Querying a centralized log

Once your containerized application logs have been collected and stored in the ELK Stack, you can query the centralized logs using Elasticsearch's Query Domain Specific Language (DSL) and visualize the results in Kibana.

Step 1 – accessing Kibana

Kibana provides a user-friendly interface for querying and visualizing Elasticsearch data. In the provided docker-compose.yml file, Kibana can be accessed on port 5601. Open your browser and navigate to http://localhost:5601.

Step 2 – setting up an index pattern

Before you can query the logs, you need to create an index pattern in Kibana to identify the Elasticsearch indices containing the log data. Follow these steps to create an index pattern:

1. The first time you access Kibana, you will be asked to add integrations. You can safely ignore this as we are using Filebeat to ship the logs.
2. Instead, locate the “hamburger menu” in the top left of the view and click...