The ELK Stack and What Elasticsearch Is Used For
The bookshop's web servers write thousands of log lines an hour. When checkout breaks at 2 a.m., nobody wants to SSH into five machines and scroll text files. The ELK stack exists to gather those lines in one place, make them searchable, and draw them as charts.
The rule
Collect, store, show: Beats and Logstash collect, Elasticsearch stores, Kibana shows.
ELK is named after three tools from the company Elastic:
- Elasticsearch — the engine that stores the data and answers searches and aggregations.
- Logstash — a processing pipeline. It receives events, reshapes them (parse a raw log line into fields, drop noise, add a location from an IP address) and sends them on.
- Kibana — the web interface. Dashboards, charts, a place to explore data, and the Dev Tools console for sending requests.
A fourth family, Beats (small shippers such as Filebeat for log files and Metricbeat for system metrics), was added later, so you will also hear "the Elastic Stack". Today, Elastic Agent can replace several separate Beats with one managed agent.
A typical flow for the bookshop's logs:
web servers → Filebeat → Logstash (parse, enrich) → Elasticsearch → Kibana dashboardLogs are only one use case. Elasticsearch is hired for:
- Site and app search — the bookshop's search box, with typo tolerance and ranking.
- Logging and observability — logs, metrics and traces from many machines.
- Security analytics — searching events for signs of an attack.
- Analytics on large data — counts, averages and histograms over millions of documents.
- Vector and semantic search — finding items by meaning rather than by exact words.
The shortcut
For any pipeline, place each tool by asking "does it move data, keep data, or show data?" Moving is Beats or Logstash; keeping is Elasticsearch; showing is Kibana.
Move
Filebeat notices a new line in
access.logand ships it off the server.
A common mix-up is thinking Kibana stores the data. It does not — it only asks Elasticsearch and draws the answer.
Drills
Answer fast — trust the rule.
Which ELK component draws dashboards?
A raw log line must be split into fields and enriched with a country before storage. Which tool does that?
Where does the data actually live in the stack?
Which of these is NOT a typical Elasticsearch use case?
Remember
- Collect, store, show: Beats and Logstash collect, Elasticsearch stores, Kibana shows.
- Place any tool by asking: does it move, keep, or show data?
- Kibana stores nothing; Elasticsearch is where the data lives.