Centralized logging (ELK stack) in Microservices - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the role of Logstash in ELK stack

In the ELK stack, what is the primary role of Logstash?

A Visualize logs and create dashboards for monitoring

B Store and index logs for fast search and retrieval

C Collect, parse, and transform logs before sending them to Elasticsearch

D Generate logs from microservices automatically

💡 Hint

Think about which component processes and prepares logs before storage.

Logstash collects logs from various sources, parses and transforms them, then forwards them to Elasticsearch for storage.

💻 Command Output

intermediate

Output of Elasticsearch index creation command

What is the expected output when you successfully create an index named 'logs-2024' in Elasticsearch using the following curl command?

curl -X PUT "localhost:9200/logs-2024" -H 'Content-Type: application/json'

A {"acknowledged":false,"index":"logs-2024"}

B {"error":"index_already_exists_exception","status":400}

C curl: (7) Failed to connect to localhost port 9200: Connection refused

D {"acknowledged":true,"shards_acknowledged":true,"index":"logs-2024"}

💡 Hint

Successful index creation returns an acknowledgment with true values.

The response confirms the index was created and shards acknowledged successfully.

❓ Configuration

advanced

Correct Logstash input configuration for Docker logs

Which Logstash input configuration correctly reads Docker container logs from the default JSON file location?

A

input {
  file {
    path => "/var/log/docker.log"
    codec => plain
  }
}

B

input {
  file {
    path => "/var/lib/docker/containers/*/*.log"
    codec => json
  }
}

C

input {
  tcp {
    port => 5044
  }
}

D

input {
  beats {
    port => 5044
  }
}

💡 Hint

Docker stores container logs as JSON files in a specific directory.

The default Docker container logs are JSON files located under /var/lib/docker/containers/*/*.log, so Logstash must read from there with JSON codec.

❓ Troubleshoot

advanced

Diagnosing Kibana dashboard not showing logs

You have set up ELK stack and Logstash is running. However, Kibana dashboards show no logs. Which of the following is the most likely cause?

A Elasticsearch index pattern is not configured in Kibana

B Logstash service is stopped

C Docker containers are not running

D Kibana is running on the wrong port

💡 Hint

Kibana needs to know which Elasticsearch indexes to read from.

If the index pattern is missing in Kibana, it cannot display logs even if data exists in Elasticsearch.

🔀 Workflow

expert

Order of ELK stack components in log processing pipeline

Arrange the ELK stack components in the correct order of processing logs from collection to visualization.

A 4,3,1,2

B 3,4,1,2

C 4,1,3,2

D 3,1,4,2

💡 Hint

Think about which component collects logs first and which shows them last.

Beats collect logs from sources, Logstash processes them, Elasticsearch stores and indexes, Kibana visualizes.