Explain the ELK stack architecture and how data flows from application logs to a Kibana dashboard.
Quick Answer
Applications send logs to Logstash (or Beats), which parses and enriches them before indexing into Elasticsearch. Kibana queries Elasticsearch to render dashboards and visualizations.
Detailed Answer
Data Flow
1. Collection: Filebeat/Fluentd tails log files or receives syslog, adding metadata (hostname, service, timestamp) 2. Processing: Logstash receives events, applies grok filters to parse unstructured logs into fields, enriches with GeoIP/DNS lookup, and transforms 3. Indexing: Logstash outputs to Elasticsearch, which indexes documents into time-based indices (logs-2026.06.23) 4. Storage: Elasticsearch distributes data across shards on data nodes. Primary shards handle writes, replicas provide redundancy 5. Querying: Kibana sends queries to Elasticsearch, which searches across shards in parallel and aggregates results
Production at Scale
Use Index Lifecycle Management (ILM) to automatically move indices through hot→warm→cold→delete phases. Hot nodes use SSDs for fast writes, warm nodes use HDDs for cost-effective storage. Set shard size to 30-50GB for optimal performance. Use data streams instead of raw indices for time-series data.
Common Pitfall: Over-sharding. Each shard consumes ~50MB heap. 1000 indices × 5 primary shards × 1 replica = 10,000 shards = 500MB heap overhead before any data.
Code Example
# Logstash pipeline configuration
input {
beats { port => 5044 }
}
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:msg}" }
}
date {
match => [ "timestamp", "ISO8601" ]
target => "@timestamp"
}
}
output {
elasticsearch {
hosts => ["http://es-cluster:9200"]
index => "logs-%{+YYYY.MM.dd}"
}
}
# ILM policy
PUT _ilm/policy/logs-policy
{
"policy": {
"phases": {
"hot": { "actions": { "rollover": { "max_size": "50gb", "max_age": "1d" }}},
"warm": { "min_age": "7d", "actions": { "shrink": { "number_of_shards": 1 }}},
"delete": { "min_age": "30d", "actions": { "delete": {} }}
}
}
}Interview Tip
Walk through the data flow end-to-end. Mention ILM and shard sizing — these show you've operated ELK at scale, not just set it up once.