Elastic Certified Observability Engineer cheat sheet

Elastic Observability combines logs, metrics, traces, and uptime data in one stack; each signal type maps to a dedicated solution view (Logs, Infrastructure, APM, Synthetics, Uptime).

Ingest paths: Elastic Agent (managed or standalone) ships to Fleet/Elasticsearch; Beats run standalone; Logstash is used when transformation, enrichment, or routing across multiple outputs is required.

Data streams are the default storage model for Observability integrations; they consist of hidden backing indices named .ds---<yyyy.MM.dd>-.

ILM policies on data streams control hot/warm/cold/frozen/delete phases; the logs-* and metrics-* index templates ship with default ILM policies that can be changed per integration.

Index templates: a composable index template defines settings/mappings and is selected by index_patterns; a component template is a reusable fragment referenced by one or more index templates.

Ingest pipelines run processors (grok, dissect, date, rename, remove, set, geoip) before indexing; pipeline failure behavior is controlled by on_failure processors.

Fleet-managed integrations add index templates, ingest pipelines, and dashboards automatically; standalone Agent configurations must supply equivalent assets manually.

Data tiers (data_content, data_hot, data_warm, data_cold, data_frozen) determine shard allocation; index.routing.allocation.include._tier_preference selects the target tier.

Snapshot lifecycle management (SLM) is separate from ILM: ILM moves data between tiers and deletes it, while SLM creates repository snapshots on a schedule.

ECS (Elastic Common Schema) field names matter: event.dataset, host.name, log.level, service.name, message, and @timestamp drive default Logs UI filtering and categorization.

KQL in the Logs UI is field-scoped: log.level : "error" matches analyzed text, while log.level : "error" and escaped variants differ; use quotes for phrases and wildcards for partial matches.

Log categorization groups messages by a machine-learned pattern; the pattern is stored in ml.category and lets you filter or aggregate by message shape rather than exact text.

The Logs UI rate indicator compares the current time range to the previous equivalent window; spikes are computed from document counts per interval, not from severity alone.

Dissect is faster than grok when the log format is fixed-delimiter; grok is required when fields are variable-position or need regex-style matching.

The date processor must set the target field to @timestamp and specify formats and a timezone; otherwise Elasticsearch uses ingest time and event ordering breaks.

Multi-line logs (Java stack traces) must be joined before indexing; Elastic Agent supports multiline configuration per integration, and Logstash uses the multiline codec.

Anomaly detection jobs over log data use population or partition analysis on fields such as host.name or event.dataset to detect per-entity rate changes.

Searching logs across clusters uses cross-cluster search with the remote cluster alias (alias:index-pattern); remote clusters must be configured in elasticsearch.yml or the cluster settings API.

The Metrics Explorer and Metrics UI query TSDB-backed metrics data streams; metric fields are typically double or long with metricset.name and service.name dimensions.

Elasticsearch time series data streams (TSDB) require the index mode time_series and a routing_path; they downsample and use synthetic _source, so field retrieval differs from standard indices.

Elastic Agent policies are the unit of configuration in Fleet: an agent policy references integrations, and each integration adds inputs, datasets, and namespaces.

Agent enrollment requires a Fleet Server URL and an enrollment token; tokens can be created per policy and expire, while service tokens are used for Fleet Server-to-Elasticsearch communication.

System integration metricsets include cpu, memory, diskio, filesystem, load, network, process, and process_summary; host.name and host.ip identify the source host.

Metric thresholds in Infrastructure alerts are defined in rules that query metrics-* with a KQL filter, an aggregation, and a threshold plus a lookback window.

Agent status values in Fleet are Healthy, Unhealthy, Offline, Updating, and Unenrolled; an agent with a policy change stuck in Updating usually cannot reach Fleet Server.

The standalone Agent runs with elastic-agent run and a local elastic-agent.yml; it does not appear in Fleet unless enrolled, and must be upgraded manually.

Logstash monitoring metrics are collected via metricbeat or the Logstash monitoring API and stored in .monitoring-logstash-; Elasticsearch monitoring uses .monitoring-es-.

APM data model: a trace is a set of transactions sharing trace.id; a transaction has a span.id and duration, and spans nest under transactions via parent.id.

APM agents send data to the APM Server, which writes to traces-apm-* data streams; the server is configured with apm-server settings or the apm integration in Fleet.

Service maps are built from span.destination.service.resource and span.subtype/span.type; missing destination fields break downstream dependency edges.

Transaction sampling is controlled by transaction_sample_rate; sampled traces keep all spans for a sampled transaction, while unsampled transactions store summary data only.

The breakdown metrics (span.self_time) attribute time to span types such as db, http, and app; self_time excludes time spent in child spans.

RUM (Real User Monitoring) uses the Elastic APM JS agent and reports page-load and user-interaction transactions with transaction.type "page-load" or "user-interaction".

Synthetics monitors run from Elastic-managed or private locations; browser monitors use Playwright scripts, while lightweight (HTTP/TCP/ICMP) monitors check availability without a browser.

Uptime monitors record status, duration, and TLS certificate data in heartbeat-style documents under the uptime data stream; TLS expiry alerts use the certificate fields.

APM anomaly detection and service-level objectives (SLOs) use the SLO API with a budgeting method (occurrences or timeslices) and an objective target such as 99.9%.