404 (usually connection error)
• Confusing 404 with authentication errors
• Using wrong HTTP method but expecting 404

5. You want to monitor Elasticsearch nodes for CPU and memory usage continuously. Which approach is best?

hard

A. Restart nodes frequently to reset CPU and memory usage

B. Use GET /_cluster/health to check CPU and memory

C. Install Kibana and create dashboards without data collection

D. Run GET /_nodes/stats regularly and parse CPU/memory fields

Solution

1. Step 1: Identify API for node resource stats

   The /_nodes/stats API provides detailed CPU and memory usage per node.

2. Step 2: Understand monitoring approach

   Regularly running this API and parsing results allows continuous monitoring of resource usage.

3. Final Answer:

   Run GET /_nodes/stats regularly and parse CPU/memory fields -> Option D

4. Quick Check:

   Node stats API for CPU/memory monitoring [OK]

Hint: Use /_nodes/stats API for detailed resource monitoring [OK]

Common Mistakes:

• Using cluster health API which lacks CPU/memory details
• Assuming Kibana dashboards work without data
• Restarting nodes does not monitor usage