Before jumping deeper into what makes the ELK Stack, let's explore the concept of centralized logs.
Imagine the following scenario; there seems to be a security breach in the environment, and some strange looking files have been spotted in some servers. Looking at the /var/log/secure file, you find root logins from several addresses, and you want to know which systems have been affected. There's just one problem—the environment has 5,000+ Linux servers, and you have to log into each of the systems and look at the logs. It might take about a minute to grep each host; that's 83+ hours straight looking at system logs.
This problem of having to go to each node can be solved by aggregating and having the logs in a centralized location. While the rest of the industry seems to be going the route of de-centralizing services, having all of the environment...
