Centralized logging (ELK stack) in Microservices - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the log input source in Logstash configuration.

Microservices

input {
  file {
    path => "[1]"
    start_position => "beginning"
  }
}

Drag options to blanks, or click blank then click option'

A/usr/share/logstash

B/var/log/syslog

C/var/log/app.log

D/etc/logstash/conf.d

Attempts:

3 left

💡 Hint

Common Mistakes

Using a directory path instead of a file path

Using a system log file instead of the application log

The path option in Logstash input specifies the log file to read. Here, /var/log/app.log is the application log file.

2fill in blank

medium

Complete the Elasticsearch query to find logs with level 'error'.

Microservices

{
  "query": {
    "match": {
      "level": "[1]"
    }
  }
}

Drag options to blanks, or click blank then click option'

Aerror

Binfo

Cwarning

Ddebug

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'info' or 'debug' instead of 'error'

Using unrelated log levels

The query matches logs where the level field is error, filtering error logs.

3fill in blank

hard

Fix the error in the Kibana index pattern to match logs from all microservices.

Microservices

logs-[1]-*

Drag options to blanks, or click blank then click option'

A*

Bmicroservice

Cservice

Dapp

Attempts:

3 left

💡 Hint

Common Mistakes

Using a specific service name instead of wildcard

Using partial names that don't match all services

The wildcard * matches all microservice names, so the pattern logs-*-* includes logs from all services.

4fill in blank

hard

Fill both blanks to configure Logstash filter to parse JSON logs and add a timestamp.

Microservices

filter {
  json {
    source => "[1]"
  }
  date {
    match => [ "[2]", "ISO8601" ]
  }
}

Drag options to blanks, or click blank then click option'

Amessage

Btimestamp

Clog

Dtime

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong field names like 'log' or 'time'

Not matching the timestamp format correctly

The json filter parses the JSON string from the message field. The date filter uses the timestamp field to set the event time.

5fill in blank

hard

Fill all three blanks to create a Kibana visualization filter for logs with status code >= 500 and service 'auth'.

Microservices

{
  "query": {
    "bool": {
      "must": [
        { "term": { "service": "[1]" } },
        { "range": { "status_code": { "[2]": [3] } } }
      ]
    }
  }
}

Drag options to blanks, or click blank then click option'

Aauth

Bgte

C500

Dlte

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'lte' instead of 'gte'

Using wrong service name

Using string instead of number for status code

The filter matches logs where the service is 'auth' and the status_code is greater than or equal to 500, indicating server errors.

Practice

1. What is the main purpose of the ELK stack in microservices architecture?

easy

A. To manage database transactions

B. To deploy microservices automatically

C. To collect, store, and visualize logs from multiple services in one place

D. To monitor network traffic between services

Solution

1. Step 1: Understand ELK stack components

   ELK stands for Elasticsearch (storage), Logstash (processing), and Kibana (visualization), all focused on logs.

2. Step 2: Identify ELK stack role in microservices

   It centralizes logs from many services to one place for easier monitoring and troubleshooting.

3. Final Answer:

   To collect, store, and visualize logs from multiple services in one place -> Option C

4. Quick Check:

   ELK stack = centralized logging [OK]

Hint: ELK = Elasticsearch + Logstash + Kibana for logs [OK]

Common Mistakes:

• Confusing ELK with deployment tools
• Thinking ELK manages databases
• Assuming ELK monitors network traffic

2. Which of the following is the correct Docker Compose service name for running Elasticsearch in an ELK stack?

easy

A. elasticsearch

B. kibana

C. logstash

D. filebeat

Solution

1. Step 1: Recall ELK stack components

   Elasticsearch stores logs, Logstash processes, Kibana visualizes, Filebeat ships logs.

2. Step 2: Identify correct service name in Docker Compose

   The service running Elasticsearch is named "elasticsearch" in Docker Compose files.

3. Final Answer:

   elasticsearch -> Option A

4. Quick Check:

   Elasticsearch service = elasticsearch [OK]

Hint: Elasticsearch service is named 'elasticsearch' in Docker Compose [OK]

Common Mistakes:

• Confusing Logstash or Kibana as Elasticsearch service
• Using 'filebeat' as ELK core service
• Misspelling service names

3. Given this Logstash configuration snippet:

input { beats { port => 5044 } } output { elasticsearch { hosts => ["http://elasticsearch:9200"] } }

What happens when Logstash receives logs on port 5044?

medium

A. Logs are discarded because port 5044 is incorrect

B. Logs are sent to Elasticsearch at http://elasticsearch:9200

C. Logs are visualized directly by Kibana

D. Logs are stored locally on Logstash server

Solution

1. Step 1: Analyze Logstash input configuration

   Logstash listens for logs from Beats agents on port 5044.

2. Step 2: Analyze Logstash output configuration

   Logs received are forwarded to Elasticsearch at the specified host and port.

3. Final Answer:

   Logs are sent to Elasticsearch at http://elasticsearch:9200 -> Option B

4. Quick Check:

   Logstash input port 5044 forwards logs to Elasticsearch [OK]

Hint: Logstash input port 5044 sends logs to Elasticsearch host [OK]

Common Mistakes:

• Assuming logs go directly to Kibana
• Thinking port 5044 is invalid
• Believing logs are stored locally on Logstash

4. You configured Logstash to receive logs on port 5044, but no logs appear in Elasticsearch. Which is the most likely cause?

medium

A. Docker Compose file is missing Kibana service

B. Kibana is not running

C. Logstash input port is set to 9200 instead of 5044

D. Elasticsearch service is down or unreachable

Solution

1. Step 1: Check connectivity between Logstash and Elasticsearch

   If Elasticsearch is down or unreachable, Logstash cannot send logs to it.

2. Step 2: Verify other options

   Kibana not running or missing does not stop logs from reaching Elasticsearch; wrong input port would prevent Logstash from receiving logs, not sending.

3. Final Answer:

   Elasticsearch service is down or unreachable -> Option D

4. Quick Check:

   Logs missing usually means Elasticsearch unreachable [OK]

Hint: Check Elasticsearch status if logs don't appear [OK]

Common Mistakes:

• Blaming Kibana for missing logs in Elasticsearch
• Confusing input port with Elasticsearch port
• Ignoring Elasticsearch service health

5. You want to add a new microservice that sends logs to the ELK stack using Filebeat. Which steps should you take to ensure logs appear in Kibana?

hard

A. Install Filebeat on the microservice host, configure it to send logs to Logstash on port 5044, and verify Elasticsearch and Kibana are running

B. Install Kibana on the microservice host and configure it to collect logs directly

C. Configure Elasticsearch to pull logs from the microservice host automatically

D. Run Logstash on the microservice host and send logs directly to Kibana

Solution

1. Step 1: Setup Filebeat on microservice host

   Filebeat collects logs locally and forwards them to Logstash on port 5044.

2. Step 2: Ensure ELK stack components are running

   Logstash processes logs, sends them to Elasticsearch, and Kibana visualizes them.

3. Final Answer:

   Install Filebeat on the microservice host, configure it to send logs to Logstash on port 5044, and verify Elasticsearch and Kibana are running -> Option A

4. Quick Check:

   Filebeat -> Logstash -> Elasticsearch -> Kibana [OK]

Hint: Filebeat sends logs to Logstash; Kibana visualizes them [OK]

Common Mistakes:

• Trying to send logs directly to Kibana
• Expecting Elasticsearch to pull logs automatically
• Running Logstash on microservice host unnecessarily