I am an end user, and we use Elasticsearch for our logs. Specifically, we use it for security logs for our enterprise, including machines, networks, and endpoints, as part of our IT infrastructure.

We have been able to collect our live logs, which helps us run security operations more effectively. It has enabled us to identify false positives and detect real-time malicious activities in the network.

The security portion of Elasticsearch is particularly beneficial, allowing me to view and analyze security alerts. It serves as a query engine for the database, enabling us to analyze logs for potential threats.

An improvement would be to have an interface that allows easier navigation and tracing of logs. The current system requires manually inputting dates to verify alerts. A visual timeline that pinpoints possible anomalies would be beneficial.

I have been using Elasticsearch for approximately one year.

I would rate the stability of the solution as nine out of ten. It is very robust.

I would rate the scalability as either nine out of ten. It's a very robust solution.

I do not interface directly with technical support from Elastic. Another colleague manages that aspect.

Positive

We did not use any different solution before Elasticsearch.

I was not involved in the setup process. Our architects and technical officer managed it.

I am not directly involved with pricing or setup costs. While I know a portion is open-source, a paid version might be necessary.

It was not my duty to evaluate other options. The architects and chief technical officer handled those decisions.

For someone wanting to be a security analyst, Elasticsearch is a valuable tool. It helps organizations collect large amounts of logs from various platforms like Windows, Ubuntu, and Palo Alto Networks.

I'd rate the solution eight out of ten.

It has helped by notifying me when something happens. I deploy my team to the infrastructure to fix the application. However, receiving alerts before something happens would be more beneficial.

New Relic is very similar to Elasticsearch in functionality; it's easier to use.

New Relic could be more flexible, similar to Elasticsearch. It could improve on providing notifications before something happens instead of when something happens.

It is a stable and good platform.

It's scalable. There's no need to worry about the environment. You just configure it, and it runs without issues.

I haven't used their support, however, a colleague I talked to about this platform with has used it.

Positive

The initial setup is not complex. The only part that may require specific knowledge is communicating your cloud environment with New Relic and managing the cloud environment configurations.

Comparing the costs between New Relic and Elasticsearch is difficult as New Relic's cost is for processing metrics, whereas Elasticsearch's cost is for storage.

I recommend New Relic, however, it depends on the specific use case you have. I'd rate the solution eight out of ten.

We use Elasticsearch as an alternative to Splunk. It is basically for log monitoring.

It's probably a cost-efficient alternative to Splunk. The search interface is nearly the same. When it comes to visualizations, Elastic is a bit better than Splunk.

Elastic Search needs better guides for developers. Better guides for development.

I have been using it for a year.

I would rate the stability an eight out of ten. 

It's fairly scalable. I would rate the scalability of this solution a ten out of ten. 

There are around five end users using it in my team. 

Till date, we did not have any issues with  customer service and support. Like, initially, we had issues in accessing the portal. But that was the only issue, but it was resolved pretty quick.

The initial setup is fairly simple. Initially, it was on-prem, but right now, it's on the cloud.

It is pretty easy to integrate as well.

It's like, when someone is buidling products for scale, it reduces the time to market.

I would rate the pricing a seven out of ten, with one being high price and ten being low price. It could be cheaper for certain use cases, but since it gets the job done, no complaints for the pricing. 

Overall, I would rate it a nine out of ten. I would definitely recommend it to other users. 

It is basically for the banking and non-banking sectors. We use it for the APM perspective and application performance monitoring, but not in a holistic way; it is just layer seven, layer five, and six that are there.

In analytics, people use it for search patterns. I've also used Elasticsearch for indexing, where we can have content and do these things. But from an analytics perspective, I have never used Elasticsearch. I have used it in one project

It's a good tool because if you compare it with MongoDB, MongoDB is better. It has a very good data warehouse and search pattern. Elasticsearch cannot be made into a data warehouse. You can use it for smaller-scale analytics, but if you are looking at anything over 30-40 TB, it's not a data lake or big data solution. 

It's a normal database, and any Oracle database or enterprise DB like MSSQL or PostgreSQL can do these things. I've never used it for unstructured data. I have used MongoDB, but not for this.  

All features are almost the same as other observability tools. The best part I like is that it becomes a MOM aka monitoring of monitors. It can capture data from all other sources. It's not a unique feature of Elasticsearch itself because other tools like Dynatrace do do the same thing. But from an ROI perspective and a user-friendly perspective, it is a good tool.

Even at level four to level seven of the OSI model, it does monitoring very well. There are a lot of AI-embedded tools or prediction tools, and numerous default reports are available, which get populated easily. 

So, the quality features are there. There are about 60  to 70 odd reports available. When you deploy the tool and the logs come in, they can capture those logs and automate field mapping and other things. That's the feature—by default, a few reports are available.

The data indexing capability of Elasticsearch is very good. It does the indexing correctly. It's not over-indexing, so it's perfect. It's very good. But how it works depends on the customization of the application and the search pattern you want. The log can be easily viewed, and based on that, you can easily tag things.

Scalability and ROI are the areas they have to improve. Their license terms are based on the number of cores. If you increase the number of cores, it becomes very difficult to manage at a large scale. For example, if I have a $3 million project, I won't sell it because if we're dealing with a 10 TB or 50 TB system, there are a lot of systems and applications to monitor, and I have to make an MOM (Mean of Max) for everything. This is because of the cost impact. 

Also, when you have horizontal scaling, it's like a multi-story building with only one elevator. You have to run around, and it's not efficient. Even the smallest task becomes difficult. That's the problem with horizontal scaling. They need to improve this because if they increase the cores and adjust the licensing accordingly, it would make more sense.

I have been using it for more than four to five years. 

I would rate the stability a nine out of ten. It is a good product. It is a stable product. 

Elasticsearch has horizontal scalability. The users can scale up to any level. The only problem is related to disaster recovery. After some time, it becomes very difficult to do the DC/DR mapping because observability is a critical tool for event alerts. It becomes difficult to manage real-time events if the primary data center goes down and the disaster recovery site needs to take over. This is an issue for large projects like those at tier-one organizations like Ford or big banks. For mid-level and lower-level tier-two or tier-three organizations, it is good.

Another thing to consider is that Elasticsearch has high resource utilization on both the vertical and horizontal levels. But it's a good product for tier-two organizations.

All my clients are enterprise businesses. 

I've never heard anything wrong from the delivery side, but it's an international company with a very good product. So, the support system should be good.

Positive

I tried to sell Kibana twice, but in terms of deployment, we've used it in two or three places. However, I don't have hands-on experience with Kibana. 

To be very honest, we faced some setbacks with Kibana, particularly with network-level monitoring. This issue occurred a few weeks ago when I tried to sell one of our products. We have used Kibana for APM purposes, as well as the Elasticsearch ELK stack.

From an application perspective, it’s one of the tools we use. I can share a lot of insights, but I haven't seen all their reports or dashboards. So, my experience is from a presales perspective rather than a deployment perspective.

If I compare it with other auxiliary tools like Dynatrace, SolarWinds, or Relay, Elasticsearch is very competitive and user-friendly. 

One thing about Elasticsearch is the way they sell licenses for their database, which can be a bit hidden. Many people think Elasticsearch is entirely open-source, but there are charges involved. It's an MPP-based NoSQL database with some limitations on certain datasets.

I would rate my experience with the initial setup a nine out of ten, with ten being easy. It is easy, not that difficult. 

It can be deployed both on the cloud and on-premises. I've seen on-premises deployments. This is especially true in other parts of the world where governments don't want to use the private cloud and have their own private cloud. I have mostly worked with on-premises deployments.

The mapping can take three months on average. However, the deployment time depends on the project. If you have a hundred servers, it will take two or three weeks. With three or four thousand servers, it will take longer. It's the same with any tool, like Dynatrace or SolarWinds. We have to map services and events, set thresholds, and configure event triggering and notifications. There's a lot to consider, so it depends on the project scope, the number of servers, the data captured, and whether it's agent or agentless. It's difficult to calculate an average about how many days it will take.

I would rate the pricing an eight out of ten, with one being cheap and ten being expensive. It is not very costly, but it is not cheap either. 

I would rate it to others. Elasticsearch can be used for many things. It has a good indexing parameter and can be used for search patterns and more. 

If it's for observability, I would give it a nine out of ten. The only issue I have is with APM (Application Performance Monitoring).

Elasticsearch as a product is different than Elasticsearch as a search engine. Elasticsearch is also different as an analytics tool. It depends on the analytical solution and how they want to fetch data from Elasticsearch as a database. As a search engine, it is one of the best. 90% of people use either Solar or Elasticsearch for web portals and other things. Nobody can challenge Elasticsearch in that area. So, out of ten, I would give it a ten.

But for analytics, I'd give it an eight. It depends on my database and in-memory tools. If I use QlikView or other tools, I'll just use Elasticsearch as a database. It's just like any other database they are using for in-memory analytics. 

For observability, Elasticsearch, Logstash, and other things, it is a good component. It's good for tier-two enterprises. But when you define "enterprise," you must be specific. If you mean more than 2000 servers, then 90% of people won't consider it. There are other observability tools on the market. So, be specific in your query.

I can describe a project where we use Elasticsearch, Logstash, and Kibana (ELK stack) for our archiving objectives. I work in the security department of a Fintech company in the payment industry. We use the ELK stack to connect our internal systems with the bank's systems and we used Beats for data collection. We then store and forward this data to Elasticsearch for indexing and analysis, visualize and create alerts using Kibana based on categorized access logs, identifying and blocking malicious traffic or payloads.

Logsign provides us with the capability to execute multiple queries according to our requirements. The indexing is very high, making it effective for storing and retrieving logs. The real-time analytics with Elastic benefits us due to the huge traffic volume in our organization, which reaches up to 60,000 requests per second. With logs of approximately 25 GB per day, manually analyzing traffic behavior, payloads, headers, user agents, and other details is impractical.

I don't see improvements at the moment. The current setup is working well for me, and I'm satisfied with it. Integrating with different platforms is also fine, and I'm not recommending any changes or enhancements right now.

I have been using Elastic Search for the past year.

We subscribed to NGINX for technical support, and they were helpful during the installation phase. There is a lack of community support for GRPC, which needs improvement. 

we are using a licensed version of the product. 

We are fully satisfied with the usage and support, rating it 8 out of 10. I recommend NGINX for managing traffic due to its multiple functionalities like load balancing, proxy management, and caching.

The tool's stability and performance are good. 

Elastic Search needs to improve its technical support. It should be customer-friendly and have good support. 

I have been using the product for a year. 

The tool is stable; I rate it an eight to nine out of ten. 

The product is scalable, and I rate it a ten out of ten. My company has three users. We use it regularly. 

You need three resources to handle the deployment. 

The tool is not expensive. Its licensing costs are yearly. 

I rate Elastic Search an eight out of ten. You can use the product if you are looking for value for money. 

The solution is a dashboarding tool that's useful for DevOps engineers for monitoring. The solution is like a log database. You can ingest into it anything you want and then find the value of the things you ingest. The solution can also be used to make reports.

The most valuable feature of the solution is its utility and usefulness. I use the solution to see the logs better or the error explained. The solution allows us to be more on top of the alerts for the logs. The solution makes passing of the logs easier and faster.

I would like to see more integration for the solution with different platforms. Sometimes, it's hard to understand what you need to send to Elastic Search.

I have been using the solution for two to three years.

Elastic Search is a stable solution.

More than 50 users are using the solution in our organization.

We use the solution's live data analysis for operations purposes. The solution also has a monitoring aspect. ElasticSearch is like a middleman between the PRTG and ITSM tools. It is easier to pass the information about the metrics or the full logs of the cloud platform you are ingesting in the solution instead of giving the output to PRTG.

The solution is deployed on the cloud in our organization. Elastic Search is something that comes after the projects are done. After implementing the project, we use the solution to have that project monitored. I would recommend the solution to other users.

Overall, I rate the solution an eight out of ten.