Elastic (ELK)

Elastic Observability & APM

Use the Elastic Stack as a full observability platform for logs, metrics, and traces.

Elastic Observability turns the search stack into a unified logs-metrics-traces platform, all stored in Elasticsearch and explored in Kibana. Elastic APM adds distributed tracing: APM agents (or OpenTelemetry) instrument services, send spans and transactions to an APM Server, and Kibana's APM app renders service maps, latency distributions, and trace waterfalls. Because traces, logs, and metrics share one store, you can pivot from a slow transaction to its logs by shared identifiers.

Extending a library that already indexes every book so it now also files the timing logs and the courier routes — same catalogue, same search desk, three kinds of records that cross-reference.

Key Concepts

1
The stack leans on conventions to keep this coherent: the Elastic Common Schema (ECS) normalises field names across data sources so a query for, say, service.name works everywhere, and data streams plus Index Lifecycle Management (ILM) handle time-based rollover and tiered retention (hot/warm/cold/frozen) to control cost. Elastic is increasingly OpenTelemetry-friendly, accepting OTLP so you can keep instrumentation vendor-neutral while using Elastic as the backend.