ELK Logstash Pros and Cons

It is the best open-source product for people working in SO, managing and analyzing logs.

The visualization is very good.

ELK documentation is very good, so never needed to contact technical support.

If the documentation were improved and made more clear for beginners, or even professionals, then we would be more attracted to this solution.

There are connectors to gather logs for Windows PCs and Linux PCs, but if we have to get the logs from Syslog then we have to do it manually, and this should be automated.

Email notification should be done the same way as Logentries does it.

We set up a cron job to delete old logs so that we wouldn't hit a disk space issue. Such a feature should be available in the UI, where old logs can be deleted automatically. (Don’t know if this feature is already there).

They don't provide user authentication and authorisation features (Shield) as a part of their open-source version.

Authentication is not a default in Kibana. We need to have another tool to have authentication and authorization. These two should be part of Kibana.

We had issues with scalability. Logstash was not scaling and aggregation was getting delayed. We moved to Fluentd making our stack from ELK to EFK.