Introduction to ELK Stack
Tags: elasticsearch, logstash, kibana, beginners
Published: 2021-12-12 07:39:10

The systems have to be monitored to ensure that there are minimum possibilities for outages and downtimes. Indeed, many tools are out there for monitoring, but not every tool can provide centralized, comprehensive monitoring. This is where the _ELK Stack_ comes into play.

The ELK Stack is an open-source log management solution that is used for collecting, searching, analyzing, and visualizing large volumes of data generated by various sources. It mainly comprises of 3 products.
- Elasticsearch
- Logstash
- Kibana

###ELK Stack Architecture
![ELK Stack Architecture](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/buczthr1v4xqktmbizzw.jpg)

###How does ELK Stack work?
**Logstash** accepts logs in a variety of formats and through a variety of protocols, over the network, or wherever they originate on your network.
After that, these logs are sent to **Elasticsearch**. Here you can perform analysis and real-time search of data gathered.
**Kibana** allows you to visualize the data in Elasticsearch in a comprehensive manner by representing it in charts and graphs.

###More On Logstash
Logstash collects data inputs and feeds them into the Elasticsearch. It gathers different types of data to unify and normalize them for analytical and visualization purposes.
Basically, Logstash contains 3 components,
- **Input:** Transferring logs to be processed into a machine-readable format.
- **Filters:** It is a series of conditions that must be met to carry out a specific action or event.
- **Output:** Processed event or log decision maker.

####Advantages of Logstash
- Capable of analyzing a large variety of structured/unstructured data.
- Offers plugins to connect various types of input sources.
- Can be used for centralized data processing.

###More on Elasticsearch
Elasticsearch is a NoSQL database. It offers advanced queries  to perform detailed analysis and stores all the data centrally.
You can also use Elasticsearch to store, search, and analyze large amounts of data. It's primarily utilized as the backend engine for applications that fulfill search needs. In addition to a simple search, the tool includes comprehensive analytics and a number of advanced capabilities.

####Advantages of Elasticsearch
- Utilize data record by record with the help of multi-document APIs.
- Perform data filtering and querying.
- Helps to scale vertically and horizontally.
- Store schema-less data while creating a schema for the data.

###More on Kibana
Kibana is a data visualization tool. This tool is used to visualize Elasticsearch documents and provides developers with a quick overview. To visualize complex queries, the Kibana dashboard provides a variety of interactive diagrams, geospatial data, and graphs.
In Kibana there are different search types,
- **Free text searches:** Specific strings can be searched.
- **Field-level searches:** String within a specific field can be searched.
- **Logical statements:** Combine searches into a logical statement.
- **Proximity searches:** Search for terms with specific character proximity.

####Advantages of Kibana
- Visualization of data is easy.
- Real-time analysis, charting, summarization, and debugging are offered.
- User-friendly interface provided.
- Allows sharing of snapshots of the logs.
- Integrated with Elasticsearch.

Wanna know more?👇
###Useful Resources

* [ELK Docs](https://www.elastic.co/guide/index.html)

---
Thanks for reading.. 🙌