Book Image

Monitoring Elasticsearch

By : Dan Noble, Pulkit Agrawal, Mahmoud Lababidi
Book Image

Monitoring Elasticsearch

By: Dan Noble, Pulkit Agrawal, Mahmoud Lababidi

Overview of this book

ElasticSearch is a distributed search server similar to Apache Solr with a focus on large datasets, a schema-less setup, and high availability. This schema-free architecture allows ElasticSearch to index and search unstructured content, making it perfectly suited for both small projects and large big data warehouses with petabytes of unstructured data. This book is your toolkit to teach you how to keep your cluster in good health, and show you how to diagnose and treat unexpected issues along the way. You will start by getting introduced to ElasticSearch, and look at some common performance issues that pop up when using the system. You will then see how to install and configure ElasticSearch and the ElasticSearch monitoring plugins. Then, you will proceed to install and use the Marvel dashboard to monitor ElasticSearch. You will find out how to troubleshoot some of the common performance and reliability issues that come up when using ElasticSearch. Finally, you will analyze your cluster’s historical performance, and get to know how to get to the bottom of and recover from system failures. This book will guide you through several monitoring tools, and utilizes real-world cases and dilemmas faced when using ElasticSearch, showing you how to solve them simply, quickly, and cleanly.
Table of Contents (15 chapters)
Monitoring Elasticsearch
About the Author
About the Reviewers

Working with Logstash and Kibana

Logstash is a utility for aggregating and normalizing log files from disparate sources and storing them in an Elasticsearch cluster. Once logs are stored in Elasticsearch, we will use Kibana, the same tool Marvel's user interface is built on, to view and explore our aggregated logs.


The Elasticsearch community refers to the Elasticsearch, Logstash, and Kibana tool combination as the ELK stack. This section shows how to load NGINX server logs into ELK, but there are many other potential use cases for these technologies.

ELK can help us explore NGINX server logs by:

  • Visualizing server traffic over time

  • Plotting server visits by location on a map

  • Searching logs by resource extension (HTML, JS, CSS, and so on), IP address, byte count, or user-agent strings

  • Discovering web requests that result in internal server errors

  • Finding attackers in a distributed denial of service attack

Other uses for ELK include:

  • Logging all Elasticsearch queries in a web application for future...