Elasticsearch
- Docker & Kubernetes course
- Advanced
- Lesson 57/70
- 4 min
Learn log storage with Elasticsearch.
Elasticsearch
Elasticsearch (and its open-source fork OpenSearch) is a distributed search engine storing logs in full-text searchable indices. Logs are usually written to daily indices (loglar-2026.11.03); old indices are deleted by a life-cycle policy (ILM):
$ curl -s "http://elasticsearch:9200/_cat/indices/loglar-*?v"
health status index docs.count store.size
green open loglar-2026.11.02 18241332 9.1gb
green open loglar-2026.11.03 7120455 3.4gbElasticsearch is stateful: in Kubernetes it runs with a StatefulSet and persistent disks, usually with the ECK operator.
Querying
Elasticsearch is queried over HTTP with JSON. It can be filtered with the Kubernetes fields added by Fluent Bit:
curl -s "http://elasticsearch:9200/loglar-*/_search?size=3" -H 'Content-Type: application/json' -d '{
"query": {"bool": {"must": [
{"match": {"kubernetes.namespace_name": "magaza"}},
{"match": {"seviye": "error"}}
]}}
}'As an alternative, Grafana Loki indexes only labels, not log content; it's cheaper but slower for full-text search.
Practice Look at Elasticsearch
Write three commands: forward the svc/elasticsearch service in loglama from local 9200 to 9200; query http://localhost:9200/_cluster/health?pretty with curl -s; query http://localhost:9200/_cat/indices/loglar-*?v with curl -s.
Starter code
# buraya yazSample solution
kubectl port-forward -n loglama svc/elasticsearch 9200:9200
curl -s "http://localhost:9200/_cluster/health?pretty"
curl -s "http://localhost:9200/_cat/indices/loglar-*?v"Expected output
Forwarding from 127.0.0.1:9200 -> 9200
{
"cluster_name" : "loglama",
"status" : "green",
"number_of_nodes" : 3
}
health status index docs.count store.size
green open loglar-2026.11.03 7120455 3.4gb
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 What is the benefit of writing logs to daily indices?
- It isn't needed
- Cleaning old data cheaply by deleting whole indices, not record by record Correct answer
- Slowing down searches
- Increasing disk usage
Explanation: The retention period (e.g. 14 days) is applied by index age.
2 Write the endpoint listing the indices.
curl -s "http://elasticsearch:9200/____/loglar-*?v"curl -s "http://elasticsearch:9200/_cat/indices/loglar-*?v"Explanation: The _cat APIs give readable summaries.
3 Match.
| Term | Meaning |
|---|---|
indeks |
Unit of log storage |
ILM |
Life-cycle policy |
_search |
Query endpoint |
Loki |
Label-indexed alternative |