Top ELK Stack Interview Questions and Answers

Q1. What is ELK?

Ans

The ELK Stack is a collection of three open-source products — Elasticsearch, Logstash, and Kibana. They are all developed, managed, and maintained by the company Elastic.

• E stands for ElasticSearch: It is used for storing logs.
• L stands for LogStash: It is used for both shipping as well as the processing and storing logs.
• K stands for Kibana: It is a visualization tool (a web interface) that is hosted through Nginx or Apache.

Q2. What is Kibana?

Ans

Kibana is an open-source visualisation and reporting user interface developed in 2013 by Rashid Khan of the Elastic Company.

Kibana allows users to produce visualisations from a variety of data inputs & can create pie charts, heat maps, line graphs, scatter plots and so much more to reflect data in an easily digestible format.

Q3. What are the advantages of using Kibana?

Ans

A few of the main benefits of using Kibana are as follows:

• Real-time observability
• Integration with Elasticsearch
• Browser-based visualisation tool
• Many graphs and charts to select from

Q4. What are the advantages of using the ELK Stack?

Ans

The ELK Stack can be used for a wide variety of use cases including but not limited to;

• APM
• SIEM
• Log analysis
• Server monitoring
• Container monitoring
• Metrics management
• Vulnerability scanning
• Compliance & auditing
• Infrastructure monitoring
• Monitoring website uptime
• Measuring sales performance
• Understanding user behaviour

Q5. How do you start Kibana?

Ans

When Kibana has been installed using a .tar.gz package on Linux, it can be started from the command line using the following command: ./bin/kibana For additional installation types & operating systems consult the following guide.

Q6. How do you search Kibana?

Ans

In Kibana you can easily search the current index pattern you are viewing by entering your search criteria in the Query bar visible near the top left-hand side of your screen. Conveniently Kibana also shows its users a filtering dialogue which provides somewhat of a cheat sheet for easier filtering to be conducted.

Q7. How can you create a Kibana dashboard?

Ans

Once you have Kibana loaded you will want to open the main menu and select Dashboard, from here you can select Create Dashboard. Once this step has been completed you will need to add panels of data to your dashboard for further visualisations and chart type selection to be applied.

Q8. Where are Kibana dashboards stored?

Ans

Kibana dashboards are stored in Elasticsearch under the default index kibana-int which can be edited within the config.js file if you wish to store your dashboards in a different location.

Q9.  What are common reasons that Kibana might be slow to load?

Ans

If you find that your Kibana instance is loading slowly it is often mentioned in the support forums that the reason this happens is due to the Apps bundle or apps themselves loading in the background.

Q10. What is the line chart used for in Kibana?

Ans

A line chart (also known as a line graph) is a type of data visualisation that displays data as a series of points that reflects changes over a designated time period.

Q11. Explain the different components available in ELK stack?

Ans

Components of ELK stack:

• Elastic Search: Elastic Search in ELK is the product that stores the data of the applications and log management.
• Logstash: Logstash in ELK is the server component designed to process the incoming logs and feeds to ElasticSearch.
• Kibana: Kibana in ELK is the web interface designed to search and visualize the logs based on the business needs.

Q12. Define Kibana docker image, kibana port, kibana.yml file?

Ans

Kibana Docker image: Kibana Docker images are of two different flavors called X-pack flavor and Oss Flavour. X-pack is the docker image that is pre-installed one, hence called as default. Concerning the Oss flavor, it doesn't have any link with the X-pack, but it is only an open-source one.

Kibana Port and Kibana.yml file: The configuration of the default setting is done on the localhost 5601 to run Kibana. The port number can be changed, or the connection can be established in an Elasticsearch that is installed on another machine, the kibana.yml file has to be updated. The Kibana server will then read the properties of the kibana.yml file.

Q13. What are the significant components of Kibana? 

Ans

Kibana provides the flexibility to host the Elasticsearch and navigate to perform the searching and modifications efficiently. The major components of the Kibana are listed below:

• Discover
• Visualize
• Dashboard
• Settings

Q14.What do you know about the Kibana visualize interface?

Ans

Kibana Visual interface: Kibana visual interface is a platform designed to make the changes or modifications to the customs based on the requirements. This includes bars, pie charts, and tables related to data.

Q15. What do you know about Logstash is ELK?

Ans

Logstash is the product in ELK that is called as the data-pipeline tool. It is specifically designed to perform operations like collecting, storing, and parsing the logs for future use. It is an open-source data collection engine capable of unifying the data from multiple resources and normalizing it. Logstash also helps in diverse downstream analytics for business enhancements.

Q16. Define the term Filebeat?

Ans

Filebeat is used to represent the shipping of the log files or log data. Filebeat is designed to play the logging agent's role, which is installed on the machine generating the log files, tailing them, and forwarding the data to either Logstash for advanced processing or directly into Elasticsearch for indexing.

Q17. What does a logstash forwarder do?

Ans

The filebeat is dependent on the Logstash forwarder source code and replaces the Logstash forwarder. This method is specifically used to make use of the tailing log file and forward the same accordingly to the Logstash.

Q18. Can you specify which Java version is required to install the Logstash? What are the different inputs in Logstash?

Ans

The Java version required to install the Logstash is Java8, while it does not support Java9. Some of the inputs used in Logstash are:

• File
• Syslog
• Redis
• beats

Q19. Explain ELK stack architecture

Ans

ELK Stack is designed to allow users to take to data from any source, in any format, and to search, analyze, and visualize that data in real-time.

• Logs: Server logs that need to be analyzed are identified
• Logstash: Collect logs and events data. It even parses and transforms data.
• ElasticSearch: The transformed data from Logstash isStore, Search, and indexed.
• Kibana: Kibana uses Elasticsearch DB to Explore, Visualize, and Share

Q20. What are the reason for using ELK stack?

Ans

Here, are reasons for using ELK stack:

• ELK works best when logs from various Apps of an enterprise converge into a single ELK instance
• It provides amazing insights for this single instance and also eliminates the need to log into a hundred different log data sources.
• Rapid on-premise installation
• Easy to deploy Scales vertically and horizontally
• Elastic offers a host of language clients, which includes Ruby. Python. PHP, Perl, .NET, Java, and JavaScript, and more
• Availability of libraries for different programming and scripting language

Q21. What are the primary operations performed in a Document?

Ans

Here, are important operation performed on documents:

• Indexing a document
• Fetching documents
• Updating documents
• Deleting documents

Q22. What are the X- Pack Commands?

Ans

X-Pack commands which will aid you in configuring security:

• migrate
• saml-metadata
• certutil
• syskeygen
• users
• certgen
• setup-passwords

Q23. What are the documents accessible in ElasticSearch?

Ans

The document is fundamentally the same as a row in relational databases. Each report in the index has a diverse structure however has a similar data type for particular fields. 

MySQL => Databases => Tables => Columns/Rows 

ElasticSearch => Indices => Types => Documents with Properties

Q24. Explain the Analyzers in Elasticsearch

Ans

While ordering information in ElasticSearch, information is moved inside by the Analyzer characterized for the index, and afterwards listed. An analyzer is a collection of filters and tokenizers. Analyzers accessible in ElasticSearch 1.10 are given below:

• Custom Analyzer
• WhiteSpace Analyzer
• Simple Analyzer
• Keyword Analyzer
• Pattern Analyzer
• Stop Analyzer
• Language Analyzer
• Standard Analyzer
• Snowball Analyzer

Q25. Explain the purpose of utilizing ELK Stack

Ans

• It gives astounding experiences to this single instance  and furthermore deletes the requirement to sign into a hundred diverse log information sources. 
• Simple to send Scales horizontally and vertically.
• ELK functions accurately when logs from different Apps of an undertaking merge into a solitary ELK instance.
• Fast on-premise establishment 
• Accessibility of libraries for various programming and scripting languages
• Elastic provides a large group of language customers, which incorporates Python, Ruby, PHP, .NET, Perl, Java, and JavaScript.

Q26. What are the use cases that are related to ELK log analytics?

Ans

The use cases of ELK log analytics are given below:

• E-commerce Search solution
• Market Intelligence
• Security analysis
• Fraud detection
• Compliance
• Risk management

Q27. What is the query language of ElasticSearch?

Ans

Elasticsearch provides a query DSL(Domain Specific Language) on the basis of JSON for defining the queries. Query DSL contains two kinds of clauses:

1) Leaf Query Clauses

Leaf Query Clauses search for a specific value in a specific field, like the term, range, or match queries.

2) Compound Query Clauses

Compound Query Clauses enclose other compound or leaf queries, and we use them for logically combining queries.

Q28. What is a Tokenizer in ElasticSearch?

Ans

A Tokenizer breakdown fields values of a document into a stream, and inverted indexes are created and updated using these values, and these stream of values are stored in the document.

Q29. What is a replica in ElasticSearch?

Ans

Each shard in ElasticSearch has 2 copies of the shard. These copies are called replicas. They serve the purpose of high availability and fault tolerance.

Q30. What is indexing in ElasticSearch?

Ans

The process of storing data in an index is called indexing in ElasticSearch. Data in ElasticSearch can be divided into write-once and read-many segments. Whenever an update is attempted, a new version of the document is written to the index.

Q31. What is a node in ElasticSearch?

Ans

Each instance of ElasticSearch is called a node. Multiple nodes can work in harmony to form an ElasticSearch Cluster.

Q32. What is a shard in ElasticSearch?

Ans

Due to resource limitations like RAM, CPU, etc, for scale-out, applications need to employ multiple instances of ElasticSearch on separate machines. Data in an index can be divided into multiple partitions, each handled by a separate node (instance) of ElasticSearch. Each such partition is called a shard. By default, an ElasticSearch index has 5 shards.

Q33. What is the syntax or code to add a Mapping in an Index?

Ans

Syntax:

 POST /_<index_name>/_type/_id

Q34. What is the syntax/code to retrieve a document by ID in Elasticsearch?

Ans

GET API fetches the specified JSON document from an index.

Syntax: 

 GET <index_name>/_doc/<_id>

Q35. What software is required to install Elasticsearch?

Ans

The latest JDK or Java version 1.8.0 is a prerequisite to install Elasticsearch.

Q36. List out different commands available in Elasticsearch cat API?

Ans

Command using with cat API are:

• Cat aliases, cat field data, cat allocation, cat count
• Cat health,  pending tasks, cat plugins, cat indices, cat master, cat recovery
• cat repositories, cat templates, cat snapshots

Q37. What are some of the configuration management tool supported by Elasticsearch

Ans

Some important configuration management tool supported by Elasticsearch is as follows:

• Puppet – puppet-elastic search
• Chef – cookbook-elastic search
• Ansible – ansible-elastic search

Q38. What are the various ways of searching in Elasticsearch?

Ans

We have different ways of searching in Elasticsearch:

• Multi-index, Multitype search: A user can search APIs that can be applied across several indices through a multi-index support system.
• URI (uniform resource identifier) search: A user can execute a search request using a URI by providing the requested parameters.
• Request body search: A search request needs to be executed by a search DSL.

Q39. What are some of the configuration management tool supported by Elasticsearch

Ans

Some important configuration management tool supported by Elasticsearch is as follows:

• Puppet – puppet-elastic search
• Chef – cookbook-elastic search
• Ansible – ansible-elastic search

Q40.  What is Grok?

Ans

Grok is a filter plugin for Logstash that is used to parse unstructured data. It is often used for transforming Apache, Syslog and other webserver logs into a structured and queryable format for easier data analysis to be performed.

Q41. What is fuzzy search?

Ans

Fuzzy search allows Elasticsearch to return positive matches for non-exact matches of the term you are searching for. This is especially beneficial for eCommerce retailers where site visitors may often have typos in their spelling when trying to locate a product they wish to purchase. Fuzzy match results mean that these visitors are not served with a blank page which would often lead to a user being less likely to convert.

Q42.  What are common reasons that Kibana might be slow to load?

Ans

If you find that your Kibana instance is loading slowly it is often mentioned in the support forums that the reason this happens is due to the Apps bundle or apps themselves loading in the background.

Q43. What is the line chart used for in Kibana?

Ans

A line chart (also known as a line graph) is a type of data visualisation that displays data as a series of points that reflects changes over a designated time period.

Q44. What is the curl command?

Ans

The curl command in Elasticsearch allows you to take many actions including but not limited to: deleting indexes, list all indexes, list all documents within an index, query using URL parameters, add data and list index mappings.

Q45.  How do you delete an index in Elasticsearch?

Ans

By using the DELETE /index name. Command.

Q46. How do you install Logstash plugins?

Ans

To find individual download and install commands specific to the Logstash plugin you are wishing to install, RubyGems provides a wealth of resources to help you. Once you've selected the plugin you wish to use you can add it to your Logstash installation using the following command: bin/logstash-plugin install logstash-input-github

Q47. Where can you write Logstash configuration in Elasticsearch?

Ans

Logstash settings can be found located at the {extract.path}/config directory. Logstash settings can be configured from the following files found here: logstash.yml, pipelines.yml, jvm.options, log4j2.properties and within Linux there is an additional configuration file called startup.options.

Q48. How can you use Logstash GeoIP?

Ans

The Logstash GeoIP filter is used to add supplementary information on the geographic location of IP addresses based on data available within the MaxMind GeoLite2 database.

Q49.  How can you test Logstash performance?

Ans

You can use the node stats API to retrieve runtime statistics from Logstash.

Q50. What is a Logstash pipeline?

Ans

A Logstash pipeline consists of these elements as listed in the following order: Input (the source of data), filter (processing, parsing & enrichment of data) & output (write the data for use within Elasticsearch & Kibana).

Q51. Can you name five companies that have an elastic search as their search engine and database for their application?

Ans

• Uber
• Stack Overflow
• DigitalOcean
• Udemy
• Wikipedia
• Netflix