Elastic Observability Reviews

We have our workload in the cloud, and we take the data from the workload, put it in a data lake, and then analyze it. We keep track, build down anomalies, and so on.

The possibility to customize it has been quite useful. Whatever the other departments want to dream up, we implement. Whatever they want to monitor, the granularity of it, the changes in the threshold, and the anomalies that they want reported all require some development. So far, every single request has been fulfilled.

Elastic Observability correlates different sources and teams to provide a single, unified, achievable goal for businesses. We offer Elastic Observation and security as part of our managed services to our customers.

Elastic Observability has helped in breaking the silos within our customers' environments, allowing different teams to work together rather than being in separate silos. It offers a single platform for role-based access administration, improving the recoverability time and issue resolution.

Elastic Observability can address multiple use cases, including monitoring, visibility, and reporting. It is integrated with a visualization product called Kibana. It's called ELK, which stands for Elasticsearch, Logstash and Kibana. Kibana provides visualization, and the others are security modules. SIEM module is there. 

We use it extensively for reporting, pulling metrics, logs, traces, events, etc. from different systems. Everything is aggregated in Elastic and visualized in Kibana. We use Logstash for ETL — extract, transform and load. We extract the data from the source, transform it—data massaging, data mixing, filters, etc. —and send it to Elasticsearch in the format we need.

The Elastic User Interface framework lets us do custom development when needed. You need to have some Javascript knowledge. We need that knowledge to develop new custom tests.

Elastic Observability didn't help our organization because it was simpler for us to configure other tools, including Dynatrace and Grafana.

The most valuable feature of Elastic Observability is the text search.

I use Elastic more for monitoring integration. For instance, I have OpenShift tools implemented in my company, and I have some workloads to integrate, expose APIs, and perform transformations from a source to the target application. I am using Elastic to monitor integration capabilities and track messages.

With Elastic Observability, we have avoided some breakdowns in our applications and integrations that could have had a business impact. These tools help us monitor and prevent applications from breaking.

I use this product in projects that we do for other companies. We use the most updated version of the solution.

We're using Elastic to get information for several points of observability and several projects and solutions. We're using it broadly in lots of systems. For each solution, we're defining the observability points and the data we want to capture in each point. We're deploying Elastic as the tool to capture the data in each of these points in these transactions, and then putting that in the database. It allows us to analyze not only the number of transactions and quantities, but also the business content of each payload of the transactions in order to have business KPIs, not just technical KPIs. We have more than 300 data capture points in several systems.

This has been used by an IO monitoring team. We have two types of users: technical guys that are monitoring the stability of the systems where this tool is used, to see if we are having issues on the operation. This is the IO management team, and there are around 40 users. The second category is people related to business that are actually using this to capture business information, like the amount of transactions, credit sales, the average value of each operation, and things like that. In that sense, there are about 100 people looking at business dashboards. 

The use is much heavier with the first group. They are tuning systems and deploying new data capture points, etc. Although there are more people in the second group, they are using it more to get the information and use it for tech and business decisions, but they are not heavy users in that sense.

It's easy to deploy, and it's very flexible. We have been able to easily deploy it in the data capture points that we want. After you capture the data payload of each transaction, it's also easy to do the search in the database.

We use Elastic Observability for APM, basically. Right now, it is used only for application performance monitoring. In short, it is only the APM module that Observability is looked upon for by all our customers.

The first time I encountered Elk was sometime around 2018. During that period, I was involved with a customer who had a very strict requirement. They had their own data center and a cloud data center, and they wanted to ensure comprehensive monitoring. This included not only applications from an application perspective but also network, code-level analysis, end-user experience, and more. 

This was why the customer considered Elk as an observability solution, which one of their consultants proposed. They requested a proof of concept from both vendors, and I was the consultant who conducted a POC while also evaluating Elk. 

The customer selected both solutions, choosing Riverbed for monitoring network infrastructure and end-user experience and Elastic for log analytics and their cloud services. I continued extensive analysis in healthcare and recently collaborated on a project with a bank in South Africa involving both Elk and Riverbed.

From my experience with several major customers, the most valued feature of Elastic is its log analytics capabilities. 

I found Elk to be excellent for log analytics, security analytics, application code-level analytics, collaboration with DevOps teams, CI/CD, microservices, and Kubernetes, specifically cloud-native or cloud-specific tasks.