# General questions regarding ELK stack

**URL:** <https://discuss.elastic.co/t/general-questions-regarding-elk-stack/64085>\
**Category:** Elasticsearch\
**Created:** [October 27, 2016, 3:43am UTC](https://discuss.elastic.co/t/general-questions-regarding-elk-stack/64085 "2016-10-27T03:43:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Post date:** [October 27, 2016, 3:43am UTC](https://discuss.elastic.co/t/general-questions-regarding-elk-stack/64085/1 "2016-10-27T03:43:27Z")

</div>

Hi,  
I have a few questions regarding ELK stack.

1. 

```
what is the best option to pull data? Read from a log file or Database? Best option in terms of Performance/latency/data accuracy.

```

a. If Database, then any drawback like extra overload on Application database? How frequently it reads?  
b. If both the cases, what happens if Kibana goes down and need to load older log files or data? Will it be done automatic, in real time?  
2) Can single Kibana instance handle multiple apps? Or should i go for separate Kibana instance per app. If single, then any performance degradation and can we control user access to specific application data?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 27, 2016, 7:35am UTC](https://discuss.elastic.co/t/general-questions-regarding-elk-stack/64085/2 "2016-10-27T07:35:46Z")

</div>

> 1. what is the best option to pull data? Read from a log file or Database? Best option in terms of Performance/latency/data accuracy.

There is no single best option that's preferable under all circumstances. All methods have advantages and drawbacks.

> a. If Database, then any drawback like extra overload on Application database? How frequently it reads?

Reading from the database obviously comes with a cost. You can choose how often to do the polling.

> b. If both the cases, what happens if Kibana goes down and need to load older log files or data? Will it be done automatic, in real time?

Kibana is just the visualization layer. If either Logstash or Elasticsearch goes down you'll probably be okay, but it depends on how things are implemented. There will always be opportunities to screw things up.

> 1. Can single Kibana instance handle multiple apps?

Yes.

> Or should i go for separate Kibana instance per app. If single, then any performance degradation and can we control user access to specific application data?

With the Shield product you get pretty granular access control.

---

<div class="post-metadata">

**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Post date:** [October 27, 2016, 5:30pm UTC](https://discuss.elastic.co/t/general-questions-regarding-elk-stack/64085/3 "2016-10-27T17:30:54Z")

</div>

Thanks so much @magnusbaeck 🙂

When you say, reading from database comes with a cost, do you mean we have to pay for the service?

FYI: The database I am going to be reading from has very large sets of data.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 28, 2016, 12:12am UTC](https://discuss.elastic.co/t/general-questions-regarding-elk-stack/64085/4 "2016-10-28T00:12:46Z")

</div>

> [@bishaka](#):
>
> When you say, reading from database comes with a cost, do you mean we have to pay for the service?

He means that reading that data takes time; to have someone setup a process, to run the process, to ingest into ES.

---

<div class="post-metadata">

**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Post date:** [October 28, 2016, 5:32pm UTC](https://discuss.elastic.co/t/general-questions-regarding-elk-stack/64085/5 "2016-10-28T17:32:32Z")

</div>

Oh ok. As long as it's not slow compared to reading from a file..It will be fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:08pm UTC](https://discuss.elastic.co/t/general-questions-regarding-elk-stack/64085/6 "2017-07-05T22:08:40Z")

</div>


