Elasticsearch Search Engine Monitoring

Elasticsearch is a search engine based on Lucene. It provides a distributed, multitenant-capable full-text search engine with an HTTP web interface and schema-free JSON documents. Elasticsearch is developed in Java and is released as open source under the terms of the Apache License.  Telegraf can be used as an Elasticsearch monitoring plugin.

Telegraf Input Plugin: Elasticsearch

Use this plugin to gather Elasticsearch health statistic clusters. The Elasticsearch Telegraf plugin queries endpoints to obtain node and optionally cluster-health or cluster-stats metrics:

• The cluster nodes stats API allows to retrieve one or more (or all) of the cluster nodes statistics.
• The cluster health API allows to get a very simple status on the health of the cluster.
• The Cluster Stats API allows to retrieve statistics from a cluster wide perspective.

Project URL

Telegraf Output Plugin: Elasticsearch

This plugin writes to Elasticsearch via HTTP using Elastic, an Elasticsearch client for the Go programming language. Currently it only supports Elasticsearch 5.x series.

This plugin can manage indexes per time-frame, as commonly done in other tools with Elasticsearch. The timestamp of the metric collected will be used to decide the index destination.

Project URL

Elasticsearch Basics

Elasticsearch is a distributed, RESTful search and analytics engine capable of solving a growing number of use cases. It is developed alongside a data-collection and log-parsing engine called Logstash, and an analytics and visualization platform called Kibana. The three products are designed for use as an integrated solution, referred to as the "Elastic Stack" (formerly the "ELK stack"). Elasticsearch is the heart of the Elastic Stack. As a full-text search engine, Elasticsearch is known for being:

• Resilient and highly available
• Predictable and reliable
• Simple and transparent

Elasticsearch can be used to search all types of documents. It provides scalable search, has near real-time search, and supports multitenancy. Elasticsearch is distributed: this means that indices can be divided into shards and that each shard can have zero or more replicas. Each node hosts one or more shards, and acts as a coordinator to delegate operations to the correct shard(s).

Reference Docs

Benchmarking InfluxDB vs. Elasticsearch for Time Series Workloads

InfluxDB outperformed Elasticsearch in all three tests with 8x greater write throughput, while using 4x less disk space when compared against Elastic's time series optimized configuration, and delivering 3.5x to 7.5x faster response times for tested queries.

Watch Webinar Read Technical Paper DZone: InfluxDB vs. Elasticsearch