Use Silk instead of ELK

[Leela_Kodali]

Hi,
I already configured the process, Filebeat -->Logstash--> Elastic Search -->Kibana, it is working good, but we have the requirement to use Solr instead of Elastic Search, while researching on internet i found about Silk.

Can i configure like this : Filebeat -->Logstash-->Solr -->Kibana ? Kibana supports Solr instead of Elastic Search?

Please give some suggestions.

Thanks,
veni

[Ranjith_M]

Hi Leela,

Kibana is tightly coupled with your elastic search, it doesn't work with solr. If you want try solr you can consider using Banana instead of kibana.

P.S: Banana is not that active project though.

[Leela_Kodali]

Thanks Ranjith,
even if i use solr_http plugin like this, i cannot use Solr with Kibana? File -> Logstash -->Solr --> Kibana ?

output {
#stdout { codec => rubydebug }
solr_http {
solr_url => "http://SOLR_HOST:8983/solr/logs"
}

i am not familiar with this logstash solr_http plugin, please advise? . I saw some project in Lucidworks about Silk (Logstash --> Solr--> Banana), but after i download the project and trying to setup i am facing some issues.

PLease suggest what is correct way.

Thanks,
veni

[Christian_Dahlqvist]

Logstash might be able to write to Solr using the plugin you mentioned, but Kibana relies heavily on aggregations and other functionality that is specific to Elasticsearch, which rules out using Solr as a data store together with Kibana.

Banana was a fork of the Kibana project that was modified to work with Solr as a backend instead of Elasticsearch, but I am not surety what extent this is still actively maintained. If you want to make this work with Solr, you are probably better off asking questions through the Banana repo.

Why do you have a requirement to use Solr?

[Leela_Kodali]

Christian,
we are using Solr since long time to store all GIS related data like street data and other data, what my manager saying is "instead of introducing new component (Elastic search) since we already have Solr why don't we use Solr" that is the reason i am exploring all the options.

Thanks,
veni

[dadoonet (David Pilato)]

Disclaimer: I'm an elastic employee.

But let me remove my elastic hat and just keep my old elasticsearch user hat...

Sometimes, introducing a new stack comes with a lot of very good bonuses! You'd be surprised

Yeah, it has a "cost". A migration cost I'd say. But I don't think it's that high TBH...
So migration, should be as well one of your options. Then put in the balance all the goodies you can get for free...

I'd start with a simple POC to let you feel how much hard would be the migration.

My 0.05 cents.