Elastic Certified Observability Engineer key terms

A single lightweight shipper installed on a host that runs one or more integrations and forwards collected data to Elasticsearch or Logstash, managed centrally through Fleet.

A central management component that enrolls Elastic Agents, distributes policies to them, and receives their status and health check-ins so administrators can control many hosts from one place.

A configuration object in Fleet that binds one integration to one or more agent policies and supplies that integration's settings, such as log paths, dataset names, and credentials.

A named collection of integrations and settings in Fleet that can be assigned to many enrolled agents, letting you change collection behavior on all of them at once.

A short-lived secret generated by Fleet that authorizes a new Elastic Agent to register with a Fleet Server and receive its assigned policy.

A packaged bundle of configuration, ingest pipelines, dashboards, and index templates that teaches Elastic Agent how to collect and parse data from a specific source such as Nginx or Kubernetes.

A named collection of hidden backing indices that share one index template and receive append-only writes, used by integrations to store time-series data efficiently.

The part of a data stream name that identifies which integration produced the documents, for example nginx.access, used for filtering, permissions, and routing.

A user-defined suffix appended to data stream names, typically naming an environment such as production or staging, so data from different sources stays separated.

An ordered set of processors that transform documents between the moment they arrive at Elasticsearch and the moment they are indexed, handling parsing, enrichment, and field cleanup.

A single step inside an ingest pipeline, such as grok, date, rename, or set, that performs one transformation on an incoming document.

A regular-expression-based syntax built from named reusable patterns that extracts structured fields, such as timestamps and status codes, out of unstructured log lines.

A faster, delimiter-based parsing syntax that splits a log line into fields by matching literal separators rather than regular expressions, useful for stable formats.

A shared field naming convention that standardizes names like event.dataset, host.name, and service.name so data from different sources can be searched and correlated consistently.

A rule that applies settings, mappings, and aliases to indices or data streams whose names match a given pattern, ensuring consistent field types across new backing indices.

The schema definition for a field in an index, declaring its data type and how it is indexed, analyzed, or stored, which determines what queries and aggregations are possible.

A field whose value is computed at query time by a script or expression instead of being stored in the index, allowing new calculations without reindexing documents.

An index lifecycle management rule that moves indices through hot, warm, cold, and delete phases based on age or size to control storage cost and retention.

The Kibana interface for exploring log data, offering a stream view, field statistics, live tailing, and categorization to spot unusual patterns quickly.

The Kibana workspace for searching and filtering documents from a data view, showing a histogram of results and a table of fields you can expand and inspect.

A Kibana object that points at one or more indices, data streams, or aliases and defines which fields are shown, letting you analyze data without naming indices each time.

Kibana Query Language, a simplified search syntax supporting free-text terms and field conditions with and, or, and not, used across Kibana search bars.

A Kibana rule that fires when the count of matching log documents in a time window crosses a configured threshold, optionally grouped by a field such as host.

A Kibana configuration that defines how an alert sends notifications, for example to email, Slack, PagerDuty, or a webhook endpoint.

A Kibana rule that evaluates an aggregation over metric documents, such as average CPU usage, against a threshold and triggers actions when the condition is met.

A Kibana tool for selecting a metric, breaking it down by a field, and comparing the result against a baseline to spot infrastructure anomalies visually.

A lightweight shipper that periodically collects system and service metrics from hosts and modules and sends them to Elasticsearch or Logstash.

The Kibana view that groups hosts or containers by attributes such as operating system or cloud region, showing counts and resource usage across your fleet.

The component that receives trace, transaction, span, and error data from instrumented applications, validates it, and writes it into Elasticsearch.

A library added to an application that automatically instruments frameworks and libraries to record request timings, database calls, and errors, then ships them to APM Server.

In APM, a single logical unit of work such as an HTTP request or background job, carrying duration, result, and context, and containing one or more spans.

A timed operation within a transaction, such as a database query or outbound HTTP call, recording its start, duration, and parent relationship to build a call tree.

The complete end-to-end record of a request as it moves across services, composed of linked transactions and spans sharing a trace identifier.

The practice of propagating a trace identifier through service calls so that work performed by multiple applications can be reassembled into one timeline.

A Kibana visualization that draws services as nodes and their calls as edges, annotated with throughput, latency, and error rates to reveal dependencies and bottlenecks.

Browser-side instrumentation that captures page loads, user interactions, and JavaScript errors from actual visitors and reports them to APM Server.

Scheduled scripted checks, such as browser journeys or lightweight HTTP pings, that run from external locations to verify availability and performance even without real traffic.

Periodic lightweight checks of endpoints and network services that record availability, response time, and TLS certificate status over time.

A registered storage location, such as S3 or a shared filesystem, where Elasticsearch writes index backups and from which indices can later be restored.