What is ELKB?

ELKB is an acronym for four open source software: Elasticsearch, Logstash, Kibana, and Beats.

Elasticsearch is an open source distributed search engine that provides three functions: collecting, analyzing and storing data. Its features are: distributed, zero configuration, automatic discovery, automatic index slicing, index copy mechanism, restful style interface, multiple data sources, automatic search load and so on.

Logstash is mainly used for log collection, analysis, log filtering tools, supporting a large number of data acquisition methods. The general working mode is the Cramp architecture. The client is installed on the host that needs to collect logs, and the server is responsible for filtering and modifying the received logs of each node and sending them to elasticsearch.

Kibana is also an open source and free tool, and Kibana provides a friendly Web interface for log analysis for Logstash and ElasticSearch to help summarize, analyze, and search important data logs.

Beats is a new member of the ELK stack, a lightweight open source data collector architecture based on Logstash-Forwarder source code development, is an alternative to it. Beats can read the data and quickly send it to Logstash for parsing, or directly to Elasticsearch for centralized storage and analysis. Beats currently has many versions of data collectors developed:

Packetbeat (for monitoring network traffic),

Filebeat (used to listen for log data, instead of logstash-input-file),

Topbeat (used to collect process information, load, memory, disk, etc.),

Winlogbeat (used to collect windows event logs)

Neusoft SaCa DataInsight has made some improvements based on ELKB, which can be found on their official website.