Elastic Certified Observability Engineer study plan

Install and run a local single-node Elasticsearch and Kibana stack, then verify cluster health and version compatibility between components

Ingest a sample dataset with the Elastic Agent standalone installer and confirm documents land in a data stream with the correct index template

Explain the difference between data streams, indices, and index templates by inspecting the generated backing indices and ILM policy attached to them

Trace one document end to end from agent input, through ingest pipelines, to a searchable document in Discover

Configure a custom ingest pipeline with at least one processor (grok, date, or rename) and validate it with the simulate pipeline API before attaching it

Map a custom index with explicit field types and demonstrate the difference in search behavior versus dynamic mapping

Set up an Elasticsearch API key and role that grants write access only to a specific data stream, then test it with a failing and a succeeding request

Compare Elastic Agent integrations versus standalone Beats for one ingestion scenario and justify your choice in writing

Build a log ingestion path with the Elastic Agent system integration and confirm logs appear in the logs-* data stream with host metadata fields populated

Write at least eight KQL queries covering field existence, wildcard, range, and boolean combinations, and record what each returns

Create a Kibana Discover saved search that isolates error-level logs from one service over the last 24 hours

Configure a log threshold alert rule that fires on a spike in error logs and route a notification to a test connector

Extract structured fields from unstructured log lines using grok patterns and verify parsing with the pipeline simulate API on at least five sample lines

Build a Kibana dashboard with a log-rate timeseries, a top-values breakdown by service, and a data table of recent errors

Diagnose and fix one broken grok pattern by reading the ingest pipeline simulate error output

Apply a runtime field to classify log severity and use it in a visualization filter

Deploy the Elastic Agent system integration to collect CPU, memory, disk, and network metrics and confirm each metric field name in the metrics-* data stream

Create a Kibana metrics dashboard comparing host resource usage over time with a threshold line

Configure a metrics threshold alert rule for sustained high CPU and confirm the alert transitions through pending to firing

Explain the role of the Fleet Server in agent policy management and demonstrate a policy change propagating to the agent

Add a second integration (for example Docker or Nginx) to the same agent policy and verify both datasets arrive without conflict

Inspect an agent policy in Fleet and identify which integration inputs map to which data streams

Use the Metrics Explorer or Lens to build a comparison chart across two hosts and explain the aggregation choices

Troubleshoot one agent that reports unhealthy and document the diagnostic steps taken in Fleet and on the host

Instrument a small sample application with the Elastic APM agent and confirm transactions and spans appear in the APM app

Trace a single request through the service map and identify the slowest span in the trace

Configure the APM agent to capture distributed tracing headers across two services and verify the trace links them

Set an APM latency threshold alert and trigger it with a deliberately slow endpoint

Create a synthetic monitor for an HTTP endpoint and a browser monitor for a simple page, then confirm both report uptime and step duration

Review a real user monitoring setup conceptually by identifying which agent configuration enables RUM and what data it produces

Assemble a single Kibana dashboard that combines logs, metrics, and APM latency for one service

Run a timed practice review across all four domains, listing weak areas and the specific docs pages to revisit