Does Kibana take data from ElasticSearch or LogStash directly?

Question

This might be quite a dumb question but I couldn't find the explanation in any architectural overview of the ELK stack.

When data are displayed in real time, does Kibana use LogStash directly or Kibana get the information from ElasticSearch after it's been put there by LogStash?

I'm asking this because I want to do some custom query on the fly, so that Kibana results become optimized with time.

Answer 1

Kibana从ElasticSearch获取数据。

Answer 2

As Kresimir Nesek told you, Kibana takes data from Elasticsearch search using the REST API. Data are previously parsed and indexed by logstash (if you use it) and sent to elasticsearch for storing.

Both, Kibana 3 and 4, use the REST API or Elasticsearch to query. See the official documentation for more information.

You might probably be interesteed in Elasticsearch node/cluster management, I recommend you this management/monitoring interface for Elasticsearch.