Integrate Elasticsearch with Ollama for Log Analysis

techhadoop ai, ELK, llm

integrate Elasticsearch/ELK with Ollama like this:

Filebeat / Logstash
        ↓
Elasticsearch  ← Kibana dashboards
        ↓
Python log-analysis API
        ↓
Ollama local LLM
        ↓
AI summary / root cause / recommendation

1. Install Ollama model

curl -fsSL https://ollama.com/install.sh | sh
ollama pull llama3.1
# or lighter:
ollama pull mistral

Test:

ollama run llama3.1

2. Python script to analyze Elasticsearch logs with Ollama

pip install elasticsearch requests
from elasticsearch import Elasticsearch
import requests
ES_URL = "http://localhost:9200"
OLLAMA_URL = "http://localhost:11434/api/generate"
INDEX = "filebeat-*"
es = Elasticsearch(ES_URL)
query = {
    "size": 50,
    "sort": [{"@timestamp": {"order": "desc"}}],
    "query": {
        "bool": {
            "must": [
                {"match": {"log.level": "error"}}
            ]
        }
    }
}
result = es.search(index=INDEX, body=query)
logs = []
for hit in result["hits"]["hits"]:
    src = hit["_source"]
    logs.append(str(src.get("message", src)))
log_text = "\n".join(logs)
prompt = f"""
You are a senior DevOps/SRE log analyst.
Analyze these logs and provide:
1. Summary
2. Possible root cause
3. Impact
4. Recommended fix
5. Exact next commands to troubleshoot
Logs:
{log_text}
"""
payload = {
    "model": "llama3.1",
    "prompt": prompt,
    "stream": False
}
response = requests.post(OLLAMA_URL, json=payload)
print(response.json()["response"])

Run:

python3 analyze_logs.py

3. Better Elasticsearch query examples

For Docker errors:

{
  "size": 100,
  "query": {
    "bool": {
      "must": [
        { "match": { "container.name": "kong" }},
        { "match": { "message": "error" }}
      ]
    }
  }
}

For last 15 minutes:

{
  "size": 100,
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-15m"
      }
    }
  }
}

4. Best architecture for your ELK setup

For your Docker/syslog environment:

Linux servers
  ├── Filebeat syslog
  ├── Filebeat Docker logs
  ↓
Central Logstash
  ↓
Elasticsearch
  ↓
AI Analyzer Service
  ↓
Ollama
  ↓
Kibana / Email / Slack report

5. Example AI output you can generate

Incident Summary:
Kong is returning intermittent 500 errors.
Likely Root Cause:
Upstream service closed the connection before Kong received a valid response.
Evidence:
- upstream prematurely closed connection
- HTTP 500 from upstream
- repeated failures from same container
Recommended Actions:
1. Check upstream container logs
2. Verify health checks
3. Check Kong upstream timeout settings
4. Check DNS resolution from Kong container

For production, do not send all logs to Ollama. First filter in Elasticsearch, then send only relevant errors/warnings to the model.

Leave a Reply