Elk Stack Architecture

ELK Stack Tutorial: What is Kibana, Logstash & Elasticsearch?

The Elasticsearch, Logstash, and Kibana (ELK) stack is a collection of three open-source products that work together to analyze data. The ELK stack is a centralized logging system that helps to identify problems with servers or software applications. It enables you to search through all of your logs from a single location. It also aids in the discovery of issues across multiple servers by connecting logs from different servers during a specific period.

ElasticSearch is represented by the letter E, and it is used to store logs.

LogStash is an abbreviation for LogStash, which is used for both shipping and processing, and storing logs.

K is an abbreviation for Kibana, which is a visualization tool (a web interface) that is hosted by Nginx or Apache web servers.

ElasticSearch, LogStash, and Kibana are all open-source search engines developed, managed, and maintained by the Elastic Corporation.

Data from any source, in any format, can be imported into the ELK Stack, which then allows users to search for, analyze, and visualize that data in real-time.

You will learn how to use the ELK stack in this tutorial.

ELK Stack Architecture

Now, in this ELK stack tutorial, we will learn about the ELK architecture, which includes the following components:

The following diagram depicts the basic architecture of the ELK stack.

Logs: Server logs that need to be analyzed are identified and gathered together.

Logstash is a tool for collecting logs and events data. It even performs data parsing and transformation.

ElasticSearch: The transformed data from Logstash is stored, searched for, and indexed using ElasticSearch technology.

Kibana: Kibana is a search engine that uses Elasticsearch to explore, visualize, and share data.

Beats is a data collection component that is required, but it is not yet available. As a result, Elastic decided to rename ELK to the Elastic Stack.

The architecture of the ELK Stack with Beats

When dealing with extremely large amounts of data, you may find yourself in need of Kafka or RabbitMQ for buffering and resilience, respectively. Nginx can be used to increase security.

Comparing the ELK Stack to other platforms

Now, let’s take a closer look at each of these open source products in this Elastic Stack tutorial:

What is Elasticsearch?

Elasticsearch is a NoSQL database, which means it does not require a relational database. RESTful APIs are used in the development of this application, which is based on the Lucene search engine. It has a straightforward deployment process, high reliability, and is simple to manage. It also provides advanced queries for performing detailed analysis, as well as centralized storage for all of the data. To conduct a quick search of the documents, is beneficial.

Elasticsearch also has the capability of storing, searching, and analyzing large amounts of data. It is primarily employed as the underlying engine for applications that fulfill search-related requirements. It has been implemented in search engine platforms for web and mobile applications that are currently in use. Aside from providing a quick search, the tool also provides complex analytics as well as numerous advanced features.

Features of Elastic search:

Java is used in the development of the open-source search server.

Any type of heterogeneous data can be indexed using this technique.

Has a web-based REST API interface with JSON output.

Full-Text Search is available.

In Near Real-Time (NRT), the search is performed in real-time.

JSON document store that is sharded, replicated, and searchable

Distributed document store that is schema-free, RESTful, and JSON-based

Support for multiple languages and geolocation

Advantages of Elasticsearch

It allows you to store data that does not have a schema while also creating a schema for your data.

Multi-document APIs allow you to manipulate your data record by record, which is particularly useful.

Filtering and querying your data can help you uncover new insights.

This search engine is built on Apache Lucene and provides a RESTful API.

Real-time indexing for faster search results is made possible by horizontal scalability, reliability, and multitenant capability provided by this product.

It makes it easier to scale both vertically and horizontally.

Elastic Search is comprised of several key terms.

Let’s take a look at some of the terms that are commonly used in ElasticSearch in this ELK tutorial:

Important Terms used in Elastic Search

Now in this ELK tutorial, let’s learn about key terms used in ElasticSearch:

Term Usage
Cluster A cluster is a collection of nodes that together holds data and provides joined indexing and search capabilities.
Node A node is an elastic search Instance. It is created when an elasticsearch instance begins.
Index An index is a collection of documents which has similar characteristics. e.g., customer data, product catalog. It is very useful while performing indexing, search, update, and delete operations. It allows you to define as many indexes in one single cluster.
Document It is the basic unit of information that can be indexed. It is expressed in JSON (key: value) pair. ‘{“user”: “null”}’. Every single Document is associated with a type and a unique id.
Shard Every index can be split into several shards to be able to distribute data. The shard is the atomic part of an index, which can be distributed over the cluster if you want to add more nodes.

What is Logstash?

Kibana is a data visualization tool that is part of the ELK stack and completes. This tool is used for visualizing Elasticsearch documents, which allows developers to gain a better understanding of the data quickly. Kibana dashboard provides a variety of interactive diagrams, geospatial data, and graphs to help you visualize complex questions more effectively.

Data stored in Elasticsearch directories can be searched for, viewed, and interacted with using this tool. In addition to performing advanced data analysis, Kibana allows you to visualize your data in a variety of formats including tables, charts, and maps.

For conducting searches on your data in Kibana, you can choose from a variety of options.

The following are the most frequently encountered search types:

Application of the Search Type

Free text searches are available.

It is employed to search for a specific string.

Field-level searches are available.

A string search within a specific field is accomplished using this method.

Statements that make sense

A logical statement is created by combining multiple searches into a logical statement.

Searches based on proximity

It is used to search for terms that are close in character proximity to a given character.

Now, let’s take a look at some of the most important features of Kibana in this tutorial:

What is Kibana?

The dashboard is a powerful front-end application that is capable of visualizing indexed information from the elastic cluster

Real-time search of indexed information is made possible.

Elasticsearch allows you to search for, view, and interact with data that has been stored.

Transform data into charts, tables, and maps by running queries on it and visualizing the results

The dashboard can be configured to slice and dice the logstash logs stored in elasticsearch.

Capable of displaying historical data in the form of graphs, charts, and other visual representations.

Dashboards that are updated in real-time and are easily customizable

A real-time search of indexed information is made possible by Kibana ElasticSearch.

Advantages and Disadvantages of Kinbana

Visualization is simple.

Elasticsearch is fully integrated into the system.

Tool for visualizing data

The software provides real-time analysis and charting, as well as summarization and debugging capabilities.

A user-friendly interface that is intuitive to use

Allows for the sharing of snapshots of the logs that have been searched.

Allows for the saving of a dashboard and the management of multiple dashboards.

Why Log Analysis?

Performance and isolation are critical in cloud-based infrastructures because they allow for more efficient use of resources. The performance of virtual machines in the cloud may vary depending on the specific loads, environments, and the number of active users in the system, among other considerations. As a result, reliability and node failure may become a significant concern. In addition to monitoring the issues listed above, log management platforms can process operating system logs, NGINX logs for web traffic analysis, IIS logs for web traffic analysis, application logs, and logs on AWS (Amazon web services).

Log management assists DevOps engineers and system administrators in making more informed business decisions. Because of this, log analysis using Elastic Stack or similar tools is essential.


ELK vs. Splunk

Elk Splunk
Elk is an open-source tool Splunk is a commercial tool.
Elk stack does not offer Solaris Portability because of Kibana. Splunk offers Solaris Portability.
Processing speed is strictly limited. Offers accurate and speedy processes.
ELK is a technology stack created with the combination Elastic Search-Logstash-Kibana. Splunk is a proprietary tool. It provides both on-premise and cloud solutions.
In ELK Searching, Analysis & Visualization will be only possible after the ELK stack is setup. Splunk is a complete data management package at your disposal.
ELK tool does not support integration with other tools. Splunk is a useful tool for setting up integrations with other tools.


Netflix makes extensive use of the ELK stack. The company is utilizing the ELK stack to monitor and analyze the security logs generated by customer service operations. Using it, they will be able to index, store, and search documents from more than fifteen clusters, each of which contains approximately 800 nodes.


The ELK stack is used by the well-known social media marketing website LinkedIn to monitor performance and security. When the IT team wanted to support their load in real-time, they integrated ELK with Kafka. A total of more than 100 clusters are spread across six different data centers in their ELK operation.


Tripwire is a Security Information and Event Management system that operates on a global scale. ELK is being used by the company to support information packet log analysis.


Medium is a well-known platform for blog publishing. They employ the ELK stack to troubleshoot production issues. In addition, ELK is used by the company to detect DynamoDB hotspots. More importantly, the company can support 25 million unique readers as well as thousands of new posts every week by utilizing this technology stack.

Advantages and Disadvantages of ELK stack


ELK performs best when logs from multiple enterprise applications are consolidated into a single ELK instance.

It provides incredible insights for this single instance and also eliminates the need to log into a hundred different log data sources, which would otherwise be necessary.

Installation on-premises in a short period

Scales that are simple to install both vertically and horizontally

Elastic provides a diverse set of language clients, among which is Ruby. Python. PHP, Perl,.NET, Java, JavaScript, and other programming languages are available.

Different programming and scripting languages have readily available libraries.


Components of varying types When you move on to a more complex setup, the stack can become difficult to manage and maintain.

There’s nothing quite like learning by doing. As a result, the more work you put in, the more you learn along the way.


When attempting to identify problems with servers or applications, centralized logging can be extremely beneficial.

To resolve issues related to a centralized logging system, the ELK server stack can be very useful.

The ELK stack is a collection of three open-source tools that work together. Elasticsearch, Logstash, and Kibana are three popular search engines.

Elasticsearch is a NoSQL (No Relational Database) database.

Logstash is a data collection pipeline tool that is used for data collection.

Kibana is a data visualization tool that is part of the ELK stack (Enterprise Learning and Knowledge).

Performance and isolation are extremely important in cloud-based computing environment infrastructures.

The processing speed of the ELK stack is strictly limited, whereas Splunk provides accurate and fast processes, whereas

Netflix, LinkedIn, Tripwire, and Medium are just a few of the companies that use the ELK stack for their operations.

Using ELK Syslog is most effective when logs from various applications throughout an enterprise are consolidated into a single ELK instance.

Components of varying types When you move on to a more complex setup, the stack can become difficult to manage and maintain.