Docker & Kubernetes
Elasticsearch
Learn log storage with Elasticsearch.
Elasticsearch
Elasticsearch (and its open-source fork OpenSearch) is a distributed search engine storing logs in full-text searchable indices. Logs are usually written to daily indices (loglar-2026.11.03); old indices are deleted by a life-cycle policy (ILM):
$ curl -s "http://elasticsearch:9200/_cat/indices/loglar-*?v"
health status index docs.count store.size
green open loglar-2026.11.02 18241332 9.1gb
green open loglar-2026.11.03 7120455 3.4gb
Elasticsearch is stateful: in Kubernetes it runs with a StatefulSet and persistent disks, usually with the ECK operator.
Querying
Elasticsearch is queried over HTTP with JSON. It can be filtered with the Kubernetes fields added by Fluent Bit:
curl -s "http://elasticsearch:9200/loglar-*/_search?size=3" -H 'Content-Type: application/json' -d '{
"query": {"bool": {"must": [
{"match": {"kubernetes.namespace_name": "magaza"}},
{"match": {"seviye": "error"}}
]}}
}'
As an alternative, Grafana Loki indexes only labels, not log content; it's cheaper but slower for full-text search.
Exercise Look at Elasticsearch
Write three commands: forward the svc/elasticsearch service in loglama from local 9200 to 9200; query http://localhost:9200/_cluster/health?pretty with curl -s; query http://localhost:9200/_cat/indices/loglar-*?v with curl -s.
Show example solution
kubectl port-forward -n loglama svc/elasticsearch 9200:9200
curl -s "http://localhost:9200/_cluster/health?pretty"
curl -s "http://localhost:9200/_cat/indices/loglar-*?v"
Test yourself
-
What is the benefit of writing logs to daily indices?
- It isn't needed
- Cleaning old data cheaply by deleting whole indices, not record by record
- Slowing down searches
- Increasing disk usage
Show answer
Cleaning old data cheaply by deleting whole indices, not record by record — The retention period (e.g. 14 days) is applied by index age.
-
Write the endpoint listing the indices.
curl -s "http://elasticsearch:9200/____/loglar-*?v"
Show answer
curl -s "http://elasticsearch:9200/_cat/indices/loglar-*?v"
-
Match.
- indeks
- Unit of log storage
- ILM
- Life-cycle policy
- _search
- Query endpoint
- Loki
- Label-indexed alternative
Next lesson: Kibana
