I noticed that both Kibana and Logstash, the RPM versions, install by default in /opt. This is correct, imo.
On the other hand, Elasticsearch installs by default in /usr/share. According to the FHS, this directory is for read-only architecture-independent data files.
Is there any particular reason for this? Will this change in the upcoming 5.0.0 release?
Update: updated the FHS link to a more current version of the standard.