ELK是开源项目，由三部分组成的——logstash，elasticsearch和kibana。
Logstash：负责对日志进行收集，分析过滤等作用，一般部署在线上机器上。
Logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching)
Elasticsearch：简单说是一个基于lucene的检索(+存储)服务；在elk中主要负责搜索日志功能。
Kibana：是为Elasticsearch服务的，提供一个可视化的web界面，进行数据的查询，汇总。

比较好的介绍：
http://www.bogotobogo.com/Hadoop/ELK/ELK_ElasticSearch_Logstash.php
http://feelmanc.blog.51cto.com/5429938/1250430
解决8小时时差问题：
http://vinc.top/2016/09/22/%E8%A7%A3%E5%86%B3elk%E6%97%B6%E5%8C%BA%E9%97%AE%E9%A2%98%E5%AF%BC%E8%87%B4%E7%9A%84%E7%9B%B8%E5%B7%AE8%E5%B0%8F%E6%97%B6/

elasticsearch_dsl-py相关：
https://github.com/elastic/elasticsearch-dsl-py
http://www.cnblogs.com/xing901022/p/4960470.html
https://stackoverflow.com/questions/29904261/range-aggregation-using-elasticsearch-dsl-py
http://blog.csdn.net/yuchenwuhen/article/details/51103543
https://stackoverflow.com/questions/39263663/elasticsearch-dsl-py-query-formation

https://www.elastic.co/guide/en/elasticsearch/reference/2.3/search-aggregations-bucket-daterange-aggregation.html

http://fingerchou.com/categories/elasticsearch/