If you use Logstash to centrally receive the log input from Filebeat, it easily creates a single point of bottleneck; if you use Kafka to receive the log input from Filebeat, the timeliness of the logs is not guaranteed. Here we output the logs collected by Filebeat directly to Elasticsearch.

1. How Logstash Works Logstash is a component for data transport and processing. Through combinations of plugins, Logstash can handle a wide variety of log collection scenarios: logstash->elasticsearch filebeat->logstash->elasticsearch filebeat->kafka->logstash->elasticsearch filebeat->redis->logstash->elasticsearch 2. Basic Logstash Configuration Here is the format of a Logstash configuration: 1 2 3 4 5 6 7

This article gives a brief introduction to the ELK stack and provides a Docker compose orchestration configuration. After reading it, you can get ELK running locally with Docker. A later article will cover deploying ELK on servers and adding the related configuration. 1. Introduction to the ELK Stack ELK is not actually a single piece of software but a whole solution — an acronym formed from the initials of three software products: Elasticsearch, Logstash, and Kibana.