Why ELK stack provides observability in Elasticsearch - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create an index in Elasticsearch.

Elasticsearch

PUT /[1]-logs
{
  "mappings": {
    "properties": {
      "timestamp": { "type": "date" },
      "message": { "type": "text" }
    }
  }
}

Drag options to blanks, or click blank then click option'

Auser

Bapp

Csystem

Dnetwork

Attempts:

3 left

💡 Hint

Common Mistakes

Using unrelated index names like 'user' or 'network' for app logs.

The index app-logs is commonly used to store application logs in ELK, which helps in observability.

2fill in blank

medium

Complete the code to query logs with a specific keyword.

Elasticsearch

GET /app-logs/_search
{
  "query": {
    "match": {
      "message": "[1]"
    }
  }
}

Drag options to blanks, or click blank then click option'

Aerror

Binfo

Cdebug

Dtrace

Attempts:

3 left

💡 Hint

Common Mistakes

Using less severe log levels like 'info' or 'debug' when searching for errors.

Searching for the keyword error helps find error logs, which is key for observability.

3fill in blank

hard

Fix the error in the aggregation to count logs by severity level.

Elasticsearch

GET /app-logs/_search
{
  "size": 0,
  "aggs": {
    "levels": {
      "terms": { "field": "[1]" }
    }
  }
}

Drag options to blanks, or click blank then click option'

Ahost

Bmessage

Cseverity.keyword

Dtimestamp

Attempts:

3 left

💡 Hint

Common Mistakes

Using analyzed text fields like 'message' or 'timestamp' for aggregation.

The field severity.keyword is used to aggregate logs by their severity level in ELK.

4fill in blank

hard

Fill both blanks to create a filter for logs between two timestamps.

Elasticsearch

GET /app-logs/_search
{
  "query": {
    "range": {
      "timestamp": {
        "gte": "[1]",
        "lte": "[2]"
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A2024-01-01T00:00:00Z

B2023-12-31T23:59:59Z

C2024-01-31T23:59:59Z

D2023-01-01T00:00:00Z

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping start and end dates or using invalid date formats.

Filtering logs from 2024-01-01T00:00:00Z to 2024-01-31T23:59:59Z helps observe logs in January 2024.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that maps log levels to counts for levels above 'warning'.

Elasticsearch

counts = {level: count for level, count in [1].items() if level [2] 'warning' and count [3] 0}

Drag options to blanks, or click blank then click option'

Alog_counts

B>

Dlog_data

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong variable names or incorrect comparison operators.

This comprehension filters log_counts dictionary to include only levels greater than 'warning' with counts above zero.