Book Image

Learning Elastic Stack 7.0 - Second Edition

By : Pranav Shukla, Sharath Kumar M N
Book Image

Learning Elastic Stack 7.0 - Second Edition

By: Pranav Shukla, Sharath Kumar M N

Overview of this book

The Elastic Stack is a powerful combination of tools that help in performing distributed search, analytics, logging, and visualization of data. Elastic Stack 7.0 encompasses new features and capabilities that will enable you to find unique insights into analytics using these techniques. This book will give you a fundamental understanding of what the stack is all about, and guide you in using it efficiently to build powerful real-time data processing applications. The first few sections of the book will help you understand how to set up the stack by installing tools and exploring their basic configurations. You’ll then get up to speed with using Elasticsearch for distributed search and analytics, Logstash for logging, and Kibana for data visualization. As you work through the book, you will discover the technique of creating custom plugins using Kibana and Beats. This is followed by coverage of the Elastic X-Pack, a useful extension for effective security and monitoring. You’ll also find helpful tips on how to use Elastic Cloud and deploy Elastic Stack in production environments. By the end of this book, you’ll be well-versed with fundamental Elastic Stack functionalities and the role of each component in the stack to solve different data processing problems.
Table of Contents (17 chapters)
Free Chapter
Section 1: Introduction to Elastic Stack and Elasticsearch
Section 2: Analytics and Visualizing Data
Section 3: Elastic Stack Extensions
Section 4: Production and Server Infrastructure

The Logstash architecture

The Logstash event processing pipeline has three stages, that is, Inputs, Filters, and Outputs. A Logstash pipeline has two required elements, that is, input and output, and one option element known as filters:

Inputs create events, Filters modify the input events, and Outputs ship them to the destination. Inputs and outputs support codecs, which allow you to encode or decode the data as and when it enters or exits the pipeline, without having to use a separate filter.

Logstash uses in-memory bounded queues between pipeline stages by default (Input to Filter and Filter to Output) to buffer events. If Logstash terminates unsafely, any events that are stored in memory will be lost. To prevent data loss, you can enable Logstash to persist in-flight events to the disk by making use of persistent queues.

Persistent queues can be enabled by setting the queue...