Elastic Certified Observability Engineer flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Data stream naming

Data streams follow .ds-<type>-<dataset>-<date>-<generation> for backing indices. The stream name itself is <type>-<dataset>-<namespace>, and writes always go to the newest backing index.

Component template purpose

A component template stores reusable settings, mappings, or aliases. One or more component templates are referenced by a composable index template, which is then matched to indices by index_patterns.

Ingest pipeline on_failure

An on_failure processor list runs when a processor throws an error. It can set a field, remove the document, or route it elsewhere, preventing the whole bulk request from failing.

Standalone versus Fleet Agent

A Fleet-managed Agent receives policy from Fleet Server and appears in the Fleet UI. A standalone Agent reads a local elastic-agent.yml, is upgraded manually, and is invisible to Fleet.

ILM versus SLM

Index lifecycle management moves indices between data tiers and deletes them. Snapshot lifecycle management creates and expires repository snapshots on a schedule. They are separate policies serving different purposes.

Data tier allocation setting

index.routing.allocation.include._tier_preference selects a data tier such as data_hot or data_warm. Elasticsearch allocates shards to nodes with the matching data role, falling back to the next tier in the list.

ECS log fields

Elastic Common Schema standardizes field names across sources: event.dataset identifies the source, log.level the severity, host.name the origin, and message the raw text.

Log rate indicator

The Logs UI rate chart counts documents per time interval and compares the selected range with the preceding equivalent range, so a spike is a change in document volume, not severity.

Log categorization field

Categorization groups similar messages into patterns using machine learning. The assigned pattern is stored in ml.category, enabling aggregation and filtering by message shape instead of exact text.

Grok versus dissect

Dissect splits fixed-delimiter strings and is faster. Grok applies regular-expression patterns and handles variable formats. Use dissect when the log layout is stable, grok otherwise.

Multiline log handling

Stack traces span multiple lines and must be joined before indexing. Elastic Agent integrations accept multiline settings, and Logstash provides a multiline codec, so each event maps to one document.

Date processor requirement

The date processor parses a source field using listed formats and writes the result to a target field. Set the target to @timestamp, otherwise Elasticsearch assigns ingest time and ordering breaks.

Cross-cluster search syntax

Query a remote cluster by prefixing the index pattern with the cluster alias, as in remote1:logs-*. The remote cluster must be registered in the local cluster settings before queries resolve.

Logs anomaly detection partitioning

Anomaly detection jobs on logs often use partition_field_name set to host.name or event.dataset, creating a separate model per entity so each host's normal rate is learned independently.

TSDB index mode

Time series data streams set index.mode to time_series and declare routing_path dimensions. They downsample older data and use synthetic _source, so stored fields are reconstructed rather than returned verbatim.

Agent policy composition

A Fleet agent policy references one or more integrations. Each integration contributes inputs and datasets, and the namespace determines the suffix of the resulting data stream name.

Enrollment token versus service token

Enrollment tokens let Agents enroll into a policy and can expire. Service tokens authenticate Fleet Server and other components to Elasticsearch and are not used for agent enrollment.

System integration metricsets

The system integration collects cpu, memory, diskio, filesystem, load, network, process, and process_summary metricsets. Documents carry host.name and host.ip to identify the source host.

Agent status values

Fleet reports Healthy, Unhealthy, Offline, Updating, and Unenrolled. An agent stuck in Updating after a policy change usually cannot reach Fleet Server over the network.

Metric alert rule anatomy

An Infrastructure threshold rule queries metrics-* with a KQL filter, applies an aggregation such as average over a lookback window, and fires when the value crosses the threshold.

Monitoring index names

Stack monitoring stores Elasticsearch metrics in .monitoring-es-*, Logstash metrics in .monitoring-logstash-*, and Kibana metrics in .monitoring-kibana-*, collected by Metricbeat or internal collectors.

Metricbeat module activation

Metricbeat modules are enabled in modules.d or via elastic-agent integration inputs. Each module defines metricsets, periods, and hosts, and writes to a dataset-specific data stream.

Trace and transaction relationship

A trace groups all transactions sharing trace.id. Each transaction has its own span.id and duration, and child spans reference it through parent.id, forming the trace tree.

APM Server data path

APM agents send events to APM Server, which validates and writes them to traces-apm-* data streams. APM Server runs as the apm integration in Fleet or as a standalone binary.

Service map dependencies

Service map edges come from span.destination.service.resource together with span.subtype and span.type. Missing destination fields mean downstream dependencies do not appear on the map.

Transaction sample rate

transaction_sample_rate sets the fraction of transactions sampled. Sampled traces retain all spans, while unsampled transactions store only summary metrics, reducing storage and agent overhead.

Span self time

span.self_time is the time spent in a span excluding child spans. Breakdown metrics aggregate self time by span type such as db, http, or app to show where latency originates.

RUM transaction types

The Elastic APM JavaScript agent reports Real User Monitoring data. Page loads produce transaction.type page-load, and interactions produce user-interaction, both tied to the browser session.

Synthetics monitor types

Browser monitors run Playwright scripts in a real browser. Lightweight monitors check HTTP, TCP, or ICMP endpoints without a browser, suiting availability checks where rendering is irrelevant.

SLO budgeting methods

An SLO defines a target such as 99.9% over a window. The occurrences method counts good versus total events, while timeslices divides the window into intervals and counts good intervals.

Uptime TLS certificate fields

Uptime monitors record TLS certificate expiry in fields under tls. Alerts on certificate expiration compare those fields against a threshold, warning before the certificate actually lapses.

APM agent central configuration

Fleet or Kibana can push settings such as transaction_sample_rate to APM agents through APM Server central configuration, so agents need not be restarted or reconfigured locally.