Centralized logging (ELK stack) in Microservices - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the log input source in Logstash configuration.

Microservices

input {
  file {
    path => "[1]"
    start_position => "beginning"
  }
}

Drag options to blanks, or click blank then click option'

A/usr/share/logstash

B/var/log/syslog

C/var/log/app.log

D/etc/logstash/conf.d

Attempts:

3 left

💡 Hint

Common Mistakes

Using a directory path instead of a file path

Using a system log file instead of the application log

The path option in Logstash input specifies the log file to read. Here, /var/log/app.log is the application log file.

2fill in blank

medium

Complete the Elasticsearch query to find logs with level 'error'.

Microservices

{
  "query": {
    "match": {
      "level": "[1]"
    }
  }
}

Drag options to blanks, or click blank then click option'

Aerror

Binfo

Cwarning

Ddebug

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'info' or 'debug' instead of 'error'

Using unrelated log levels

The query matches logs where the level field is error, filtering error logs.

3fill in blank

hard

Fix the error in the Kibana index pattern to match logs from all microservices.

Microservices

logs-[1]-*

Drag options to blanks, or click blank then click option'

A*

Bmicroservice

Cservice

Dapp

Attempts:

3 left

💡 Hint

Common Mistakes

Using a specific service name instead of wildcard

Using partial names that don't match all services

The wildcard * matches all microservice names, so the pattern logs-*-* includes logs from all services.

4fill in blank

hard

Fill both blanks to configure Logstash filter to parse JSON logs and add a timestamp.

Microservices

filter {
  json {
    source => "[1]"
  }
  date {
    match => [ "[2]", "ISO8601" ]
  }
}

Drag options to blanks, or click blank then click option'

Amessage

Btimestamp

Clog

Dtime

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong field names like 'log' or 'time'

Not matching the timestamp format correctly

The json filter parses the JSON string from the message field. The date filter uses the timestamp field to set the event time.

5fill in blank

hard

Fill all three blanks to create a Kibana visualization filter for logs with status code >= 500 and service 'auth'.

Microservices

{
  "query": {
    "bool": {
      "must": [
        { "term": { "service": "[1]" } },
        { "range": { "status_code": { "[2]": [3] } } }
      ]
    }
  }
}

Drag options to blanks, or click blank then click option'

Aauth

Bgte

C500

Dlte

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'lte' instead of 'gte'

Using wrong service name

Using string instead of number for status code

The filter matches logs where the service is 'auth' and the status_code is greater than or equal to 500, indicating server errors.