Centralized logging (EFK stack) in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the container image for Elasticsearch in the Kubernetes manifest.

Kubernetes

containers:
  - name: elasticsearch
    image: [1]

Drag options to blanks, or click blank then click option'

Amysql:5.7

Bnginx:latest

Credis:6.2

Delasticsearch:7.17.0

Attempts:

3 left

💡 Hint

Common Mistakes

Using unrelated container images like nginx or mysql.

The Elasticsearch container image must be specified correctly to deploy Elasticsearch as part of the EFK stack.

2fill in blank

medium

Complete the code to set the Elasticsearch service type to expose it internally in the cluster.

Kubernetes

apiVersion: v1
kind: Service
metadata:
  name: elasticsearch
spec:
  type: [1]
  ports:
    - port: 9200
  selector:
    app: elasticsearch

Drag options to blanks, or click blank then click option'

AClusterIP

BLoadBalancer

CNodePort

DExternalName

Attempts:

3 left

💡 Hint

Common Mistakes

Using LoadBalancer or NodePort which expose services outside the cluster unnecessarily.

ClusterIP exposes the service only inside the cluster, which is typical for Elasticsearch in EFK stack.

3fill in blank

hard

Fix the error in the Fluentd ConfigMap to correctly specify the Elasticsearch host.

Kubernetes

apiVersion: v1
kind: ConfigMap
metadata:
  name: fluentd-config
data:
  fluent.conf: |
    <match **>
      @type elasticsearch
      host [1]
      port 9200
    </match>

Drag options to blanks, or click blank then click option'

A127.0.0.1

Belasticsearch.default.svc.cluster.local

Cfluentd

Dlocalhost

Attempts:

3 left

💡 Hint

Common Mistakes

Using localhost or IP addresses which do not resolve to Elasticsearch service inside the cluster.

The host must be the full DNS name of the Elasticsearch service inside the Kubernetes cluster for Fluentd to send logs correctly.

4fill in blank

hard

Fill both blanks to create a Kubernetes Deployment for Kibana with the correct container image and port.

Kubernetes

apiVersion: apps/v1
kind: Deployment
metadata:
  name: kibana
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kibana
  template:
    metadata:
      labels:
        app: kibana
    spec:
      containers:
      - name: kibana
        image: [1]
        ports:
        - containerPort: [2]

Drag options to blanks, or click blank then click option'

Akibana:7.17.0

B9200

C5601

Delasticsearch:7.17.0

Attempts:

3 left

💡 Hint

Common Mistakes

Using Elasticsearch image or port 9200 for Kibana.

Kibana uses its own image and listens on port 5601 by default.

5fill in blank

hard

Fill all three blanks to define a Fluentd DaemonSet with the correct container image, volume mount path, and log path.

Kubernetes

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd
spec:
  selector:
    matchLabels:
      name: fluentd
  template:
    metadata:
      labels:
        name: fluentd
    spec:
      containers:
      - name: fluentd
        image: [1]
        volumeMounts:
        - name: varlog
          mountPath: [2]
      volumes:
      - name: varlog
        hostPath:
          path: [3]

Drag options to blanks, or click blank then click option'

Afluent/fluentd:v1.14.2

B/var/log

Dfluentd:latest

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect image names or mismatched volume mount and host paths.

The Fluentd container image must be correct, and the volume mount path inside the container and the host path must both be /var/log to collect logs properly.

Practice

1. What is the main purpose of the EFK stack in Kubernetes?

easy

A. To collect, store, and visualize logs from all pods centrally

B. To manage Kubernetes cluster networking

C. To automate deployment of applications

D. To monitor CPU and memory usage only

Solution

1. Step 1: Understand EFK components

   The EFK stack consists of Fluentd (log collector), Elasticsearch (log storage), and Kibana (log viewer).

2. Step 2: Identify the main goal

   Its main goal is to centralize logs from all Kubernetes pods for easier troubleshooting and monitoring.

3. Final Answer:

   To collect, store, and visualize logs from all pods centrally -> Option A

4. Quick Check:

   EFK = Centralized logging [OK]

Hint: EFK means Fluentd, Elasticsearch, Kibana for logs [OK]

Common Mistakes:

• Confusing EFK with monitoring CPU/memory
• Thinking EFK manages networking
• Assuming EFK automates deployments

2. Which Kubernetes resource is typically used to deploy Fluentd as a log collector in the EFK stack?

easy

A. ServiceAccount

B. DaemonSet

C. Deployment

D. ConfigMap

Solution

1. Step 1: Understand Fluentd deployment needs

   Fluentd must run on every node to collect logs from all pods on that node.

2. Step 2: Choose correct Kubernetes resource

   DaemonSet ensures one pod per node, perfect for log collectors like Fluentd.

3. Final Answer:

   DaemonSet -> Option B

4. Quick Check:

   Fluentd runs as DaemonSet [OK]

Hint: DaemonSet runs pods on all nodes [OK]

Common Mistakes:

• Using Deployment which may not run on all nodes
• Confusing ConfigMap with deployment type
• Thinking ServiceAccount deploys pods

3. Given this Fluentd config snippet in Kubernetes:

match ** {
  @type elasticsearch
  host elasticsearch.logging.svc.cluster.local
  port 9200
}

What is the main effect of this configuration?

medium

A. Fluentd sends all logs to Elasticsearch service at port 9200

B. Fluentd collects logs only from pods named elasticsearch

C. Fluentd stores logs locally on each node

D. Fluentd forwards logs to Kibana directly

Solution

1. Step 1: Analyze Fluentd match directive

   The match ** means all logs are matched and processed by this output plugin.

2. Step 2: Understand output plugin settings

   @type elasticsearch with host and port means logs are sent to Elasticsearch service at that address.

3. Final Answer:

   Fluentd sends all logs to Elasticsearch service at port 9200 -> Option A

4. Quick Check:

   match ** + elasticsearch output = send all logs to ES [OK]

Hint: match ** means all logs sent to Elasticsearch [OK]

Common Mistakes:

• Thinking logs go directly to Kibana
• Assuming logs are stored locally
• Confusing match pattern with pod names

4. You deployed the EFK stack but Kibana shows no logs. Which of these is the most likely cause?

medium

A. Kibana is configured to use wrong Elasticsearch URL

B. Elasticsearch service port is set to 8080 instead of 9200

C. All of the above

D. Fluentd DaemonSet is not running on nodes

Solution

1. Step 1: Check Fluentd status

   If Fluentd pods are not running, logs won't be collected or sent.

2. Step 2: Verify Elasticsearch connectivity

   Wrong port on Elasticsearch service means Fluentd can't send logs properly.

3. Step 3: Confirm Kibana configuration

   If Kibana points to wrong Elasticsearch URL, it can't display logs.

4. Final Answer:

   All of the above -> Option C

5. Quick Check:

   Any broken link in EFK stops logs [OK]

Hint: Check Fluentd, Elasticsearch port, Kibana URL [OK]

Common Mistakes:

• Checking only one component
• Ignoring service port mismatch
• Assuming Kibana auto-fixes URLs

5. You want to filter out logs from Kubernetes system namespaces (like kube-system and default) before sending to Elasticsearch in Fluentd. Which configuration snippet achieves this?

hard

A. filter ** {
@type grep

key kubernetes.namespace_name
pattern ^kube-system$

}

B. filter ** {
@type record_transformer
remove_keys kubernetes.namespace_name
}

C. filter ** {
@type grep

key kubernetes.namespace_name
pattern ^kube-system$

}

D. filter ** {
@type grep

key kubernetes.namespace_name
pattern ^(kube-system|default)$

}

Solution

1. Step 1: Understand filtering with Fluentd grep plugin

   The grep plugin can exclude logs matching certain patterns using blocks.

2. Step 2: Identify namespaces to exclude

   We want to exclude system namespaces like kube-system and default, so pattern must match both.

3. Step 3: Compare options

   filter ** {
     @type grep
     
       key kubernetes.namespace_name
       pattern ^(kube-system|default)$
     
   }

   excludes both kube-system and default namespaces correctly; others exclude only one or do wrong action.

4. Final Answer:

   filter ** { @type grep key kubernetes.namespace_name pattern ^(kube-system|default)$ } -> Option D

5. Quick Check:

   Exclude system namespaces with grep exclude pattern [OK]

Hint: Use grep exclude with regex for system namespaces [OK]

Common Mistakes:

• Excluding only one namespace
• Using include instead of exclude
• Removing keys instead of filtering logs