ELK is perfect for small business who need to monitor the logs of their infra. Coming from a Splunk setup, I can say that even if ELK is lacking few minor functionalities, it will convince 90% of companies with it price (free! ;) and community support & content!
Here is some final production dashboards. All of this could be running on one big screen.
We can monitor here all logs with errors, by vm/container. ON 24 hours we can detect app failing, database errors, incoming high traffic, node stop syncing.
All ssh success and failures are displayed, impossible then to miss any attack (hopefully ;-).
Below is the performance of servers, basically we run each 1 min a "top" on all servers to collect metrics. We display only the top 6 servers high CPU or disk, which is very powerfull because in half of a screen we can monitor 20+ servers.
Here we can see that vm ethworker is swapping badly... :-O
Follow the github doc to get a full ELK stack running:
I will add later commands to easily visualise via ELK: VM performances via a simple "Top", and the parsing for ssh security.
If you are interested to forward container performance logs from cadvisor to elk, please have a look at this doc. (carefull, old version of elk)