Kibana

1. Kibana is an open source data visualization plugin for Elasticsearch. It provides
visualization capabilities on top of the content indexed on an Elasticsearch cluster.
The combination of Elasticsearch, Logstash, and Kibana (also known as ELK stack
or Elastic stack) is available as products or service.
What is an Elastic Search?
Elastic search is a search engine based on Lucene. It provides a distributed,
multitenant-capable full-text search engine with an HTTP web interface and schema-
free JSON documents. Elastic search is developed in Java and is released as open
source under the terms of the Apache License.
What is logstash?
Logstash is an open source tool for collecting, parsing, and storing logs for future use.
Kibana can be used to search and view the logs that Logstash has indexed. Both of
these tools are based on Elasticsearch. Elasticsearch, Logstash, and Kibana, when
used together is known as an ELK stack.
What is an ELK stack?
The ELK stack consists of Elasticsearch, Logstash, and Kibana. Although they've all
been built to work exceptionally well together, each one is a separate project that is
driven by the open-source vendor Elastic—which itself began as an enterprise search
platform vendor.
What’s our problem?
 Small Team
 Lots of users (untrusted users)
 Lots of system
 Lots of logs
Optimization Priorities:
 Reaction time
 Enrichment
 Insights
“Optimize for query not for storage”
What is Kibana written in?
JavaScript
Why Kibana?
 Easy to deploy.
 Scales vertically and horizontally.
 Easy to use API.
 Modules for multiprogramming and scripting languages.
 “Its Free”

2. Linux
Servers
Windows
Servers
KIBANA INTERFACE OVERVIEW:
 DISCOVER
1. Search Bar
2. Time Filter
3. Field Selector
4. Data Histogram
5. Log View
 VISUALIZE
1. Make aspects of data more readily apparent.
2. Aids perspective and understanding of data.
3. Attach one or more queries to individual aspects.
4. Drill down on data using filters.
 DASHBOARD
1. Highly customizable dashboarding.
2. Instant sharing and embedding of dashboards.
3. Panels: Time Picker – Query – Filtering, Charts – Table – Text
 SETTING
1. Intuitive interface for variety of users.
2. Correlate events within and between data sets to gain context.
Even with such features and vast utility “SPLUNK” beats it in many aspects:
SPLUNK E-L-K
* EPS : 6500 5000
* Portability: OK Kibana Issue
* Compression: YES NO
* What you get: Product Technology Stack
Logstash Agent Logstash Agent
Message Queuing
Logstash
Node2
Node3 Node1 Kibana
Analysis