Elasticsearch has few interesting features around Machine Learning. While I was looking for data to import into Elasticsearch, I found interesting data sets from Airbnb especially reviews. I noticed that it does not contain any rate, but only comments. To have sentiment of the a review, I would rather have an opinion on that review like: For that matter, I…
Setting up Zabbix monitoring over an Elasticsearch cluster is quiet easy as it does not require an agent install. As a matter a fact, the official template uses the Elastic REST API. Zabbix server itself will trigger these requests. In this blog post, I will quick explain how to setup Elasticsearch cluster, then how easy the Zabbix setup is and…
We sow together how to install and configure Filebeat, Logstash and Elasticsearch. Our log data has been sent from Filebeat to Logstash, then forwarded to Elasticsearch. In this blog, we will see how to configure Kibana and discover our data. Data Stream vs Index A data stream lets you store append-only time series data across multiple indices while giving you…
As promised in the previous blog, I will show how to configure Filebeat to push logs to Logstash, then to Elasticsearch. This for sure will not cover all use cases, but will give you an idea on how it works. Configure Filebeat First of all, let’s understand how Filebeat works. We have to configure inputs and outputs, once Filebeat starts…
In a previous blog, we saw together the difference between Filebeat and Logstash, we said also that both can cooperate together in some cases. In this blog series we will deep into a use case: send logs using filebeat, transform it using Logstash, then send it to Elasticsearch, view it from Kibana. Let’s start by the first step, which is…
Filebeat and Logstash are both comprised in ELK Stack, in this blog we will compare both with some use cases. So, you can then take the most appropriate to your case. Introduction Are you using ELK for logging? In fact, both Filebeat and Logstash can be used to send logs from a file-based data source to a supported output destination.…
In a previous blog, I spoke about snapshot, restore, and briefly about Snapshot Lifecycle Management. In this blog, I will go more in deep in SLM. Snapshot lifecycle management (SLM) is the easiest way to regularly back up a cluster. An SLM policy automatically takes snapshots on a preset schedule. The policy can also delete snapshots based on retention rules…
No need to explain what is a snapshot and restore, how much they are important to any platform, software, database, aso. In this blog, I will show you how to take snapshots of your Elasticsearch cluster and how to restore. A snapshot is a backup of a running Elasticsearch cluster, it could be used to: Please note that this blog…
Upgrade Elasticsearch is an easy task, I always heard this sentence. Which is correct if you take care about indices and compatibility. At a customer, I had the chance to upgrade an old version of Elasticsearch, today I will share with you the Index compatibility story 😉 Index compatibility Elastic confirm that any index you restore from a snapshot must…
There are several query languages to query Elasticsearch (e.g. KQL, EQL, DSL, aso), in this blog I will speak about Domain Specific Language (DSL) which is the most flexible and gives access to all Elasticsearch options! Elasticsearch provides a full Query DSL (Domain Specific Language) based on JSON to define queries. Think of the Query DSL as an AST (Abstract…
One more blog in the Elasticsearch series (blogs list at the bottom), this time we will try to learn more together about indexing and search, more specifically answer the question: is Elasticsearch case-sensitive or case-insensitive? To be honest, I had this question as a beginner and rapidly noticed that there are two sides to answer it. First the indexing, is…
I have recently wrote blogs about ELK Stack and more specifically around Elasticsearch, this blog comes as a complement of the previous blog (Data lifecycle management). What is an index? To understand what is an index in Elasticsearch, first we have to know that Elasticsearch is a distributed document store. Instead of storing information as rows of columnar data, Elasticsearch…
