Search and analytics at scale
Searchable telemetry for planned analyses and questions that arise during investigation.
ELASTIC OBSERVABILITY
Every signal. One context to understand what is really happening.
Add Solution uses Elastic Observability to build architectures that can correlate logs, metrics, traces, network telemetry, digital experience and application signals in a unified investigation and analytics platform.
Our work goes beyond data ingestion. We design pipelines, architecture, retention, integration, dashboards, alerts, APM, OpenTelemetry, automation and operational intelligence around the infrastructure, applications and services that support the business.
UNIFIED OBSERVABILITY
Isolated logs, metrics and traces explain parts of the problem. Context emerges when we can connect them.
An application slows down. CPU looks normal, the database has no alerts and the network is available, but the user still experiences degradation. The question shifts from “which dashboard is red?” to “what happened across the entire transaction?”.
- LOGS
Describe events, errors and state changes.
- METRICS
Show behavior, capacity and trends.
- TRACES
Track the transaction across services.
- FLOWS
Reveal how systems communicate.
- EXPERIENCE
RUM and Synthetics show the perceived journey.
- CONTEXT
Correlation turns signals into investigation and action.
Observability is not about putting all data in one place. It is about being able to navigate that data until you understand what is happening.
OBSERVABILITY PLATFORM
One platform to correlate applications, infrastructure and experience.
Elastic Observability uses Elasticsearch's storage, search, aggregation and correlation capabilities, with Kibana as the exploration and investigation layer. Elastic Agent and Fleet support collection and integration management, coexisting with OpenTelemetry and other sources according to the architecture. The standard distribution of Elasticsearch and Kibana remains under Elastic License 2.0 (ELv2). Since version 8.16, eligible free portions of the source code offer AGPLv3, SSPL 1.0 or ELv2, according to the file and its headers; this does not relicense the entire distribution or all features. Official client libraries identified by Elastic remain under Apache 2.0; the artifact and version must be checked. Elastic Cloud Hosted, Elastic Cloud Serverless and self-managed deployments have different responsibilities, controls and features; availability depends on deployment model, region, version and subscription.
Exploration and investigation
Visualizations, Discover, APM, infrastructure, alerts and contextual analysis.
Managed collection
Centrally managed integrations and policies where appropriate.
Question-driven analysis
A language for exploring, transforming and correlating data during investigation.
OPEN OBSERVABILITY
Modern observability should not depend on a single form of instrumentation.
Elastic supports OpenTelemetry to collect metrics, logs and traces across applications and infrastructure. SDKs and collectors standardize emission and transport; native integrations and Elastic Agent can coexist where they deliver specific value.
- APPLICATION
Instrumented services and workloads.
- OTEL SDK
Signals with conventions and context.
- OTEL COLLECTOR
Processing, routing and export.
- ELASTIC
Search, correlation and investigation.
Standardizing telemetry reduces dependence on instrumentation. Putting that telemetry in context remains an engineering task.
LOG ANALYTICS + STREAMS
An event record gains value when it can be found in the context of the problem.
The architecture addresses collection, parsing, normalization, Elastic Common Schema, enrichment, retention and search. Elastic Streams helps organize, structure and identify relevant events in log streams without replacing rules, quality and human validation.
- RAW LOGS
Events received from different sources.
- STRUCTURE
Parsing and consistent fields.
- PARTITION
Organization according to context and usage.
- ENRICH
Metadados de serviço, ambiente e ownership.
- INVESTIGATE
Search, patterns, anomalies and correlation.
Centralizing logs solves the location problem. Observability starts when we can relate those logs to the service we are investigating.
APPLICATION PERFORMANCE MONITORING
When the application is slow, we need to see the transaction.
Elastic APM observes transactions, traces, spans, services, dependencies, latency, errors, database calls and external services according to instrumentation. In microservices and cloud-native environments, distributed tracing connects stages that no isolated dashboard can explain.
- USER REQUEST
The experience that initiated the journey.
- WEB / API
Entry point, authentication and routing.
- SERVICES
Spans, dependencies, timing and errors.
- DATABASE
Queries, latency and results.
- EXTERNAL API
A dependency outside the application's domain.
The user experiences a transaction. The architecture executes dozens of steps.
DIGITAL EXPERIENCE
Available to the infrastructure does not mean fast for the user.
Real User Monitoring shows the actual browser experience; Synthetics runs checks and journeys from public or private locations. SLOs connect signals to operational objectives for availability, latency and errors, without confusing them with a contractual SLA.
Usuários reais
Browser, device, loading, errors and perceived experience.
Jornadas proativas
Lightweight checks and browser tests for availability and functionality.
Service-driven health
SLIs, objectives, error budgets and burn rates translate telemetry into an operational commitment.
Components in context
Infrastructure, applications, dependencies and experience together define service health.
INFRASTRUCTURE, CLOUD & NETWORK FLOWS
Infrastructure state, utilization and communication in context.
Hosts, VMs, containers, Kubernetes, cloud and serverless produce metrics and logs that need to be linked to applications. The official NetFlow integration receives NetFlow/IPFIX through Elastic Agent and turns records into searchable documents for analysis of sources, destinations, ports, protocols, bytes and patterns.
- ROUTERS
NetFlow/IPFIX exporters.
- SWITCHES
Communication and volume between segments.
- FIREWALLS
Observable sessions and patterns.
- CLOUD
Flow records and service telemetry.
- ELASTIC
Search, analytics and correlation with other signals.
CONTINUOUS PROFILING
Not every performance problem appears in a trace.
Universal Profiling continuously observes CPU consumption in application code, libraries and the kernel, helping locate expensive functions and efficiency opportunities without requiring instrumentation of every function.
Tracing shows where the request went. Profiling helps explain where the code is consuming resources.
LLM & AGENTIC AI OBSERVABILITY
AI applications also need to be observed.
Elastic combines metrics and log integrations with APM/OTLP traces to track requests, latency, usage, cost, errors and providers in LLM and agentic AI applications. Prompts and responses require specific privacy, access and retention policies. Vector search and RAG depend on the corpus, embeddings, filters, evaluation, data authorization and features available in the purchased deployment model.
- USER
Intent and request experience.
- AI APPLICATION
Code, session, context and guardrails.
- AGENT
Orchestration, decisions and tools.
- LLM
Model, provider, tokens, latency and cost.
- TOOLS / DATA
Dependencies, retrieval and results.
An AI application is still a distributed application. It simply adds new dependencies, costs and behaviors to observe.
OBSERVE → UNDERSTAND → ACT
Observability does not have to end at the alert.
Agent Builder for Observability uses platform context and tools to support investigation of infrastructure, applications and root causes. Workflows executes deterministic automations driven by alerts, events, schedules and search results. Agents can reason; workflows keep actions repeatable and controlled.
- OBSERVE
Receive signals with context.
- DETECT
Identify a condition, pattern or anomaly.
- ENRICH
Add service, owner and criticality.
- CORRELATE
Cross-reference signals and dependencies.
- DECIDE
The operator and AI assess evidence.
- ACT
The workflow executes a defined, auditable action.
ALÉM DA PLATAFORMA
Collecting telemetry is not the same as building observability.
You can store billions of events and still have no answers. Add Solution starts with what the organization needs to understand: services, applications, criticality, users, signals, retention, granularity, teams and decisions that should lead to action.
More data does not mean more knowledge
Fields, names, timestamps, correlation IDs, environments and ownership must be consistent.
Service before dashboard
Information represents journeys and operations, not just components.
A quality signal
An alert without context merely transfers the investigation to someone else.
Unanticipated questions
Investigation requires exploring hypotheses that were not already built into a dashboard.
Telemetry is raw material. Observability is the ability to turn it into understanding.
ELASTIC OBSERVABILITY PROFESSIONAL SERVICES
Da estratégia de telemetria à operação da plataforma.
We design Elastic Cloud, self-managed or hybrid architectures according to edition, requirements and licensing. Sizing considers daily volume, cardinality, sampling, retention, replicas, tiers, search, concurrency, ML, AI, flows and growth — without universal formulas. Hosted and Serverless are not equivalent: ILM, plugins, node configuration and user-initiated snapshots do not apply in the same way in Serverless.
- ASSESSMENT
- STRATEGY
- ARCHITECTURE
- SIZING
- INGESTION
- INSTRUMENTATION
- NORMALIZATION
- CORRELATION
- VISUALIZATION
- AUTOMATION
- OPERATION
- EVOLUTION
ARCHITECTURE, RETENTION & PERFORMANCE
Observability also needs to be observable and economically sustainable.
The architecture balances performance, retention and cost through applicable data streams, lifecycle management and data tiers. It also considers shards, mappings, ingest pipelines, queries, cardinality, sampling, security, high availability and the evolution of legacy environments. Commercial and operational features vary by subscription; replicas do not replace snapshots, and no RPO, RTO or savings are assumed.
Hot, warm, cold and frozen
The strategy varies according to search speed, historical horizon and acceptable cost.
Normalization and correlation
Elastic Common Schema helps align fields where appropriate to the use case.
Cluster and workloads
Indexing, search, storage and concurrency analyzed as one system.
Evolução controlada
Upgrades, pipelines, Beats to Agent where applicable, OTel, data streams and dashboards.
COMPETÊNCIAS COMPLEMENTARES
Different technologies answer different questions.
Zabbix helps explain infrastructure health; Progress Flowmon provides deeper insight into communication and network behavior; Lansweeper adds asset context; Elastic correlates signals; Business Service Monitoring connects impact to the service. This is a view of possible capabilities, not a mandatory architecture or a claim of native integration.
OBSERVABILITY ASSESSMENT
You have telemetry. But can you investigate across all signals?
Add Solution can assess your current architecture for logs, metrics, traces, APM, OpenTelemetry, retention, alerts and correlation to identify gaps and opportunities for improvement.
POR QUE ADD SOLUTION
A unified platform requires an equally integrated vision.
Add Solution combines observability engineering, application experience, infrastructure, networking, cloud, data engineering, AI, automation and business context to turn a platform into operational capability.
Signals as parts of the same system
Logs, metrics, traces, experience and flows addressed together.
APM and tracing
Instrumentation aligned with the architecture and critical journeys.
Knowledge of the observed environment
Networks, servers, cloud, Kubernetes and dependencies.
Telemetry connected to the service
Ownership, criticality, operations and experience guide investigation.
PERGUNTAS FREQUENTES
Perguntas frequentes
Answers about components, telemetry, shards, snapshots, deployment models, licensing and Elastic assessment.
Are Elasticsearch and Kibana the same tool?
No. Elasticsearch stores, indexes and queries data; Kibana enables exploration and visualization of information and administration of available features. The architecture must consider both components and their dependencies. Reference (https://www.elastic.co/docs/deploy-manage/deploy/elastic-cloud/cloud-hosted).
Can I start with logs only?
Yes. A deployment can prioritize log sources and evolve according to operational questions. Metrics and traces require appropriate collection and instrumentation. Define the first stage with measurable quality criteria. Reference (https://www.elastic.co/docs/solutions/observability/apm/get-started).
Do more shards always improve performance?
No. Count and size must balance parallelism, overhead and recovery. The decision must be measured with a representative workload, also considering expected growth. Reference (https://www.elastic.co/docs/deploy-manage/production-guidance/optimize-performance/size-shards).
Do replicas eliminate the need for backups?
No. Replicas and snapshots address different problems. Recovery after deletion or disaster requires its own strategy and restoration testing. Reference (https://www.elastic.co/docs/deploy-manage/tools/snapshot-and-restore).
Does OpenTelemetry work with Elastic APM?
Supported paths exist, but language, version, endpoint, conventions and functionality must be checked. Transport compatibility does not prove that all dashboards and features will behave identically. Reference (https://www.elastic.co/docs/solutions/observability/apm/opentelemetry).
Is every Elastic feature free?
No. Availability varies by feature, license, subscription and deployment. Check the current matrix and the chosen component's terms before finalizing the scope. Reference (https://www.elastic.co/subscriptions).
Does Serverless eliminate operational work?
It transfers infrastructure management and updates to Elastic. The organization still needs to address data quality, access, queries, retention and usage monitoring. Reference (https://www.elastic.co/docs/deploy-manage/deploy/elastic-cloud/serverless).
How can I start an assessment with ADD Solution?
Gather sources, estimated volume, retention, environments and priority services. The technical discussion enables diagnostics, deployment and operations to be defined according to need. Technical reference: Elasticsearch clusters, nodes and shards (https://www.elastic.co/docs/deploy-manage/distributed-architecture/clusters-nodes-shards).
SOLUÇÕES RELACIONADAS
Observabilidade conectada à operação.
ADD SOLUTION + ELASTIC
Turn telemetry into context for action.
Talk to our specialists about Elastic Observability, APM, logs, metrics, traces, OpenTelemetry, Synthetics, Network Flows, LLM Observability, AI and automation.