> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/deployment/stream/publisher-specific-guidance/elk-integration.md).

# ELK integration

### Introduction

A primary function of the Vectra AI Platform is its ability to provide [Enhanced Network Metadata](https://www.vectra.ai/resources/datasheets/vectra-stream-overview) gathered from various network sensors deployed across an environment. This metadata can be managed by Vectra (when using Vectra Recall) or stored in any Data Lake (when using Vectra Stream). A common choice for hosting this data is the ELK Stack (Elasticsearch, Logstash and Kibana). This article provides various resources for setting up and utilizing the network metadata produced by Vectra.

### Compatibility matrix

​​​​​Qualified version of ELK:

* 7.x
* 8.x

|                                       | ELK 7.x | ELK 8.x |
| ------------------------------------- | ------- | ------- |
| \[Logstash] config samples            | Yes     | Yes     |
| \[Elasticsearch] Index templates      | Yes     | Yes\*   |
| \[Elasticsearch]Component Templates   |         | Yes\*   |
| \[Kibana] Index patterns              | Yes     |         |
| \[Kibana] Data View                   |         | Yes     |
| \[Kibana] Searches                    | Yes     | Yes     |
| \[Kibana] Visualizations & Dashboards | Yes     | Yes     |

\* Composable index templates have been introduced in Elasticsearch 7.8.

### Content Library

This content is stored in a GitHub repository. This is available at this address <https://github.com/vectranetworks/vectra-content-for-elk>.

Hosting this content on GitHub, as opposed to directly in this knowledge base, presents several advantages:

* Simplified change tracking
* Efficient version control
* Bug reporting capabilities
* Option to submit enhancement requests
* Notifications for any updates or changes.

The [README](https://github.com/vectranetworks/vectra-content-for-elk) file in the GitHub repository contains all the information about the content available as well as the instructions to install it.

In a nutshell, it contains the following:

* [Logstash](https://www.elastic.co/logstash) Configuration examples.
* [Elasticsearch](https://www.elastic.co/elasticsearch) Index templates/components.
* [Kibana](https://www.elastic.co/kibana) Index patterns/data views, searches and dashboards.

You might not be utilizing Logstash for log shipping. While it has long been a favored choice and remains extensively used, other alternatives like [Fluentd](https://www.fluentd.org/) have become increasingly popular. It's important to note that the content for Elasticsearch and Kibana remains consistent regardless of the log shipper you use. Additionally, Vectra Stream offers support for directly sending network metadata to Elasticsearch.

### Support

If you believe you found a bug or have an idea you'd like to suggest you may [report an issue](https://github.com/vectranetworks/vectra-content-for-elk/issues) or [start a discussion](https://github.com/vectranetworks/vectra-content-for-elk/discussions).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.vectra.ai/deployment/stream/publisher-specific-guidance/elk-integration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.