Explain Elastic Observability & APM in Observability

4 / 4

Elastic (ELK)

Elastic Observability & APM

Use the Elastic Stack as a full observability platform for logs, metrics, and traces.

Elastic Observability turns the search stack into a unified logs-metrics-traces platform, all stored in Elasticsearch and explored in Kibana. Elastic APM adds distributed tracing: APM agents (or OpenTelemetry) instrument services, send spans and transactions to an APM Server, and Kibana's APM app renders service maps, latency distributions, and trace waterfalls. Because traces, logs, and metrics share one store, you can pivot from a slow transaction to its logs by shared identifiers.

Extending a library that already indexes every book so it now also files the timing logs and the courier routes — same catalogue, same search desk, three kinds of records that cross-reference.

Key Concepts

The stack leans on conventions to keep this coherent: the Elastic Common Schema (ECS) normalises field names across data sources so a query for, say, service.name works everywhere, and data streams plus Index Lifecycle Management (ILM) handle time-based rollover and tiered retention (hot/warm/cold/frozen) to control cost. Elastic is increasingly OpenTelemetry-friendly, accepting OTLP so you can keep instrumentation vendor-neutral while using Elastic as the backend.

What the interviewer is probing.

What the interviewer is probing.

1. "How does Elastic APM fit the stack?" *Probing:* the integration. *Stalls:* "Separately." *Moves up:* agents send to an APM server that writes into Elasticsearch, so traces sit beside logs and metrics in one store.

1. "How does Elastic APM fit the stack?"

2. "What is the advantage of one store?" *Probing:* the argument. *Stalls:* "Simplicity." *Moves up:* correlating a trace with its logs and host metrics is a query, not an integration between products.

2. "What is the advantage of one store?"

3. "What does it accept besides its own agents?" *Probing:* currency. *Stalls:* "Nothing." *Moves up:* OpenTelemetry data, so instrumentation is not locked to Elastic.

3. "What does it accept besides its own agents?"

4. "What is the main operational cost?" *Probing:* honesty. *Stalls:* "None." *Moves up:* running and sizing the cluster — storage, shards and heap are yours to manage unless you take the cloud service.

4. "What is the main operational cost?"