EFK

EFK stands for Elasticsearch, Fluentd, and Kibana, a popular open-source stack for centralized logging and log analysis. It is a variant of the ELK stack that uses Fluentd (often Fluent Bit) in place of Logstash to collect and forward logs, offering a lighter-weight data pipeline suitable for scalable environments.

The components and their roles are as follows: Elasticsearch is a distributed search and analytics engine that stores and indexes log data. Fluentd serves as a unified data collector capable of parsing, filtering, buffering, and forwarding logs from diverse sources to Elasticsearch. Kibana provides a web-based interface for querying and visualizing data stored in Elasticsearch, enabling dashboards and ad-hoc analysis.

In typical usage, applications generate logs which are collected by Fluentd or Fluent Bit from sources such as files, syslog, or container logs. Fluentd processes these logs—parsing and tagging them as needed—and forwards them to Elasticsearch for storage and indexing. Kibana is then used to explore the data, build dashboards, and create visual representations of log trends and events. Users configure index patterns, dashboards, and retention policies to manage data over time.

Deployment patterns often align with cloud or Kubernetes environments. Fluentd or Fluent Bit is commonly deployed as a DaemonSet or agent to collect node or pod logs. The stack can be secured with TLS, authentication, and access controls, and it supports a wide range of inputs, parsers, and outputs through plugins.

EFK is valued for relatively low resource usage and fast startup compared with ELK deployments that rely on Logstash, though performance depends on Elasticsearch sizing and data design. It remains a central choice for teams pursuing scalable, cloud-native log collection and analysis.