The primary purpose of an ELK/EFK stack is?

• A. Real-time metrics collection
• B. DNS resolution
• C. Centralized log collection, search, and analysis
• D. TLS termination

Answer: (C)

Centralized log collection, search, and analysis. The ELK/EFK stack brings logs from many sources into a single, searchable store. Elasticsearch indexes the logs so you can run fast queries and aggregations. Logstash (or Fluentd in the EFK variant) acts as the data pipeline, parsing and normalizing diverse log formats before sending them to Elasticsearch. Kibana provides the user interface to search, filter, visualize, and build dashboards, making it easier to spot patterns, correlate events across services, and investigate incidents over time. This setup is ideal for troubleshooting, security monitoring, and gaining operational visibility at scale. Other options describe functions outside log management, such as real-time metrics collection or TLS termination, which are not the primary purpose of the stack.