Slide 5 of 11

Elasticsearch

Elasticsearch: Full-text search and log analytics

What it’s for: Logs with complex search needs including security analytics, audit logging, and full-text search.

Good to know

  • Query language: Lucene query syntax
  • Indexes the full content of every log, which enables full-text search across everything
  • That full indexing uses more storage, memory, and CPU than label-based stores like Loki, and the cluster takes more work to size and maintain.

Best for

  • Complex log search requirements
  • Security analytics (security information and event management, or SIEM)
  • Existing Elasticsearch installations

Documentation

View the full documentation.

Elasticsearch data source

Script

Elasticsearch has been a leading log search engine for over a decade, and for good reason. It indexes the full content of your log lines by default. This enables full-text search across your entire log corpus.

Need to find every log containing a specific error message? Elasticsearch finds it quickly.

The query capabilities are rich: fuzzy matching, phrase searches, aggregations, complex boolean logic. For security teams doing SIEM work, Elasticsearch is often the default choice because that investigative search capability is essential.

The limitations? Complexity and cost. Because Elasticsearch indexes the full content of every log, it uses more storage, memory, and CPU than Loki, and the cluster takes more work to size and maintain.

But if you need sophisticated search capabilities, or you’re already running Elasticsearch for other purposes, it’s an excellent choice.

Previous Next