knowledge hub

Knowledge base

Technical articles written by our own engineers out of working practice: concrete commands, configuration snippets, protocol behaviour and trade-offs. No marketing copy.

18 August 20264 min read

Centralising logs — Elasticsearch, Logstash, Kibana and Graylog

Four components, two routes and one question they exist to answer: what happened at 03:14. What each piece actually does, where ELK and Graylog part company, and why retention decides the project rather than the choice of tool.

logging
elasticsearch
logstash
kibana
graylog
siem