Elastic Stack

Kibana with Elastic Stack can be used to fetch data from different sources and filter, process, and analyze it to create meaningful dashboards. Elastic Stack has the following components:

• Elasticsearch: We can store data in Elasticsearch.
• Logstash: A data pipeline that we can use to read data from various sources, and can write it to various sources. It also provides a feature to filter the input data before sending it to output.
• Kibana: A graphical user interface that we can use to do a lot of things, which I will cover in this chapter.
• Beats: Lightweight data shippers that sit on different servers and send data to Elasticsearch directly or via Logstash:
  • Filebeat
  • Metricbeat
  • Packetbeat
  • Auditbeat
  • Winlogbeat
  • Heartbeat

The following diagram shows how Elastic Stack works:

In the preceding diagram, we have three different servers on which we have installed and configured Beats. These Beats are shipping data to Elasticsearch directly or via Logstash. Once this data is pushed into Elasticsearch, we can analyze, visualize, and monitor the data in Kibana. Let's discuss these components in detail; we're going to start with Elasticsearch.