Elasticsearch: Full-text search and log analytics

What it’s for: Logs with complex search needs including security analytics, audit logging, and full-text search.

Good to know

Query language: Lucene query syntax
Indexes the full content of every log, which enables full-text search across everything
That full indexing uses more storage, memory, and CPU than label-based stores like Loki, and the cluster takes more work to size and maintain.

Best for

Complex log search requirements
Security analytics (security information and event management, or SIEM)
Existing Elasticsearch installations

Documentation

View the full documentation.

Elasticsearch data source

Read script

Script

Elasticsearch has been a leading log search engine for over a decade, and for good reason. It indexes the full content of your log lines by default. This enables full-text search across your entire log corpus.

Need to find every log containing a specific error message? Elasticsearch finds it quickly.

The query capabilities are rich: fuzzy matching, phrase searches, aggregations, complex boolean logic. For security teams doing SIEM work, Elasticsearch is often the default choice because that investigative search capability is essential.

The limitations? Complexity and cost. Because Elasticsearch indexes the full content of every log, it uses more storage, memory, and CPU than Loki, and the cluster takes more work to size and maintain.

But if you need sophisticated search capabilities, or you’re already running Elasticsearch for other purposes, it’s an excellent choice.

Elasticsearch: Full-text search and log analytics

Good to know

Best for

Documentation

Still have questions?

Get every update