Why ELK stack provides observability in Elasticsearch - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Core components of ELK stack for observability

Which component of the ELK stack is responsible for collecting and shipping logs and metrics from various sources?

A Kibana

B Logstash

C Elasticsearch

D Beats

💡 Hint

Think about the lightweight data shippers designed to send data to Elasticsearch or Logstash.

Beats are lightweight data shippers that collect and send data to Logstash or Elasticsearch, enabling observability by gathering logs and metrics.

❓ Predict Output

intermediate

Output of Elasticsearch query for observability data

What is the output of this Elasticsearch query that counts documents with status 'error'?

Elasticsearch

GET /logs/_count
{
  "query": {
    "match": {
      "status": "error"
    }
  }
}

A {"count": 0, "_shards": {"total": 5, "successful": 5, "skipped": 0, "failed": 0}}

B {"count": 42, "_shards": {"total": 5, "successful": 5, "skipped": 0, "failed": 0}}

C {"error": "index_not_found_exception", "status": 404}

D {"count": "error", "_shards": {"total": 5, "successful": 5, "skipped": 0, "failed": 0}}

💡 Hint

Count returns the number of documents matching the query.

The query counts documents where the field 'status' matches 'error'. The output shows the count as 42, meaning 42 such documents exist.

🔧 Debug

advanced

Identify the error in Logstash configuration

What error will this Logstash configuration cause when trying to parse JSON logs?

Elasticsearch

input {
  beats {
    port => 5044
  }
}
filter {
  json {
    source => "message"
    remove_field => ["message"]
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
  }
}

A Runtime error because 'message' field might not contain valid JSON

B Connection refused error to Elasticsearch host

C SyntaxError due to missing closing brace in filter block

D No error, configuration works correctly

💡 Hint

Consider what happens if the 'message' field is not valid JSON.

If the 'message' field does not contain valid JSON, the json filter will fail at runtime, causing errors in Logstash processing.

📝 Syntax

advanced

Correct syntax for Kibana visualization query

Which Kibana query syntax correctly filters logs with response time greater than 500ms?

A response_time:>500

B response_time > 500

C response_time:> 500

D response_time:>500ms

💡 Hint

Check the correct use of operators and spacing in Kibana query syntax.

Kibana uses Lucene query syntax where range queries require a colon and operator without space, like 'field:>value'.

🚀 Application

expert

How ELK stack enables full observability in distributed systems

Which explanation best describes how the ELK stack provides observability across logs, metrics, and traces?

A By replacing all application code with Logstash pipelines, ELK ensures observability through code instrumentation.

B By using Elasticsearch to generate logs and metrics automatically without external data collection, ELK provides observability.

C By storing all data in Elasticsearch and using Kibana dashboards to visualize logs, metrics, and traces collected via Beats and Logstash, ELK enables monitoring and troubleshooting across distributed systems.

D By using Kibana to collect data directly from servers and storing it in Logstash for analysis.

💡 Hint

Think about the roles of each ELK component in collecting, storing, and visualizing data.

The ELK stack collects data via Beats and Logstash, stores it in Elasticsearch, and visualizes it in Kibana, enabling full observability of distributed systems.