Why elgamal is still discussed As I understand, if two users have a shared key, it is possible to encrypt a message using symmetric key encryption. 

So when a secret key is shared through Diffie-Hellman asymmetric key exchange, it means that the users have their shared key. So why can't AES keys be generated from shared keys, and why not use only AES for message encryption after this point?

Actually I am confused about this: if there is a shared key from a DH key exchange, why are we still talking about ElGamal asymmetric message encryption, isn't it confusing for a learner like me, to study that , firstly a secret key is sufficient to do encryption using faster symmetric encryptions and also talking about an asymmetric encryption that is based on shared secret key. Isn't learning Elgamal unnecessary and confusing? If not, is there any particular application that uses elgamal, because I do not find any solid application.
So why can't AES keys be generated from shared keys, and why not use only AES for message encryption after this point?


That is exactly what is done.


  if there is a shared key from a DH key exchange, why are we still talking about ElGamal asymmetric message encryption


Remember, DH is just one way to exchange a key. DH has its problems (no authentication). Using ElGamal is another way someone could exchange a key. It would typically be used as follows: Use AES to encrypt a large message with a random key for Bob. Encrypt that random key using Bob's ElGamal (or RSA if you prefer) public key. Send both to Bob. Bob decrypts the random key using his private key, then uses AES to decrypt the message. You are correct in that ElGamal (or any public-key cipher for that matter) is rarely used to send encrypted messages.


  Isn't learning Elgamal unnecessary and confusing?


If you are only learning DH and nothing else, then definitely not. DH does not provide digital signatures, does not provide authentication, does not provide encryption. It only exchanges a key (and is succeptible to a man-in-the-middle attack). Learning about ElGamal can provide the opportunity to discuss all these other things that you do not get with DH alone. That said, when I took a network security class we didn't discuss ElGamal at all. We instead learned about RSA as a way of doing digital signatures, signing a DH key exchange, exchanging a key, etc.

So, a question you didn't ask, but might be thinking now:


  If we learned about DH and RSA, isn't ElGamal unnecessary?


The answer is no. ElGamal has some other interesting properties and uses that a professor might still want you to learn about. ElGamal is semantically secure out of the box (RSA is only semantically secure if you have random padding). ElGamal has homomorphic properties that make it useful in applications like e-voting. You can create an elliptic curve variant of ElGamal. ElGamal also leads to a fairly simple threshold cryptosystem.

That said, I can see why some professors would skip ElGamal in an undergraduate crypto or network security course.