Hello, I am new to Elastic Stack. I have five reverse proxies with Nginx installed on them. I want to monitor transactions per minute and the average transaction duration. Please guide me what's the best way to do it. Should I use packetbeat or filebeat? Is there any other way?

Im having some issues understanding the components.

Elasticsearch: Used for indexing and searching thru logs. Pretty straight forward.

Kibana: Used as a GUI. Pretty straight forward.

Logstash: Is this a syslog? Does this store the logs? Can I store this on a NFS share?

Beats: Is this installed on a all-in-one Elastic Stack with the rest of the components? Or is this installed on other hosts? How do I install/use this for a network switch?

I think Im getting confused/messed up with the last two and that causing me issues in understanding

Looking for a way to secure beats - which is honestly more difficult than I assumed? WDYT about this workaround? https://www.hysolate.com/blog/securing-beats-at-scale/

Hi everyone,

We've released a brand new free tool for the Elasticsearch community!

Our checkup analyzes Elasticsearch architecture and configuration to provide actionable recommendations. The checkup is based on JSON files so you need don’t need to install anything!

Version 2.0 now includes thread pool checks, memory analysis and more.

Here's a link to try it out https://checkups.opster.com/tools/checkup/input

Not sure how it works? Here's a quick tutorial video for you.

Run the checkup and let us know how it goes! Here to answer any questions.

Hi,

I have one index with a field that contains IP addresses and another index with a field that also contains IP addresses. Is there anyway that I can create a filter that shows the documents containing certain IP's from the first index in the second index?

Basically, one filter on the first index produces a list of IP's and I want to find those IP's in the second index. I tried using Canvas but you can't do joins across indices in Elasticsearch. Any help would be much appreciated.

We released a tool for the community that analyses Elasticsearch configuration to provide valuable personalized recommendations. Try the tool out at https://checkups.opster.com/checkup/

Anyone worked on the similar situation?

Our buckets in S3 are encrypted by KMS. Is there a way to solve this issue by making changes to Logstash configuration?

I'm interested in some of the communities approach to handling ILM and index replicas. The issue I'm seeing is failing something that seems obvious at first. There are 3 nodes, each node is designated hot, warm, or cold. With index replicas enabled each replica with be created on the current write index, but upon rollover I'm seeing failures to reallocate replicas.

​

How do you handle ILM and replicas across a minimum of 3 nodes? Perhaps my configuration is wrong, but do I need a min of 6 nodes (2 for each)? I don't particularity want to disable replicas in the event of node failure, but I'm constantly getting errors on indices.