Components
- Filebeat / Fluentd — an agent on each server that reads log files and ships them forward
- Logstash — parsing, filtering, transforming logs (can be replaced by Fluentd or Vector)
- Elasticsearch — indexes and stores logs; provides full-text search
- Kibana — web UI for log search, dashboards, alerts
Alternatives
- Grafana Loki — lighter, stores only labels and lines (does not index content)
- Datadog, Splunk — cloud SaaS solutions
Structured logs
Log JSON instead of plain text. Elasticsearch then automatically indexes fields and you can query: level:error AND service:payments AND duration:>1000.