I85PREP
⌘ K
Elastic Certified Observability Engineer study materials
Elastic Certified Observability Engineer study resources

Elastic Certified Observability Engineer practice questions

One question at a time. Build your Elastic Certified Observability Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Elastic Observability fundamentals and data ingestion

In Elastic Observability, which data stream type is designed to hold application log events and is queried through the Logs app?

  1. Traces
  2. Synthetics
  3. Metrics
  4. Logs Correct answer.

Explanation

Elastic Observability organizes ingested telemetry into signal types, and log events belong to the Logs data stream type, which the Logs app queries. Metrics, traces, and synthetics are separate signal types with their own views and mappings.

Question 2Elastic Observability fundamentals and data ingestion

Which Elastic Agent integration should you add to collect CPU, memory, and disk metrics from the Linux hosts in a fleet?

  1. System Correct answer.
  2. Elasticsearch
  3. Nginx
  4. Kubernetes

Explanation

The System integration collects host-level metrics such as CPU, memory, disk, and network usage from Linux, Windows, and macOS hosts. The other integrations target specific services or platforms rather than general host metrics.

Question 3Elastic Observability fundamentals and data ingestion

What is the primary purpose of a Fleet Server in an Elastic Agent deployment?

  1. Parsing raw log lines into structured fields
  2. Long-term storage of observability documents
  3. Rendering dashboards for observability data
  4. Central management of agent policies and enrollment Correct answer.

Explanation

Fleet Server is the component that Elastic Agents connect to for enrollment, policy updates, and status reporting, enabling centralized management. Storage, visualization, and parsing are handled by other components such as Elasticsearch and ingest pipelines.

Question 4Elastic Observability fundamentals and data ingestion

Which component applies ingest pipelines and index templates to incoming documents before they are written to Elasticsearch?

  1. Data node
  2. Master node
  3. Ingest node Correct answer.
  4. Coordinating node

Explanation

Ingest nodes run ingest pipelines that transform documents, such as parsing and enriching fields, before indexing. Data nodes store shards, master nodes manage cluster state, and coordinating nodes only route requests.

Question 5Elastic Observability fundamentals and data ingestion

A team wants to ship logs from a Kubernetes cluster with minimal manual configuration. Which approach aligns with Elastic Observability best practice?

  1. Store logs on a shared NFS volume and index them nightly
  2. Send logs directly to Kibana over HTTP
  3. Run a Filebeat instance manually on each node with custom config
  4. Deploy Elastic Agent as a DaemonSet using the Kubernetes integration Correct answer.

Explanation

The Kubernetes integration with Elastic Agent deployed as a DaemonSet collects node and pod logs automatically and manages configuration through policies. Manual Filebeat setups, direct Kibana ingestion, and batch indexing add operational overhead and are not the recommended path.

Question 6Elastic Observability fundamentals and data ingestion

Which field is commonly used as the default timestamp field for observability data streams in Elasticsearch?

  1. timestamp_raw
  2. ingest_time
  3. @timestamp Correct answer.
  4. event.time

Explanation

Elastic data streams and integrations use @timestamp as the canonical event time field, and it drives time-based queries and index sorting. Other field names may appear in custom mappings but are not the default.

Question 7Elastic Observability fundamentals and data ingestion

In the Elastic Common Schema, which field holds the IP address of the host that generated an event?

  1. client.ip
  2. host.ip Correct answer.
  3. observer.ip
  4. source.ip

Explanation

ECS defines host.ip for addresses assigned to the host where the event occurred. source.ip and client.ip describe network peers, and observer.ip describes the monitoring component.

Question 8Elastic Observability fundamentals and data ingestion

Which Elasticsearch API is used to define index mappings and settings that apply to the backing indices of a data stream?

  1. Reindex API
  2. Index template API Correct answer.
  3. Snapshot API
  4. Search template API

Explanation

Index templates, including composable templates, define mappings, settings, and aliases applied when new backing indices are created for a data stream. The other APIs handle search templating, backups, and document copying.

Question 9Elastic Observability fundamentals and data ingestion

An ingest pipeline needs to extract fields from an Apache access log line. Which processor is most appropriate for parsing the line with a regular expression?

  1. rename
  2. set
  3. remove
  4. grok Correct answer.

Explanation

The grok processor parses unstructured text using pattern matching and extracts named fields. Rename, remove, and set modify existing fields but do not parse raw text.

Question 10Elastic Observability fundamentals and data ingestion

Which Elastic Agent policy setting determines which integrations and inputs an enrolled agent runs?

  1. Fleet settings
  2. Agent policy Correct answer.
  3. Enrollment token
  4. Output configuration

Explanation

An agent policy groups integrations and inputs, and agents enrolled to that policy receive and apply its configuration. Outputs define where data is sent, Fleet settings configure the server, and enrollment tokens authorize agents.

Question 11Elastic Observability fundamentals and data ingestion

Which data stream naming convention does Elastic use for integration data such as logs collected from the System integration?

  1. traces-<dataset>-<namespace>
  2. custom-<dataset>-<namespace>
  3. logs-<dataset>-<namespace> Correct answer.
  4. metrics-<namespace>-<dataset>

Explanation

Elastic data streams follow a type-dataset-namespace pattern, so logs from a dataset are written to logs-<dataset>-<namespace>. The other options reverse the components or use an unsupported type prefix.

Question 12Elastic Observability fundamentals and data ingestion

A user wants to confirm that documents from a new integration are arriving in Elasticsearch. Which Kibana tool provides a quick view of recently indexed observability documents by data stream?

  1. Alerting
  2. Maps
  3. Canvas
  4. Discover Correct answer.

Explanation

Discover lets you select a data view or data stream, filter by time, and inspect individual documents to verify ingestion. Maps, Canvas, and Alerting serve visualization, presentation, and rule evaluation respectively.

Question 13Elastic Observability fundamentals and data ingestion

What does an Elasticsearch data view (formerly index pattern) primarily provide in Kibana?

  1. A security role that restricts field access
  2. A pipeline that transforms documents at ingest
  3. A physical copy of documents for faster search
  4. A named reference to one or more indices or data streams for querying Correct answer.

Explanation

A data view points Kibana at index patterns or data streams and supplies the field list and time field used by apps. It does not copy data, enforce security, or transform documents.

Question 14Elastic Observability fundamentals and data ingestion

Which Elastic Agent output type sends collected data to a self-managed Elasticsearch cluster while allowing the agent to buffer events locally during outages?

  1. Console output
  2. Kafka output
  3. Logstash output
  4. Elasticsearch output Correct answer.

Explanation

The Elasticsearch output writes events directly to cluster nodes and maintains an internal queue so events can be retried after connectivity returns. Logstash and Kafka outputs route through intermediary systems, and console output only prints to stdout.

Question 15Elastic Observability fundamentals and data ingestion

A pipeline must enrich incoming events with geographic information derived from a client IP address. Which processor accomplishes this?

  1. date
  2. convert
  3. geoip Correct answer.
  4. dissect

Explanation

The geoip processor looks up an IP address in a GeoIP database and adds location fields such as country and city. The date, dissect, and convert processors handle timestamps, tokenization, and type conversion.

Question 16Elastic Observability fundamentals and data ingestion

Which statement best describes the role of an Elasticsearch data stream's write index?

  1. It stores only rolled-over historical documents
  2. It is a snapshot repository for backups
  3. It is a read-only alias used for searches
  4. It is the newest backing index that receives all new documents Correct answer.

Explanation

A data stream writes new documents to its current write index, which is the most recently created backing index. Older backing indices remain searchable but no longer accept writes, and snapshot repositories are separate.

Question 17Elastic Observability fundamentals and data ingestion

Which condition triggers an automatic rollover of a data stream's write index when configured through ILM?

  1. The cluster performs a snapshot
  2. The write index reaches a size or age threshold in its rollover action Correct answer.
  3. A new Kibana space is created
  4. A user manually deletes the write index

Explanation

ILM rollover creates a new write index when configured thresholds such as maximum size, document count, or age are met. Deletion, snapshots, and space creation do not drive rollover.

Question 18Elastic Observability fundamentals and data ingestion

Which Elasticsearch index setting is required for an index to be used as a backing index of a data stream?

  1. index.number_of_replicas set to zero
  2. index.mode set to lookup
  3. index.blocks.read_only set to true
  4. index.hidden set to true Correct answer.

Explanation

Backing indices of a data stream are hidden so they do not clutter index listings and are managed through the data stream. Replica count, lookup mode, and read-only blocks are unrelated to data stream membership.

Question 19Elastic Observability fundamentals and data ingestion

A team wants to add a static tag to every document processed by an integration's ingest pipeline without altering the integration package. Which approach is most appropriate?

  1. Add the tag in Kibana Discover after ingestion
  2. Create a custom ingest pipeline with a set processor and configure it as the final pipeline Correct answer.
  3. Edit the integration package files directly on each host
  4. Disable the integration pipeline and rely on default mappings

Explanation

Custom ingest pipelines can be chained after integration pipelines, and the final pipeline setting appends additional processors such as set. Editing packages directly is not durable, Discover cannot modify stored documents, and disabling pipelines loses parsing.

Question 20Elastic Observability fundamentals and data ingestion

Which setting on an Elasticsearch index controls how many fields can be mapped before indexing fails with a mapping limit error?

  1. index.mapping.total_fields.limit Correct answer.
  2. index.max_result_window
  3. index.number_of_shards
  4. index.refresh_interval

Explanation

The index.mapping.total_fields.limit setting caps the total number of mapped fields to prevent mapping explosion. Refresh interval, shard count, and result window govern visibility, distribution, and pagination instead.

Question 21Elastic Observability fundamentals and data ingestion

What is the effect of setting dynamic to false in an index mapping?

  1. New fields are stored but not indexed or added to the mapping Correct answer.
  2. New fields are rejected and the document fails indexing
  3. New fields overwrite existing fields with the same name
  4. New fields are automatically mapped as keyword

Explanation

With dynamic set to false, unmapped fields are accepted into _source but are not indexed or added to the mapping, so they cannot be searched. Rejecting documents requires strict, and false does not force a data type or overwrite fields.

Question 22Elastic Observability fundamentals and data ingestion

Which Elastic Agent integration collects distributed tracing data from instrumented applications?

  1. Docker
  2. APM Correct answer.
  3. System
  4. AWS

Explanation

The APM integration receives trace spans and transaction data from instrumented applications and powers service maps and latency views. System, Docker, and AWS integrations collect host, container, and cloud metrics or logs.

Question 23Elastic Observability fundamentals and data ingestion

An operator needs to ensure logs from a new data stream are retained for 30 days and then removed. Which Elasticsearch feature should be configured?

  1. Searchable snapshots
  2. Cross-cluster replication
  3. Index lifecycle management Correct answer.
  4. Snapshot lifecycle management

Explanation

Index lifecycle management defines phases such as hot, warm, and delete, and can delete backing indices after a retention period. Snapshot lifecycle management handles backups, replication copies data across clusters, and searchable snapshots mount remote data.

Question 24Elastic Observability fundamentals and data ingestion

Which statement accurately contrasts metrics and logs as observability signal types in Elastic?

  1. Metrics are numeric time-series measurements, while logs are discrete timestamped text events Correct answer.
  2. Metrics are only produced by synthetic monitors
  3. Metrics are free-text records, while logs are numeric counters
  4. Metrics and logs are stored in the same data stream by default

Explanation

Metrics capture numeric values sampled over time, such as CPU percentages, whereas logs record discrete events with messages. They use distinct data stream types, and synthetic monitors produce their own result data rather than all metrics.

Question 25Elastic Observability fundamentals and data ingestion

A pipeline uses the dissect processor with the pattern %{clientip} %{ident} %{auth} [%{timestamp}]. Which outcome is expected when an input line does not match the delimiter pattern?

  1. The processor falls back to grok pattern matching automatically
  2. The dissect processor fails and the document is handled per the on_failure setting Correct answer.
  3. The document is indexed with the original message only
  4. The processor silently assigns empty strings to all fields

Explanation

Dissect requires the input to match the delimiter pattern exactly; a mismatch raises an error that on_failure can handle. It does not auto-fill empty fields, fall back to grok, or bypass the failure silently.

Question 26Elastic Observability fundamentals and data ingestion

In Fleet, which component bundles an integration's ingest pipeline, index template, and data stream definitions so that data is parsed and indexed consistently?

  1. The output configuration
  2. The agent binary
  3. The enrollment token
  4. The integration package Correct answer.

Explanation

An integration package contains the assets that define how collected data is processed and stored, including ingest pipelines, index templates, and data stream definitions. Fleet installs these assets into Elasticsearch when the integration is added to a policy. The agent binary and enrollment token are fleet-management artifacts, and the output only determines where data is shipped.

Question 27Elastic Observability fundamentals and data ingestion

Which Elasticsearch component performs field extraction and transformation on documents before they are indexed, without requiring an external processing tier?

  1. Snapshot repositories
  2. Ingest pipelines Correct answer.
  3. Index aliases
  4. Search templates

Explanation

Ingest pipelines run a series of processors on documents inside Elasticsearch before indexing, so parsing and enrichment happen at the cluster level. Snapshot repositories store backups, search templates store query bodies, and aliases point to indices. None of those transform document fields on the write path.

Question 28Elastic Observability fundamentals and data ingestion

An engineer wants Elastic Agent to collect host metrics and log files from the same machine through a single enrolled policy. Which Fleet concept allows both inputs to be managed together?

  1. A cross-cluster search connection
  2. A standalone Logstash pipeline
  3. A Kibana advanced setting
  4. An agent policy containing multiple integrations Correct answer.

Explanation

A Fleet agent policy can include several integrations, and each integration contributes inputs that the enrolled agent runs. This lets one agent collect metrics and logs under centralized management. Logstash pipelines, cross-cluster search, and Kibana advanced settings do not enroll an agent or assign inputs to it.

Question 29Elastic Observability fundamentals and data ingestion

Which Elastic Common Schema field set is designed to hold information about the operating system and hostname of the machine that produced an event?

  1. http.*
  2. host.* Correct answer.
  3. user.*
  4. event.*

Explanation

The host field set in ECS captures details about the host that generated the event, such as hostname, OS family, and architecture. The user field set describes the account, http describes web request details, and event holds categorization and outcome metadata.

Question 30Elastic Observability fundamentals and data ingestion

Which data stream naming pattern must an integration follow so that Elasticsearch treats it as a data stream rather than a regular index?

  1. logs.<dataset>.<namespace>
  2. logs-<dataset>-<namespace> Correct answer.
  3. logs/<dataset>/<namespace>
  4. logs_<dataset>_<namespace>

Explanation

Elasticsearch recognizes data streams by the type-dataset-namespace pattern, joined by hyphens, such as logs-system.auth-default. Underscores, dots, and slashes do not satisfy the naming rule and the name would be treated as an ordinary index. Following the convention also lets index templates match the stream automatically.

Question 31Elastic Observability fundamentals and data ingestion

Which Kibana application lets an operator inspect the documents stored in a specific data stream and filter them by field values?

  1. Maps
  2. Discover Correct answer.
  3. Canvas
  4. Alerting

Explanation

Discover provides an interactive document explorer where a data view is selected and records are filtered and inspected field by field. Maps visualizes geographic data, Canvas builds presentations, and Alerting evaluates rules. Only Discover is intended for ad hoc document inspection.

Question 32Elastic Observability fundamentals and data ingestion

Which signal type in Elastic Observability is best suited to answering whether a service's request latency has increased over the last hour?

  1. Metrics Correct answer.
  2. Logs
  3. Uptime monitors
  4. Traces

Explanation

Metrics are numeric measurements sampled over time, so latency percentiles and trends can be charted and compared across intervals. Logs record discrete events, traces capture individual request paths, and uptime monitors check availability. Trend comparison over a time window is a metrics use case.

Question 33Elastic Observability fundamentals and data ingestion

An integration's ingest pipeline must copy the value of an existing field into a new field while leaving the original intact. Which processor performs this action?

  1. remove
  2. set Correct answer.
  3. rename
  4. drop

Explanation

The set processor assigns a value to a target field, and that value can reference another field, which copies it without disturbing the source. The rename processor moves a value and removes the original field, remove deletes a field, and drop discards the document. Copying while preserving the source therefore requires set.

Question 34Elastic Observability fundamentals and data ingestion

A pipeline must convert a string field containing a numeric port value into an integer so it can be aggregated numerically. Which processor should be used?

  1. geoip
  2. grok
  3. date
  4. convert Correct answer.

Explanation

The convert processor changes a field's type, for example from string to integer, so numeric aggregations work correctly. Grok extracts fields from text, date parses timestamps, and geoip derives location data. Only convert changes an existing value's data type.

Question 35Elastic Observability fundamentals and data ingestion

An operator wants new documents to be routed to a data stream's write index automatically as older backing indices age. Which mechanism provides this behavior?

  1. A reindex operation run on a schedule
  2. A cross-cluster replication follower
  3. A snapshot lifecycle policy
  4. Index lifecycle management with a rollover action Correct answer.

Explanation

Index lifecycle management can apply a rollover action to a data stream, creating a new write index when the configured conditions are met and moving older backing indices through later phases. Reindex copies documents manually, snapshot policies only back up data, and replication copies indices to another cluster. None of those advance the write index.

Question 36Elastic Observability fundamentals and data ingestion

A pipeline needs to add the fixed string "production" to a field named environment on every document. Which processor configuration accomplishes this?

  1. rename with field environment
  2. set with field environment and value production Correct answer.
  3. gsub with field environment
  4. split with field environment

Explanation

The set processor writes a specified value into a target field, which is exactly the behavior needed for a constant tag. Rename moves an existing value, gsub replaces substrings in an existing value, and split divides a string into an array. Only set introduces a fixed literal.

Question 37Elastic Observability fundamentals and data ingestion

Which processor should be used when a log line has a stable structure with fixed delimiters but the fields contain no reliable regular-expression anchors?

  1. grok
  2. script
  3. dissect Correct answer.
  4. csv

Explanation

The dissect processor parses text using a pattern of literal separators and field placeholders, which is efficient for consistently formatted lines. Grok relies on regular expressions, script runs custom code, and csv targets comma-separated input. For fixed-delimiter lines without regex needs, dissect is the appropriate choice.

Question 38Elastic Observability fundamentals and data ingestion

A pipeline uses the date processor on a field whose values look like 2024-03-01T10:15:30Z. What is the primary effect of this processor?

  1. It replaces the value with the current system time.
  2. It converts the date into a numeric epoch stored as a keyword.
  3. It parses the string into a date value using the specified format and writes it to the target field. Correct answer.
  4. It removes the timezone offset from the original string in place.

Explanation

The date processor reads a string field, interprets it using the declared formats, and stores the resulting date value in a target field so range queries and date histograms work correctly. It does not substitute the current time, force a keyword type, or edit the source string in place.

Question 39Elastic Observability fundamentals and data ingestion

Which statement describes how an Elasticsearch index template interacts with a data stream created by an integration?

  1. The template stores a copy of every document for backup purposes.
  2. The template's mappings and settings are applied to each new backing index as it is created. Correct answer.
  3. The template schedules rollover independently of index lifecycle management.
  4. The template defines the Kibana dashboards shipped with the integration.

Explanation

Index templates supply mappings, settings, and aliases that are applied when a matching index or backing index is created. For data streams, each new backing index inherits the template configuration. Templates do not store documents, define dashboards, or schedule rollover themselves.

Question 40Elastic Observability fundamentals and data ingestion

An engineer needs to verify which processors ran and whether any failed for a specific document sent through an ingest pipeline. Which approach provides that detail?

  1. Open the Fleet enrollment token settings
  2. Simulate the pipeline against a sample document and review the per-processor results Correct answer.
  3. Query the data stream with a match_all search and count the hits
  4. Check the Kibana advanced setting for sample size

Explanation

The simulate pipeline API runs a document through the pipeline and returns the resulting document along with per-processor status, making failures and transformations visible before indexing. A match_all query only shows documents already indexed, and neither enrollment tokens nor Kibana advanced settings report processor execution.

Question 41Elastic Observability fundamentals and data ingestion

A team wants to stop indexing documents whose message field contains a known health-check string, without deleting the surrounding pipeline logic. Which processor accomplishes this?

  1. lowercase with a condition on the message field
  2. drop with a condition on the message field Correct answer.
  3. rename with a condition on the message field
  4. set with a condition on the message field

Explanation

The drop processor discards documents that satisfy its condition, which is the intended way to filter unwanted events inside a pipeline. The other processors transform or rename fields but always allow the document to continue to indexing. Conditional drop is the standard filtering mechanism.

Question 42Elastic Observability fundamentals and data ingestion

Which Elastic Agent capability allows a single agent to collect data for several integrations at once under Fleet management?

  1. Installing a separate agent per integration on the host
  2. Running multiple inputs assigned by the agent policy Correct answer.
  3. Enrolling the same agent with several enrollment tokens
  4. Disabling the agent's output and relying on Beats

Explanation

Fleet assigns inputs from all integrations in a policy to the enrolled agent, and the agent runs those inputs concurrently. Multiple enrollment tokens are not used to attach several policies to one agent, and separate agents per integration are unnecessary. The output must remain configured for data to ship.

Question 43Elastic Observability fundamentals and data ingestion

A mapping defines a text field with a keyword sub-field. What benefit does the keyword sub-field provide?

  1. It converts the field into a numeric type for aggregation
  2. It enables exact-value filtering and sorting on the full field value Correct answer.
  3. It automatically translates values into other languages
  4. It stores the original text for full-text search scoring

Explanation

A keyword sub-field indexes the whole value as a single term, which supports exact matching, sorting, and aggregations. The text portion handles analyzed full-text search. The sub-field does not preserve text for scoring, translate values, or change the field into a number.

Question 44Elastic Observability fundamentals and data ingestion

An operator wants to confirm that a data stream's documents are being enriched with geo location derived from a client IP. Which field family in ECS should be inspected in Discover?

  1. event.action
  2. http.version
  3. host.os.*
  4. source.geo.* Correct answer.

Explanation

ECS stores geographic enrichment for an address under the geo field set nested beneath the address field, such as source.geo.country_iso_code. Host OS details, event action, and HTTP version do not carry location data. Inspecting source.geo confirms the geoip enrichment succeeded.

Question 45Elastic Observability fundamentals and data ingestion

A pipeline uses the grok processor with a pattern that fails to match a document's message. What is the default result for that document?

  1. The document is rejected and an error is returned to the shipper
  2. The message field is automatically truncated to fit the pattern
  3. The grok failure is recorded and the document continues unless ignore_failure or a failure handler is configured Correct answer.
  4. The pipeline restarts and retries the pattern until it matches

Explanation

By default a grok mismatch marks the processor as failed, and unless the pipeline handles failures the document proceeds with the failure recorded rather than being rejected outright. The shipper does not receive an indexing error for a processor mismatch, fields are not truncated, and pipelines do not loop on retries.

Question 46Elastic Observability fundamentals and data ingestion

A team needs a new field added to every event from an integration but cannot modify the packaged pipeline directly. Which approach keeps the change durable across package upgrades?

  1. Add a pipeline that runs after the integration pipeline via the final pipeline setting Correct answer.
  2. Change the data stream name to include the new field
  3. Edit the packaged pipeline in Kibana and save over it
  4. Disable the integration pipeline and index raw documents

Explanation

The final pipeline setting runs a custom pipeline after the integration's own pipeline, so custom processing survives when the package is upgraded and its pipeline is replaced. Overwriting the packaged pipeline is lost on upgrade, disabling parsing discards enrichment, and renaming a data stream does not add fields.

Question 47Elastic Observability fundamentals and data ingestion

An index template sets dynamic to false for an object field. What happens to a document that contains an unmapped sub-field inside that object?

  1. The document is rejected with a strict mapping exception
  2. The entire object is dropped from the stored document
  3. The sub-field is stored in _source but is not indexed or searchable Correct answer.
  4. The sub-field is indexed as a keyword automatically

Explanation

Setting dynamic to false causes unmapped fields to be ignored for indexing while remaining present in the original _source. This avoids mapping explosions without rejecting documents, unlike strict, and no automatic keyword mapping is created. The stored source is preserved intact.

Question 48Elastic Observability fundamentals and data ingestion

A data stream's ILM policy has a rollover action with max_primary_shard_size set to 50gb. What determines when a new write index is created?

  1. The action triggers when a snapshot of the index completes
  2. The action triggers when the number of documents exceeds one million
  3. The action triggers at a fixed daily interval regardless of shard size
  4. The action triggers once the write index's primary shards reach the configured size threshold Correct answer.

Explanation

A size-based rollover condition is evaluated against the primary shard size of the write index, and rollover occurs when that threshold is met. Rollover is not tied to a fixed schedule, a document count unless configured, or snapshot completion. Only the configured condition governs the transition.

Question 49Elastic Observability fundamentals and data ingestion

An engineer wants to test a grok pattern against several sample log lines before deploying it to a live pipeline. Which built-in Kibana capability supports this iteration?

  1. The snapshot repository wizard
  2. The Fleet agent list
  3. The Maps layer editor
  4. The Grok Debugger in Dev Tools Correct answer.

Explanation

The Grok Debugger lets an operator paste sample messages and a pattern and see the extracted fields immediately, which supports iterating before deployment. Maps edits geographic layers, the Fleet agent list shows enrolled agents, and the snapshot wizard manages backups. Only the Grok Debugger evaluates parsing patterns.

Question 50Elastic Observability fundamentals and data ingestion

A pipeline enriches events with geoip data, but queries on source.geo.country_iso_code return no results while other fields are present. Which cause is most consistent with this symptom?

  1. The index template disabled all dynamic mappings for the data stream
  2. The source IP field was empty or private, so the geoip lookup produced no location values Correct answer.
  3. The data stream was rolled over before the query ran
  4. The Discover time filter excluded the current day

Explanation

The geoip processor only enriches addresses that resolve to a public location, so empty or private-range IPs yield no geo fields even though the rest of the document indexes normally. A template disabling dynamic mappings, a rollover, or a time filter would affect other fields or document visibility rather than selectively removing geo values.