ELK is a very standard stack for collecting and disseminating logs. It&#x27;s a fairly natural, and i think sensible, step to build a pattern-based alerting tool as a bag on the side of ELK.<p>If you were going to do it more properly, the first choice would probably be Riemann, which has already seen some adoption in this role. There are already plugins on both sides to forward events to the other:<p><a href="https:&#x2F;&#x2F;www.elastic.co&#x2F;guide&#x2F;en&#x2F;logstash&#x2F;current&#x2F;plugins-outputs-riemann.html" rel="nofollow">https:&#x2F;&#x2F;www.elastic.co&#x2F;guide&#x2F;en&#x2F;logstash&#x2F;current&#x2F;plugins-out...</a><p><a href="http:&#x2F;&#x2F;riemann.io&#x2F;api&#x2F;riemann.logstash.html" rel="nofollow">http:&#x2F;&#x2F;riemann.io&#x2F;api&#x2F;riemann.logstash.html</a>