ELK Stack (Elasticsearch/Logstash/Kibana) Cheat Sheet

Reference for Elasticsearch queries, Logstash pipeline configuration, and Kibana usage for centralized log aggregation and search.

3 PagesAdvancedFeb 12, 2026

Elasticsearch Query DSL

A basic search query filtering by term and range.

json

GET /logs-*/_search{  "query": {    "bool": {      "must": [        { "match": { "message": "error" } }      ],      "filter": [        { "term": { "level": "ERROR" } },        { "range": { "@timestamp": { "gte": "now-1h" } } }      ]    }  },  "sort": [{ "@timestamp": "desc" }],  "size": 50}

Logstash Pipeline

A pipeline parsing Apache logs with grok and shipping to Elasticsearch.

ruby

input {  file {    path => "/var/log/apache2/access.log"    start_position => "beginning"  }}filter {  grok {    match => { "message" => "%{COMBINEDAPACHELOG}" }  }  date {    match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]  }}output {  elasticsearch {    hosts => ["http://localhost:9200"]    index => "apache-logs-%{+YYYY.MM.dd}"  }}

Elasticsearch _cat & Index APIs

Useful admin/inspection commands via curl.

bash

curl -X GET "localhost:9200/_cat/indices?v"        # List indicescurl -X GET "localhost:9200/_cluster/health?pretty" # Cluster healthcurl -X DELETE "localhost:9200/logs-2023.01.01"     # Delete an indexcurl -X PUT "localhost:9200/logs-2024.01.01" -H 'Content-Type: application/json' -d '{"settings":{"number_of_shards":1}}'

Key Concepts

Core ELK stack terminology.

index- A collection of documents in Elasticsearch, roughly analogous to a database table
shard- A horizontal partition of an index distributed across nodes for scale
grok filter- Logstash pattern matching that parses unstructured text into structured fields
Kibana Discover- UI for interactively searching and filtering indexed log documents
index lifecycle management (ILM)- Automates rollover, shrink, and deletion of indices based on age/size
Beats- Lightweight shippers (Filebeat, Metricbeat) that forward data to Logstash/Elasticsearch

Pro Tip

Prefer Filebeat shipping directly to Elasticsearch (or via an ingest pipeline) over a heavyweight Logstash agent on every host — reserve Logstash for centralized, complex transformations to reduce per-node resource overhead.

Was this cheat sheet helpful?

Grafana Cheat Sheet

Datadog Cheat Sheet

Explore Topics

#ELKStackElasticsearchLogstashKibana#ELKStackElasticsearchLogstashKibanaCheatSheet#DevOps#Advanced#ElasticsearchQueryDSL#LogstashPipeline#Elasticsearch#Cat#DataStructures#Databases#CheatSheet#SkillVeris

Sri Hayavadhana Info-Tech

Professional Web Designing Services