|
Answer» The "ELK" acronym refers to three open-source products i.e., Elasticsearch, Logstash, and Kibana, which are all produced, managed, and maintained by ELASTIC company. With the introduction of Beats, this stack became a four-legged project called BELK or Elastic Stack. - ElasticSearch: Elasticsearch is an open-source, modern, full-text search engine BASED or built on Apache Lucene. ElasticSearch enables you to store, search, and analyze vast or huge amounts of data in near real-time, providing results in milliseconds.
- Logstash: Logstash is a data processing pipeline tool, which COLLECTS data from different sources, performs several transformations and enhancements, and then sends the data to stash or wherever you want it to go.
- Kibana: Kibana is a visualization tool built on top of Elasticsearch, enabling users to analyze and view data. The Kibana dashboard lets you visualize complex queries through interactive diagrams, geospatial data, and graphs.
- Beats: Beats are lightweight data shipping agents (data shippers) that collect different types of data and forward it to Logstash or ElasticSearch. There are different types of Beats, each focused on a specific type of data, such as metrics, log files, network packets, audit data, Windows events, uptime monitoring data, and cloud data.
These components are typically used in conjunction to monitor, troubleshoot, and SECURE IT environments. The Beats and Logstash tools handle the collection and processing of data, while Elasticsearch stores and indexes the data, and Kibana provides a graphical UI (user interface) for querying and visualizing the data.
|