## 3 Materials
### ELK Implementation Requirements  
This section covers the requirements for using ELK. The requirements are intended to ensure that, after implementation, it can be evaluated whether the ELK is a suitable method for analyzing and visualizing data. Two different types of requirements can be placed on an experimental setup. The functional requirements deal with what functionalities a system should have. The non-functional requirements define the required quality properties for the overall system. These include, for example, performance, scalability, or reliability.  
1. Functional requirements (FR) 1. FR 1: The retrieved data should be filtered and structured if necessary. 2. FR 2: Any missing information should be added. 3. FR 3: The data should be assigned to an index that contains, for example, the time of indexing. 4. FR 4: The data should be forwarded to an Elasticsearch system. 5. FR 5: Elasticsearch shall store the data received from Logstash. 6. FR 6: Elasticsearch should recognize and delete duplicates. 7. FR 7: Search or aggregation requests made by Kibana should be processed by Elasticsearch.  
Figure 5: Overview of the structure of Kibana.  
* FR 8: Indexes stored in Elasticsearch should be searchable and retrievable in Kibana.
* FR 9: Visualization and statistical values should be able to be created from these indices.
* FR 10: Visualizations and statistical values should be accessible in an individually adaptable dashboard.
* FR 11: The dashboard should be able to be updated automatically if data have been changed or added.
* FR 12: It should be possible to organize and display data by time in order to analyze changes in the data over time.
* Non-functional requirements (NFR)
* NFR 1: ELK should be able to scale vertically and horizontally.
* NFR 2: It should be possible to compensate for the failure of one or more computers in the system.
* NFR 3: Actions such as searches or aggregations should deliver their results after a maximum of 2 s.
* NFR 4: The dashboard should be accessible under the specific port.  
Based on the requirements and the applications to be used, the experimental setup can be outlined as follows. The experimental setup should consist of three components, namely Logstash, Elasticsearch, and Kibana. Users then access Kibana, where the dashboard can be viewed with metrics and graphs, but also the data can be browsed and additional graphs can be added to the dashboard. Logstash works with configuration files, which consist of 3 components, namely input, filter, and output. Input is responsible for fetching data from various sources. These data can then be filtered and structured in the filter section to then be routed to their destination--in this case, Elasticsearch--in the output section. After the data have arrived in Elasticsearch, they are stored and indexed, and are now searchable or aggregable. Kibana uses these functions and provides users with the results in the form of datasets or graphics.  
When implementing the ELK, the following points must be observed and configured accordingly:  
* How can the desired data be retrieved and what intervals make sense for this?
* What information do the retrieved data contain?
* What is the structure of the data?
* Which index should the data be assigned to?  
* How many computers are available?
* How many primary and replica shards per index make sense?  
* How can the data be visualized well?
* How can conclusions be drawn from the data? How can the dashboard be designed clearly?  
In summary, functional and non-functional requirements continue to require the use of specific software from ELK. If ELK does not meet these requirements 100%, there are various tools that can be used as an alternative to ELK (such as Algolia, Splunk Enterprise, etc.).