FresherTechnicalElasticsearch
What is the Elastic Stack and where does Elasticsearch fit in it?
Try answering first
Model answer
The Elastic Stack (often called ELK) is a set of products around Elasticsearch for collecting, storing and exploring data.
- Elasticsearch: stores and searches the data.
- Kibana: the UI for dashboards, Discover (search), Dev Tools, alerts and cluster management.
- Logstash: a server-side pipeline that ingests, parses, enriches and forwards data through inputs, filters and outputs.
- Beats (such as Filebeat and Metricbeat) and the unified Elastic Agent: lightweight shippers that collect logs and metrics from hosts and send them to Logstash or straight to Elasticsearch. Elastic Agent is managed centrally with Fleet.
A typical log pipeline:
app logs -> Elastic Agent -> (Logstash) -> Elasticsearch -> Kibana
The application writes logs, the agent collects them, an ingest pipeline or Logstash parses them (grok, JSON, geoip), Elasticsearch stores them in a data stream, and Kibana shows dashboards.
The stack also covers application search, metrics, APM traces and security analytics (SIEM). OpenSearch, a fork of Elasticsearch 7.10, has a similar stack with OpenSearch Dashboards.
Elasticsearch is the storage and search core, and the rest of the stack feeds it and presents the data.
Key points
- Elasticsearch stores and searches, Kibana visualises
- Beats and Elastic Agent collect, Logstash transforms
- Fleet manages agents centrally
- OpenSearch is a fork with its own dashboards
Likely follow-ups
- When would you use Logstash instead of an ingest pipeline?
- What is a data stream?
Common mistakes
- Thinking Elasticsearch alone collects and parses logs
- Sending raw unparsed log lines and losing structure