ELK stack

As explained in Elasticsearch in Action, Second Edition

The Elastic Stack is a collection of data collection, processing, search, analytics, and visualization products that includes Beats, Logstash, Elasticsearch, and Kibana.

The ELK Stack, now called the Elastic Stack, combines Beats, Logstash, Elasticsearch, and Kibana to collect, process, store, search, analyze, and visualize data. Elasticsearch is the core; the surrounding products move data into it or provide ways to work with it. section 1.4.2 section 1.7

The components divide responsibilities across the data workflow:

• Beats ship data from external systems. Filebeat handles file-based sources, while Metricbeat collects machine and operating-system metrics. section 1.4.2
• Logstash extracts data from multiple sources, transforms and enriches it through configured pipelines, and sends it to target destinations. section 1.4.2
• Elasticsearch stores and indexes incoming data for near-real-time search and analytics. section 1.0 section 3.1.1
• Kibana provides the web console for queries, dashboards, graphs, charts, and other visual work on Elasticsearch data. section 1.4.2

Application-log pipeline

An organization can use Filebeat to collect application logs, send them directly to Elasticsearch or through Logstash for parsing and enrichment, then use Elasticsearch for search and analysis and Kibana for dashboards. The resulting data supports debugging, monitoring, and operational investigation. section 3.1.1 section 1.4.2

Figure 1.3 The Elastic Stack: Beats, Logstash, Elasticsearch, and Kibana

Use the architecture figure to trace how Beats and Logstash bring data into Elasticsearch and how Kibana works with the stored data. section 1.4.2

How Elasticsearch in Action, Second Edition covers it

How deep it goes

Defines each component and its pipeline role, but stops short of detailed product implementation.

Examples

Uses application logs, machine metrics, real-time events, debugging, dashboards, and large-scale organizational deployments.

What you can do after

Operate a data pipeline that feeds Elasticsearch for searchable analysis and Kibana-based visualization.

How it connects

Connects Beats, Logstash, Elasticsearch, Kibana, ETL, search, analytics, observability, and security.

liveBookmanning.com

Read Elasticsearch in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Data-Driven CybersecurityThe ELK stack is a collection of Elasticsearch, Logstash, and Kibana components for collecting, searching, analyzing, and visualizing data.

Compare how 2 books explain ELK stack →

Related concepts

• Elasticsearchhas part · Elasticsearch is a distributed search and analytics engine that indexes data for searching, retrieval, and analysis.
• Logstashhas part · Logstash is an open-source server-side data-processing pipeline that collects, transforms, enriches, and routes event data.
• Kibanahas part · Kibana is an open-source web interface for searching, analyzing, visualizing, monitoring, and dashboarding data stored in Elasticsearch.
• Wazuhused by · Wazuh is an open-source security platform for threat detection, file-integrity monitoring, vulnerability detection, and compliance analysis.
• machine learninguses · Machine learning is a field of computational methods in which systems learn patterns or relationships from data to make predictions, decisions, or other outputs.

This explainer was generated by Manning's knowledge graph from the text of Elasticsearch in Action, Second Edition. The section links point to the parts of the book it draws on.