Book Image

Elasticsearch 8.x Cookbook - Fifth Edition

By : Alberto Paro
Book Image

Elasticsearch 8.x Cookbook - Fifth Edition

By: Alberto Paro

Overview of this book

Elasticsearch is a Lucene-based distributed search engine at the heart of the Elastic Stack that allows you to index and search unstructured content with petabytes of data. With this updated fifth edition, you'll cover comprehensive recipes relating to what's new in Elasticsearch 8.x and see how to create and run complex queries and analytics. The recipes will guide you through performing index mapping, aggregation, working with queries, and scripting using Elasticsearch. You'll focus on numerous solutions and quick techniques for performing both common and uncommon tasks such as deploying Elasticsearch nodes, using the ingest module, working with X-Pack, and creating different visualizations. As you advance, you'll learn how to manage various clusters, restore data, and install Kibana to monitor a cluster and extend it using a variety of plugins. Furthermore, you'll understand how to integrate your Java, Scala, Python, and big data applications such as Apache Spark and Pig with Elasticsearch and create efficient data applications powered by enhanced functionalities and custom plugins. By the end of this Elasticsearch cookbook, you'll have gained in-depth knowledge of implementing the Elasticsearch architecture and be able to manage, search, and store data efficiently and effectively using Elasticsearch.
Table of Contents (20 chapters)

Using alerting to monitor data events

Alerting is one of the most used X-Pack components because it allows us to fire alert events on data that is processed in the cluster.

The main concepts behind Elasticsearch alerting are as follows:

  • Conditions: These define what needs to be detected.
  • Schedule: These define the frequency of how the checks run.
  • Actions: These define how to respond to an alert.

Elasticsearch is able to cover the following:

  • Infrastructural alerting such as issues about load on the server, disk space, and node being down
  • ETL flow alerting such as the reduction of ingested records in some indices
  • Business alerting with rules defined by a business user on data quality or features on their data
  • Predictive alerting using the Machine Learning (ML) X-Pack component, which is able to detect an anomaly in ingested data

Getting ready

Alerting only works on a full setup environment with security enabled; we will use the...