Elasticsearch Search Engine Monitoring
Elasticsearch is a search engine based on Lucene. It provides a distributed, multitenant-capable full-text search engine with an HTTP web interface and schema-free JSON documents. Elasticsearch is developed in Java and is released as open source under the terms of the Apache License. Telegraf can be used as an Elasticsearch monitoring plugin.
Telegraf Input Plugin: Elasticsearch
Use this plugin to gather Elasticsearch health statistic clusters. The Elasticsearch Telegraf plugin queries endpoints to obtain node and optionally cluster-health or cluster-stats metrics:
- The cluster nodes stats API allows to retrieve one or more (or all) of the cluster nodes statistics.
- The cluster health API allows to get a very simple status on the health of the cluster.
- The Cluster Stats API allows to retrieve statistics from a cluster wide perspective.
Telegraf Output Plugin: Elasticsearch
This plugin writes to Elasticsearch via HTTP using Elastic, an Elasticsearch client for the Go programming language. Currently it only supports Elasticsearch 5.x series.
This plugin can manage indexes per time-frame, as commonly done in other tools with Elasticsearch. The timestamp of the metric collected will be used to decide the index destination.
Elasticsearch is a distributed, RESTful search and analytics engine capable of solving a growing number of use cases. It is developed alongside a data-collection and log-parsing engine called Logstash, and an analytics and visualization platform called Kibana. The three products are designed for use as an integrated solution, referred to as the "Elastic Stack" (formerly the "ELK stack"). Elasticsearch is the heart of the Elastic Stack. As a full-text search engine, Elasticsearch is known for being:
- Resilient and highly available
- Predictable and reliable
- Simple and transparent
Elasticsearch can be used to search all types of documents. It provides scalable search, has near real-time search, and supports multitenancy. Elasticsearch is distributed: this means that indices can be divided into shards and that each shard can have zero or more replicas. Each node hosts one or more shards, and acts as a coordinator to delegate operations to the correct shard(s).
Benchmarking InfluxDB vs. Elasticsearch for Time Series Workloads
InfluxDB outperformed Elasticsearch in all three tests with 8x greater write throughput, while using 4x less disk space when compared against Elastic's time series optimized configuration, and delivering 3.5x to 7.5x faster response times for tested queries.