{"id":3626,"date":"2023-06-18T20:44:44","date_gmt":"2023-06-19T00:44:44","guid":{"rendered":"https:\/\/dft.wiki\/?p=3626"},"modified":"2026-06-08T16:46:05","modified_gmt":"2026-06-08T20:46:05","slug":"elastic-stack-aka-elk-elasticsearch-logstash-and-kibana","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=3626","title":{"rendered":"Elastic Stack, aka ELK (Elasticsearch, Logstash, and Kibana)"},"content":{"rendered":"<p>What is <strong>Elastic Stack<\/strong> or <strong>ELK<\/strong>?<\/p>\n<ul>\n<li><strong>Elasticsearch<\/strong>\n<ul>\n<li>A distributed search and analytics engine, essentially a big-data database. Elasticsearch is the central component of the Elastic Stack [<a href=\"https:\/\/github.com\/elastic\/elasticsearch\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><strong>Logstash<\/strong>\n<ul>\n<li>Not a mandatory component, but essential when data needs to be transformed during ingestion from multiple sources on the server side. Beats agents can also send data directly to Elasticsearch if no transformation is needed [<a href=\"https:\/\/github.com\/elastic\/logstash\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<li><strong>Kibana<\/strong>\n<ul>\n<li>The frontend (dashboard) used to search, index, and visualize data. It sits on top of the Elastic Stack [<a href=\"https:\/\/github.com\/elastic\/kibana\">Link<\/a>].<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>On the client side, an Elastic Agent collects data based on Policies (groups of Integrations) that can be managed from a single point: the ELK server.<\/p>\n<p><strong>Beats<\/strong> [<a href=\"https:\/\/github.com\/elastic\/beats\">Link<\/a>] are open source data shipper agents that send operational data to Elasticsearch. They can be manually installed or managed via the Elastic Agent.<\/p>\n<p>What is each <strong>Beat<\/strong> used for?<\/p>\n<ul>\n<li><strong>Auditbeat<\/strong>\n<ul>\n<li>Audits Linux data for file integrity.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Filebeat<\/strong>\n<ul>\n<li>Tails log files and journals.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Functionbeat<\/strong>\n<ul>\n<li>Cloud data shipper for serverless applications.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Heartbeat<\/strong>\n<ul>\n<li>Checks availability by pinging remote services.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Metricbeat<\/strong>\n<ul>\n<li>Scrapes metrics from systems and services.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Packetbeat<\/strong>\n<ul>\n<li>Sniffs network traffic to monitor applications.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Winlogbeat<\/strong>\n<ul>\n<li>Ships Windows event logs.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Osquerybeat<\/strong>\n<ul>\n<li>Runs Osquery, a SQL-powered framework for OS instrumentation, monitoring, and analytics.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>What are the requirements for an Elastic Stack server?<\/p>\n<ul>\n<li>16 GB of RAM<\/li>\n<li>4 vCPU<\/li>\n<li>20 GB for the system\n<ul>\n<li>After installation, about 10 GB will be used.<\/li>\n<\/ul>\n<\/li>\n<li>50 GB for data storage (ideally on a secondary volume)\n<ul>\n<li>This is a starting point; actual needs depend on data volume.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<hr \/>\n<p><strong>PRE-INSTALLATION<\/strong><\/p>\n<p><span style=\"color: #777777; font-size: 1rem;\">For Debian-based distributions, such as Ubuntu:<\/span><\/p>\n<pre>sudo apt update\r\nsudo apt upgrade -y\r\nsudo hostnamectl set-hostname elk\r\nsudo reboot<\/pre>\n<hr \/>\n<p><strong>INSTALLING ELASTICSEARCH<\/strong><\/p>\n<p>On the server:<\/p>\n<pre>wget -qO - https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | sudo apt-key add -\r\nsudo apt install apt-transport-https -y\r\necho \"deb https:\/\/artifacts.elastic.co\/packages\/8.x\/apt stable main\" | sudo tee -a \/etc\/apt\/sources.list.d\/elastic-8.x.list\r\nsudo apt update &amp;&amp; sudo apt install elasticsearch -y<\/pre>\n<p>Note the output at the end of the installation (see example below):<\/p>\n<pre>--------------------------- Security autoconfiguration information ------------------------------\r\n\r\nAuthentication and authorization are enabled.\r\nTLS for the transport and HTTP layers is enabled and configured.\r\n\r\nThe generated password for the elastic built-in <strong>superuser<\/strong> is : <strong>4T3lx5OhuhY1kUm4jUc+<\/strong>\r\n\r\nIf this node should join an existing cluster, you can reconfigure this with\r\n'\/usr\/share\/elasticsearch\/bin\/elasticsearch-reconfigure-node --enrollment-token'\r\nafter creating an enrollment token on your existing cluster.\r\n\r\nYou can complete the following actions at any time:\r\n\r\nReset the password of the elastic built-in superuser with \r\n'\/usr\/share\/elasticsearch\/bin\/elasticsearch-reset-password -u elastic'.\r\n\r\nGenerate an enrollment token for Kibana instances with \r\n'<strong>\/usr\/share\/elasticsearch\/bin\/elasticsearch-create-enrollment-token -s kibana<\/strong>'.\r\n\r\nGenerate an enrollment token for Elasticsearch nodes with \r\n'\/usr\/share\/elasticsearch\/bin\/elasticsearch-create-enrollment-token -s node'.\r\n\r\n-------------------------------------------------------------------------------------------------<\/pre>\n<p><strong>Note:<\/strong> the superuser account above has the username <code>elastic<\/code> and, in this example, the password is <code>4T3lx5OhuhY1kUm4jUc+<\/code>.<\/p>\n<pre>sudo nano \/etc\/elasticsearch\/elasticsearch.yml<\/pre>\n<p>Edit or add the following lines:<\/p>\n<pre>network.host: 0.0.0.0\r\ndiscovery.seed_hosts: [ ]<\/pre>\n<p>Start the service:<\/p>\n<pre>sudo systemctl enable elasticsearch\r\nsudo systemctl start elasticsearch\r\nsudo systemctl status elasticsearch<\/pre>\n<p>Navigate to <strong>https:\/\/200.200.200.200:9200<\/strong> (replace the IP with the correct one):<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3632\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-06-31.png\" alt=\"\" width=\"497\" height=\"314\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-06-31.png 497w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-06-31-300x190.png 300w\" sizes=\"auto, (max-width: 497px) 100vw, 497px\" \/><\/p>\n<p>Check the logs if needed:<\/p>\n<pre>sudo tail \/var\/log\/elasticsearch\/elasticsearch.log<\/pre>\n<hr \/>\n<p><strong>INSTALLING KIBANA<\/strong><\/p>\n<p>On the same server:<\/p>\n<pre>sudo apt install kibana -y<\/pre>\n<pre>sudo nano \/etc\/kibana\/kibana.yml<\/pre>\n<pre>server.host: \"0.0.0.0\"\r\nserver.name: \"ELK\"<\/pre>\n<pre>sudo systemctl enable kibana\r\nsudo systemctl start kibana\r\nsudo systemctl status kibana<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3635\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-17-05.png\" alt=\"\" width=\"1590\" height=\"397\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-17-05.png 1590w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-17-05-300x75.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-17-05-1024x256.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-17-05-768x192.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-17-05-1536x384.png 1536w\" sizes=\"auto, (max-width: 1590px) 100vw, 1590px\" \/><\/p>\n<pre>sudo \/usr\/share\/elasticsearch\/bin\/elasticsearch-create-enrollment-token -s kibana<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3638\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-20-39.png\" alt=\"\" width=\"1668\" height=\"57\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-20-39.png 1668w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-20-39-300x10.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-20-39-1024x35.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-20-39-768x26.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-20-39-1536x52.png 1536w\" sizes=\"auto, (max-width: 1668px) 100vw, 1668px\" \/><\/p>\n<p>Navigate to <strong>http:\/\/200.200.200.200:5601\/?code=081899<\/strong> (replace the IP with the correct one):<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3640\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-22-38.png\" alt=\"\" width=\"508\" height=\"537\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-22-38.png 508w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-14-22-38-284x300.png 284w\" sizes=\"auto, (max-width: 508px) 100vw, 508px\" \/><\/p>\n<p><strong>Note:<\/strong> this token is the one generated in the previous command. If prompted for a Verification Code (a 6-digit OTP), run:<\/p>\n<pre>\/usr\/share\/kibana\/bin\/kibana-verification-code<\/pre>\n<p>Check the logs if needed:<\/p>\n<pre>sudo tail \/var\/log\/kibana\/kibana.log<\/pre>\n<hr \/>\n<p><strong>INSTALLING LOGSTASH (OPTIONAL)<\/strong><\/p>\n<p>Logstash can modify data before ingestion (e.g. converting logs from a proprietary format to a generic one).<\/p>\n<pre>sudo apt install logstash -y\r\nsudo systemctl enable logstash\r\nsudo systemctl start logstash\r\nsudo systemctl status logstash<\/pre>\n<hr \/>\n<p><strong>ADDING A FLEET SERVER (OPTIONAL)<\/strong><\/p>\n<p>Fleet Server allows monitoring of system metrics from a fleet of servers (e.g. Windows or Linux servers).<\/p>\n<pre>curl -L -O https:\/\/artifacts.elastic.co\/downloads\/beats\/elastic-agent\/elastic-agent-8.8.1-amd64.deb\r\nsudo dpkg -i elastic-agent-8.8.1-amd64.deb\r\nsudo elastic-agent enroll <strong>--insecure<\/strong> --url=https:\/\/172.31.43.213:8220 --enrollment-token=V0czdno0Z0J0M2pkZHA3cGM1YVQ6Wk9aZE1fZEtUQm1PQW5MY2VkN2xOZw== \r\nsudo systemctl enable elastic-agent\r\nsudo systemctl start elastic-agent\r\nsudo systemctl status elastic-agent<\/pre>\n<p><strong>Note:<\/strong> the steps above were provided by Kibana when adding the Fleet Server. The <code>--insecure<\/code> argument was added because no <strong>CA<\/strong> (Certificate Authority) was set up in this lab.<\/p>\n<hr \/>\n<p><strong>POST-INSTALLATION<\/strong><\/p>\n<p>Set firewall rules accordingly. Basic example for a Debian-based distribution such as Ubuntu 22.04 LTS:<\/p>\n<pre>sudo ufw limit 22 comment \"SSH\"\r\nsudo ufw allow 9200 comment \"Elasticsearch\"\r\nsudo ufw allow 5601 comment \"Kibana\"\r\nsudo ufw allow 8220 comment \"Fleet Server\"\r\nsudo ufw allow 5044 comment \"Logstash\"\r\nsudo ufw enable\r\nsudo ufw status numbered<\/pre>\n<p><strong>Note:<\/strong> if this server has a public IP, these services will be exposed to the internet. It is recommended to keep the server accessible only on the local (internal) network. A reverse proxy is a good option for making it publicly available while also handling SSL\/TLS certificates.<\/p>\n<hr \/>\n<p><strong>INSTALLING FILEBEAT<\/strong><\/p>\n<p><strong>Filebeat<\/strong> [<a href=\"https:\/\/github.com\/elastic\/beats\/tree\/main\/filebeat\">Link<\/a>] is the most versatile of all Beats. It works like the <code>tail -f<\/code> command, watching log files for new entries and forwarding events to Elasticsearch.<\/p>\n<p>Create a Role to grant the Filebeat Agent the necessary privileges. Navigate to <strong>Management &gt; Stack Management &gt; Security &gt; Roles &gt; Create role<\/strong>:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3652\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-14-53.png\" alt=\"\" width=\"1675\" height=\"1224\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-14-53.png 1675w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-14-53-300x219.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-14-53-1024x748.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-14-53-768x561.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-14-53-1536x1122.png 1536w\" sizes=\"auto, (max-width: 1675px) 100vw, 1675px\" \/><\/p>\n<ul>\n<li>Role name: <strong>filebeat_publisher_role<\/strong><\/li>\n<li>Cluster privilege: <strong>manage<\/strong>, <strong>monitor<\/strong><\/li>\n<li>Indices: <strong>*<\/strong><\/li>\n<li>Privileges: <strong>create<\/strong>, <strong>monitor<\/strong>, <strong>manage<\/strong>, <strong>view_index_metadata<\/strong><\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3654\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-19-29.png\" alt=\"\" width=\"1675\" height=\"1277\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-19-29.png 1675w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-19-29-300x229.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-19-29-1024x781.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-19-29-768x586.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-19-29-1536x1171.png 1536w\" sizes=\"auto, (max-width: 1675px) 100vw, 1675px\" \/><\/p>\n<p>Then create a User for the Filebeat Agent. Navigate to <strong>Management &gt; Stack Management &gt; Security &gt; Users &gt; Create user<\/strong>:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3655\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-28-54.png\" alt=\"\" width=\"1671\" height=\"846\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-28-54.png 1671w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-28-54-300x152.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-28-54-1024x518.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-28-54-768x389.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-28-54-1536x778.png 1536w\" sizes=\"auto, (max-width: 1671px) 100vw, 1671px\" \/><\/p>\n<ul>\n<li>Username: <strong>filebeats_agent<\/strong><\/li>\n<li>Password: <strong>*************<\/strong><\/li>\n<li>Confirm password: <strong>*************<\/strong><\/li>\n<li>Roles: <strong>filebeats_publisher_role<\/strong>, <strong>kibana_admin<\/strong><\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3660\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-57-48.png\" alt=\"\" width=\"1146\" height=\"840\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-57-48.png 1146w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-57-48-300x220.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-57-48-1024x751.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-19-57-48-768x563.png 768w\" sizes=\"auto, (max-width: 1146px) 100vw, 1146px\" \/><\/p>\n<p>On a Debian-based client, such as Ubuntu 22.04 LTS:<\/p>\n<pre>wget -qO - https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | sudo apt-key add -\r\nsudo apt install apt-transport-https -y\r\necho \"deb https:\/\/artifacts.elastic.co\/packages\/8.x\/apt stable main\" | sudo tee -a \/etc\/apt\/sources.list.d\/elastic-8.x.list\r\nsudo apt update &amp;&amp; sudo apt install filebeat -y\r\nsudo nano \/etc\/filebeat\/filebeat.yml<\/pre>\n<p>Edit or add the following configuration:<\/p>\n<pre># ============================== Filebeat inputs ===============================\r\nfilebeat.inputs:\r\n  - type: <strong>filestream<\/strong>\r\n    id: <strong>application1<\/strong>\r\n    enabled: <strong>true<\/strong>\r\n    paths:\r\n      - \/var\/log\/<strong>application1\/*.log<\/strong>\r\n    fields:\r\n      level: debug\r\n      env: prod\r\n# =================================== Kibana ===================================\r\nsetup.kibana:\r\n  host: \"<strong>http:\/\/192.168.1.200<\/strong>:5601\"\r\n  username: \"<strong>filebeat_agent<\/strong>\"\r\n  password: \"<strong>8NGwMnM46YvbRbV<\/strong>\"\r\n# ================================== Outputs ===================================\r\noutput.elasticsearch:\r\n  hosts: [\"<strong>192.168.1.200<\/strong>:9200\"]\r\n  protocol: \"<strong>https<\/strong>\"\r\n  username: \"<strong>filebeat_agent<\/strong>\"\r\n  password: \"<strong>8NGwMnM46YvbRbV<\/strong>\"\r\n<strong>  ssl:\r\n    enabled: true\r\n    verification_mode: none<\/strong><\/pre>\n<p>Create the test log file:<\/p>\n<pre>sudo mkdir \/var\/log\/application1\r\nsudo chown ubuntu: \/var\/log\/application1\r\necho \"Current time \" `date` &gt;&gt; \/var\/log\/application1\/info.log\r\necho \"Current time \" `date` &gt;&gt; \/var\/log\/application1\/warning.log\r\necho \"Current time \" `date` &gt;&gt; \/var\/log\/application1\/error.log<\/pre>\n<pre>sudo filebeat setup test -e<\/pre>\n<p>If there are no errors, start the service:<\/p>\n<pre>sudo filebeat setup -e\r\nsudo systemctl enable filebeat\r\nsudo systemctl start filebeat\r\nsudo systemctl status filebeat<\/pre>\n<p>Navigate to <strong>Observability &gt; Logs &gt; Stream<\/strong>:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-3666\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-20-17-08.png\" alt=\"\" width=\"1665\" height=\"966\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-20-17-08.png 1665w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-20-17-08-300x174.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-20-17-08-1024x594.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-20-17-08-768x446.png 768w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/06\/Screenshot-from-2023-06-18-20-17-08-1536x891.png 1536w\" sizes=\"auto, (max-width: 1665px) 100vw, 1665px\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>What is Elastic Stack or ELK? Elasticsearch A distributed search and analytics engine, essentially a [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-3626","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3626","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3626"}],"version-history":[{"count":30,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3626\/revisions"}],"predecessor-version":[{"id":5642,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3626\/revisions\/5642"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3626"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3626"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3626"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}