Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Why run the log collector as a DaemonSet?

   1. AIt's required by Elasticsearch
   2. BContainer logs are files on each node, so one collector pod per node can read all of them without changing applications
   3. CTo save Elasticsearch disk
   4. DDaemonSets are faster to start
   Show answer

   B. Apps write to stdout/stderr; the runtime writes files on the node; the per-node collector tails them.

   From lesson 01 · EFK architecture

2. Q2. Why is `kubectl logs` not enough in production?

   1. AIt's too fast
   2. BLogs disappear when pods are deleted or nodes rotate files, you can't search across many pods and days, and you can't alert on them
   3. CIt needs root
   4. DIt only shows JSON
   Show answer

   B. Central logging keeps history independent of pod lifetimes and makes it searchable across the fleet.

   From lesson 01 · EFK architecture

3. Q3. What's the E, F and K in EFK?

   1. AEtcd, Flannel, Kubelet
   2. BElasticsearch (storage/search), Fluent Bit or Fluentd (collection), Kibana (UI)
   3. CEnvoy, Falco, Kyverno
   4. DElastic, Filebeat, Kafka
   Show answer

   B. ELK uses Logstash instead of Fluent Bit/Fluentd for processing.

   From lesson 01 · EFK architecture

4. Q4. Cluster health is yellow. What does it mean?

   1. AData is lost
   2. BAll primary shards are assigned, but at least one replica isn't; searches work but redundancy is reduced
   3. CThe cluster is read-only
   4. DKibana is down
   Show answer

   B. Yellow = primaries OK, replicas missing (common on single-node clusters with replicas > 0). Red = at least one primary is unassigned.

   From lesson 02 · Elasticsearch fundamentals

5. Q5. You want exact filtering and aggregations on `kubernetes.namespace_name`. Which field type?

   1. Atext
   2. Bkeyword
   3. Cfloat
   4. Dgeo_point
   Show answer

   B. text is analyzed (split into terms) for full-text search; keyword stores the exact value for filters, sorting and aggregations.

   From lesson 02 · Elasticsearch fundamentals

6. Q6. Why is oversharding (thousands of tiny shards) a problem?

   1. AIt isn't
   2. BEvery shard costs heap, file handles and cluster-state overhead; many small shards slow the cluster and master nodes
   3. CShards can't be small
   4. DIt makes disks faster
   Show answer

   B. Aim for fewer, larger shards (tens of GB each) and control shard count with rollover and templates.

   From lesson 02 · Elasticsearch fundamentals

7. Q7. What does the ECK operator do when you change `spec.version` of an Elasticsearch resource?

   1. ADeletes the cluster
   2. BPerforms a rolling upgrade: restarts nodes one at a time in a safe order, respecting shard availability
   3. CNothing until you restart pods by hand
   4. DCreates a second cluster
   Show answer

   B. Operators encode the upgrade runbook. You still read the release notes and check the supported upgrade path.

   From lesson 03 · ECK operator on Kubernetes

8. Q8. Why must vm.max_map_count be raised (or mmap disabled) for Elasticsearch?

   1. AFor networking
   2. BElasticsearch memory-maps index files and needs more memory map areas than the default kernel limit allows
   3. CFor TLS
   4. DFor Kibana
   Show answer

   B. Set vm.max_map_count=262144 on nodes (DaemonSet/init container/node config), or use node.store.allow_mmap: false for small test clusters.

   From lesson 03 · ECK operator on Kubernetes

9. Q9. How do applications authenticate to an ECK-managed Elasticsearch by default?

   1. ANo authentication
   2. BSecurity is on by default: HTTPS with an operator-generated CA and users/roles (the elastic superuser secret for admin only; dedicated users or API keys for apps)
   3. COnly via kubectl
   4. DThrough Kibana
   Show answer

   B. Create least-privilege users or API keys for Fluent Bit and apps; don't hand out the elastic superuser.

   From lesson 03 · ECK operator on Kubernetes

10. Q10. Why is Fluent Bit usually preferred over Fluentd or Logstash as the per-node collector?

    1. AIt has more plugins
    2. BIt's written in C with a small memory/CPU footprint, which matters when one copy runs on every node
    3. CIt's the only one that supports Elasticsearch
    4. DIt stores logs itself
    Show answer

    B. Fluentd (Ruby) and Logstash (JVM) are heavier but have richer processing; they're often used as central aggregators if needed.

    From lesson 04 · Log collection: Fluent Bit vs Fluentd

11. Q11. Elasticsearch is down for 10 minutes. With default output settings, what may happen to logs?

    1. ANothing, they're always kept
    2. BWith the default retry_limit of 1, chunks that fail twice are dropped; memory limits can pause inputs; logs can be lost without obvious errors to users
    3. CFluent Bit crashes
    4. DKubernetes stores them
    Show answer

    B. Set retries (no_limits or a high number), filesystem buffering with a size cap, and monitor dropped/retried records.

    From lesson 04 · Log collection: Fluent Bit vs Fluentd

12. Q12. What does `mem_buf_limit` on the tail input do when it's reached?

    1. ADeletes old logs
    2. BPauses that input until buffered data is flushed; if files rotate away meanwhile, lines can be missed
    3. CIncreases memory
    4. DSends logs to stdout
    Show answer

    B. It protects the node's memory but creates back-pressure. Filesystem storage lets Fluent Bit buffer more safely.

    From lesson 04 · Log collection: Fluent Bit vs Fluentd

13. Q13. Why do Java stack traces show up as dozens of separate log entries?

    1. AElasticsearch splits them
    2. BEach line of the trace is written as its own line; without a multiline parser, the collector treats each line as a separate record
    3. CKibana displays them wrong
    4. DThe JVM sends them to stderr
    Show answer

    B. Multiline parsers recognise the start of a new entry and append continuation lines, so one exception = one document.

    From lesson 05 · Parsing & routing

14. Q14. What's the most reliable way to get searchable fields from application logs?

    1. AComplex regex for every app
    2. BHave applications log structured JSON with consistent field names, and let Fluent Bit merge it
    3. COnly full-text search
    4. DLog less
    Show answer

    B. Regex parsing is fragile and slow; JSON logs are parsed trivially and survive message format changes.

    From lesson 05 · Parsing & routing

15. Q15. Payments team logs must go to a separate data stream with longer retention. How in Fluent Bit?

    1. ASeparate cluster only
    2. BRe-tag or match their records (e.g. rewrite_tag on namespace) and send them with a second es output to a different index/data stream
    3. CKibana filters
    4. DIt's not possible
    Show answer

    B. Tags and match patterns route records to different outputs; the data stream's template/ILM policy sets retention.

    From lesson 05 · Parsing & routing

16. Q16. Which KQL finds errors in namespace shop, excluding the sidecar?

    1. Ashop AND error
    2. Bkubernetes.namespace_name : "shop" and log.level : "error" and not kubernetes.container_name : "istio-proxy"
    3. Cnamespace=shop level=error
    4. DSELECT * FROM shop
    Show answer

    B. KQL uses field : value, and/or/not, and parentheses. Field-scoped queries are faster and more precise than free text.

    From lesson 06 · Kibana & KQL

17. Q17. What is a data view in Kibana?

    1. AA dashboard
    2. BA definition of which indices or data streams to query (e.g. logs-*) and which field is the timestamp
    3. CA user role
    4. DA saved query
    Show answer

    B. Discover, visualisations and rules all query through data views (formerly called index patterns).

    From lesson 06 · Kibana & KQL

18. Q18. Free-text search of a single word across everything is slow and noisy. What's better?

    1. ASearch more words
    2. BNarrow the time range and filter on keyword fields (namespace, service, level) first, then search the message
    3. CUse a bigger cluster
    4. DExport to CSV
    Show answer

    B. Filters on keyword fields and short time ranges let Elasticsearch skip most data.

    From lesson 06 · Kibana & KQL

19. Q19. Which panel best reveals that log collection itself has broken for a namespace?

    1. AA pie chart of log levels
    2. BLog volume per namespace over time: a sudden drop to zero while the app runs points at the pipeline
    3. CA map
    4. DTotal document count
    Show answer

    B. Absence of logs is a signal. Watch volume per source, and alert when an important source goes silent.

    From lesson 07 · Kibana on-call dashboard

20. Q20. What makes a log alert actionable?

    1. AIt fires often
    2. BIt targets a specific, meaningful condition (e.g. payment errors > threshold for 5 minutes), links to a saved search or runbook, and someone knows what to do
    3. CIt includes all fields
    4. DIt goes to everyone
    Show answer

    B. Alerts without a clear owner and action get ignored, and then the important one gets missed too.

    From lesson 07 · Kibana on-call dashboard

21. Q21. Your Elastic deployment runs on the free Basic license. Slack connectors aren't available. Options?

    1. AGive up alerting
    2. BUse the Index/Server log connectors with something that forwards, alert from another tool (e.g. Grafana with an Elasticsearch data source, or ElastAlert 2), or upgrade the subscription
    3. CEdit Kibana's source
    4. DUse KQL only
    Show answer

    B. Check Elastic's subscription matrix for your version; many teams alert from Grafana or ElastAlert 2 on self-managed clusters.

    From lesson 07 · Kibana on-call dashboard

22. Q22. A data node hits 95% disk. What does Elasticsearch do?

    1. ADeletes old indices
    2. BApplies the flood-stage watermark: indices with shards on that node get a read-only (allow delete) block, so writes fail until space is freed
    3. CNothing
    4. DShuts down
    Show answer

    B. At 85% (low) no new shards are allocated there, at 90% (high) shards move away, at 95% writes are blocked. The block is released automatically once usage falls below the high watermark.

    From lesson 08 · Lifecycle & backup

23. Q23. What does rollover do for a data stream?

    1. ADeletes it
    2. BCreates a new backing index when the current one reaches a size/age/doc limit, so indices stay a manageable size and old ones can age through phases and be deleted whole
    3. CMoves data to Kibana
    4. DRe-indexes everything
    Show answer

    B. Deleting whole old indices is cheap; deleting documents from a huge index is not.

    From lesson 08 · Lifecycle & backup

24. Q24. Why run restore drills?

    1. ASnapshots are always fine
    2. BA backup you haven't restored is a hope, not a backup: drills prove the repository, credentials, permissions, timings and runbook work
    3. CTo test Kibana
    4. DLicensing requires it
    Show answer

    B. Drills also tell you how long a restore takes, which is your real recovery time.

    From lesson 08 · Lifecycle & backup