ELK Stack (Elasticsearch/Logstash/Kibana) Cheat Sheet
Reference for Elasticsearch queries, Logstash pipeline configuration, and Kibana usage for centralized log aggregation and search.
3 PagesAdvancedFeb 12, 2026
Elasticsearch Query DSL
A basic search query filtering by term and range.
json
GET /logs-*/_search{ "query": { "bool": { "must": [ { "match": { "message": "error" } } ], "filter": [ { "term": { "level": "ERROR" } }, { "range": { "@timestamp": { "gte": "now-1h" } } } ] } }, "sort": [{ "@timestamp": "desc" }], "size": 50}
Logstash Pipeline
A pipeline parsing Apache logs with grok and shipping to Elasticsearch.
ruby
input { file { path => "/var/log/apache2/access.log" start_position => "beginning" }}filter { grok { match => { "message" => "%{COMBINEDAPACHELOG}" } } date { match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ] }}output { elasticsearch { hosts => ["http://localhost:9200"] index => "apache-logs-%{+YYYY.MM.dd}" }}
Elasticsearch _cat & Index APIs
Useful admin/inspection commands via curl.
bash
curl -X GET "localhost:9200/_cat/indices?v" # List indicescurl -X GET "localhost:9200/_cluster/health?pretty" # Cluster healthcurl -X DELETE "localhost:9200/logs-2023.01.01" # Delete an indexcurl -X PUT "localhost:9200/logs-2024.01.01" -H 'Content-Type: application/json' -d '{"settings":{"number_of_shards":1}}'
Key Concepts
Core ELK stack terminology.
- index- A collection of documents in Elasticsearch, roughly analogous to a database table
- shard- A horizontal partition of an index distributed across nodes for scale
- grok filter- Logstash pattern matching that parses unstructured text into structured fields
- Kibana Discover- UI for interactively searching and filtering indexed log documents
- index lifecycle management (ILM)- Automates rollover, shrink, and deletion of indices based on age/size
- Beats- Lightweight shippers (Filebeat, Metricbeat) that forward data to Logstash/Elasticsearch
Pro Tip
Prefer Filebeat shipping directly to Elasticsearch (or via an ingest pipeline) over a heavyweight Logstash agent on every host — reserve Logstash for centralized, complex transformations to reduce per-node resource overhead.
Was this cheat sheet helpful?
Explore Topics
#ELKStackElasticsearchLogstashKibana#ELKStackElasticsearchLogstashKibanaCheatSheet#DevOps#Advanced#ElasticsearchQueryDSL#LogstashPipeline#Elasticsearch#Cat#DataStructures#Databases#CheatSheet#SkillVeris
