Now, we will dive deep into the components of the ELK Stack, and we will start with the most important component: Elasticsearch.
Elasticsearch is based on an Apache project named Lucene. Its role is to index data and store it for later retrieval. Elasticsearch receives data from different sources and stores it in a centralized location, or multiple nodes if they are set up as a cluster. For this setup, we'll be using Logstash as a data source; however, Elasticsearch can receive data directly from Beats, which we will discuss later on. At its core, Elasticsearch is an analytics and search engine capable of retrieving data very quickly; since data is indexed once it is stored, Elasticsearch stores the data as a JSON document.
A couple of things that define Elasticsearch are as follows:
- Fast
- Scalable
- Highly available
