01 / THE ROLE
In this lab.
Elastic was tested in UAT before a dedicated production logging environment was introduced. Fleet manages Elastic Agents on enrolled systems. Elasticsearch indexes the events and Kibana provides investigation views. The documented production rollout progressed beyond the original pilot and its earlier deferred clients were subsequently completed.
02 / THE CONNECTIONS
Follow the flow.
- STEP 01OS & container sources
- STEP 02Elastic Agent
- STEP 03Elasticsearch
- STEP 04Kibana investigation
03 / How it works
How it works.
Policies select the integrations and environment. In the documented Fleet-managed path, agents send to Elasticsearch directly; a Logstash hop should not be invented just because the stack is often called ELK. Logs are correlated with Zabbix symptoms using source and time-window context. Docker log events and Docker metrics are different inputs.
04 / Persistent data & recovery
Persistent data & recovery.
Active index state and the snapshot repository are separate storage roles. The documented production setup uses a NAS snapshot repository and a seven-day retention policy. An initial collection cutoff was introduced to avoid importing unwanted old container history; it is a fixed onboarding boundary, not a sliding replacement for retention.
05 / How to check it
How to check it.
Check agent health, policy acknowledgement, recent source events, timestamps, ingest errors and search behaviour. A green Elasticsearch cluster alone cannot prove that a particular application’s events are arriving. Synthetic markers can validate a collection path without copying private log messages into documentation.
06 / Decisions & limits
Decisions & limits.
Initial historical backfill created much more ingestion than ordinary daily operation. That made collection scope, retention and resource controls part of the design. Successful snapshot and synthetic restore evidence do not amount to a full disaster-recovery exercise.