SlideShare a Scribd company logo
1 of 45
Download to read offline
Logging logs with Logstash
Steve Howe – RetailMeNot UK Ltd.
showe@rmn.com
About me..
Devops engineer at RetailMeNot
Obsessed with making things better
Husband, father, frequently busy
Why Logstash?
Jordan Sissel
Why Logstash?
Jordan Sissel
Noticed a problem
Why Logstash?
Jordan Sissel
Noticed a problem
Why Logstash?
Jordan Sissel
Noticed a problem
Why Logstash?
Jordan Sissel
Noticed a problem
Why Logstash?
Jordan Sissel
Noticed a problem
What does Logstash provide?
Empowerment
What does Logstash provide?
Empowerment
Aggregation
What does Logstash provide?
Empowerment
Aggregation
Search
What does Logstash provide?
Empowerment
Aggregation
Search
What is Logstash (ELK stack)?
Centralization
What is Logstash (ELK stack)?
Centralization
Visualization
What is Logstash (ELK stack)?
Centralization
Visualization
Segregation
Components
httpd
Logstash
shipper
redis
Logstash
indexer
Elastic
search
Kibana
MySQL
Logstash
shipper
Logstash-forwarder shipper
Small package (java) (used to be “lumberjack”)
Logstash-forwarder shipper
Small package (java) (used to be “lumberjack”)
Grok processing can happen on client
Logstash-forwarder shipper
Small package (java) (used to be “lumberjack”)
Grok processing can happen on client
One shipper, multiple logfiles (perms)
Logstash-forwarder shipper
Small package (java) (used to be “lumberjack”)
Grok processing can happen on client
One shipper, multiple logfiles (perms)
Many log formats, one output - JSON
Redis
Message broker
Redis
Message broker
SSL encryption for non-VPN networks
Redis
Message broker
SSL encryption for non-VPN networks
Scalable
Logstash Indexer
Java app
Logstash Indexer
Java app
Grok processing of logs off app-servers
Logstash Indexer
Java app
Grok processing of logs off app-servers
Outputs to multiple endpoints, if required
Logstash Indexer
Java app
Grok processing of logs off app-servers
Outputs to multiple endpoints, if required
Scalable
Elasticsearch
Mature, scalable db
Elasticsearch
Mature, scalable db
Document-based index, Query DSL API
Elasticsearch
Mature, scalable db
Document-based index, Query DSL API
Sharded, clustered
Elasticsearch
Mature, scalable db
Document-based index, Query DSL API
Sharded, clustered
Indices are stored in date format
Kibana
Standalone (used to be simple website)
Kibana
Standalone (used to be simple website)
Points directly at the Elasticsearch db
Kibana
Standalone (used to be simple website)
Points directly at the Elasticsearch db
Solr Lucene syntax
Kibana
Standalone (used to be simple website)
Points directly at the Elasticsearch db
Solr Lucene syntax
Scalable
Kibana
Standalone (used to be simple website)
Points directly at the Elasticsearch db
Solr Lucene syntax
Scalable
Demo
Tricks
Elasticsearch Curator, single indices
Tricks
Elasticsearch Curator, single indices
Outputs to Graphite, Nagios, Cloudwatch,
Datadog, GELF, Slack, Hipchat, PagerDuty etc.
Tricks
Elasticsearch Curator, single indices
Outputs to Graphite, Nagios, Cloudwatch,
Datadog, GELF, Slack, Hipchat, PagerDuty etc.
Kibana dashboards
Gotchas
Logstash Elasticsearch client (versions, AWS)
Gotchas
Logstash Elasticsearch client (versions, AWS)
Enterprise ready? (utter lack of users/security,
streams, alerting)
Gotchas
Logstash Elasticsearch client (versions, AWS)
Enterprise ready? (utter lack of users/security,
streams, alerting)
Graylog – Alternative log engine
Links
Jordan Sissels Github - https://github.com/jordansissel
Jordan Sissel pres - http://semicomplete.com/presentations/logstash-
scale11x/#/33
Logstash book - http://www.logstashbook.com/
Enterprise ready? (users, streams, alerting)
Cheers!

More Related Content

What's hot

Logstash + Elasticsearch + Kibana Presentation on Startit Tech Meetup
Logstash + Elasticsearch + Kibana Presentation on Startit Tech MeetupLogstash + Elasticsearch + Kibana Presentation on Startit Tech Meetup
Logstash + Elasticsearch + Kibana Presentation on Startit Tech Meetup
Startit
 

What's hot (20)

ELK introduction
ELK introductionELK introduction
ELK introduction
 
ELK Ruminating on Logs (Zendcon 2016)
ELK Ruminating on Logs (Zendcon 2016)ELK Ruminating on Logs (Zendcon 2016)
ELK Ruminating on Logs (Zendcon 2016)
 
More kibana
More kibanaMore kibana
More kibana
 
'Scalable Logging and Analytics with LogStash'
'Scalable Logging and Analytics with LogStash''Scalable Logging and Analytics with LogStash'
'Scalable Logging and Analytics with LogStash'
 
Logstash: Get to know your logs
Logstash: Get to know your logsLogstash: Get to know your logs
Logstash: Get to know your logs
 
Monitoramento com ELK - Elasticsearch - Logstash - Kibana
Monitoramento com ELK - Elasticsearch - Logstash - KibanaMonitoramento com ELK - Elasticsearch - Logstash - Kibana
Monitoramento com ELK - Elasticsearch - Logstash - Kibana
 
Open Source Logging and Monitoring Tools
Open Source Logging and Monitoring ToolsOpen Source Logging and Monitoring Tools
Open Source Logging and Monitoring Tools
 
Logstash family introduction
Logstash family introductionLogstash family introduction
Logstash family introduction
 
Elastic{ON} 2016 Review - 김종민 님
Elastic{ON} 2016 Review - 김종민 님Elastic{ON} 2016 Review - 김종민 님
Elastic{ON} 2016 Review - 김종민 님
 
Customer Intelligence: Using the ELK Stack to Analyze ForgeRock OpenAM Audit ...
Customer Intelligence: Using the ELK Stack to Analyze ForgeRock OpenAM Audit ...Customer Intelligence: Using the ELK Stack to Analyze ForgeRock OpenAM Audit ...
Customer Intelligence: Using the ELK Stack to Analyze ForgeRock OpenAM Audit ...
 
Logstash + Elasticsearch + Kibana Presentation on Startit Tech Meetup
Logstash + Elasticsearch + Kibana Presentation on Startit Tech MeetupLogstash + Elasticsearch + Kibana Presentation on Startit Tech Meetup
Logstash + Elasticsearch + Kibana Presentation on Startit Tech Meetup
 
Null Bachaav - May 07 Attack Monitoring workshop.
Null Bachaav - May 07 Attack Monitoring workshop.Null Bachaav - May 07 Attack Monitoring workshop.
Null Bachaav - May 07 Attack Monitoring workshop.
 
The ELK Stack - Get to Know Logs
The ELK Stack - Get to Know LogsThe ELK Stack - Get to Know Logs
The ELK Stack - Get to Know Logs
 
ELK stack at weibo.com
ELK stack at weibo.comELK stack at weibo.com
ELK stack at weibo.com
 
Elk
Elk Elk
Elk
 
ELK Stack
ELK StackELK Stack
ELK Stack
 
Large Scale Log collection using LogStash & mongoDB
Large Scale Log collection using LogStash & mongoDB Large Scale Log collection using LogStash & mongoDB
Large Scale Log collection using LogStash & mongoDB
 
Elk devops
Elk devopsElk devops
Elk devops
 
Journée DevOps : Des dashboards pour tous avec ElasticSearch, Logstash et Kibana
Journée DevOps : Des dashboards pour tous avec ElasticSearch, Logstash et KibanaJournée DevOps : Des dashboards pour tous avec ElasticSearch, Logstash et Kibana
Journée DevOps : Des dashboards pour tous avec ElasticSearch, Logstash et Kibana
 
Introducing ELK
Introducing ELKIntroducing ELK
Introducing ELK
 

Similar to Logging logs with Logstash - Devops MK 10-02-2016

Introduction to MongoDB
Introduction to MongoDBIntroduction to MongoDB
Introduction to MongoDB
Justin Smestad
 
Log analysis with the elk stack
Log analysis with the elk stackLog analysis with the elk stack
Log analysis with the elk stack
Vikrant Chauhan
 
JavaOne 2009 - Full-Text Search: Human Heaven and Database Savior in the Cloud
JavaOne 2009 - Full-Text Search: Human Heaven and Database Savior in the CloudJavaOne 2009 - Full-Text Search: Human Heaven and Database Savior in the Cloud
JavaOne 2009 - Full-Text Search: Human Heaven and Database Savior in the Cloud
Aaron Walker
 
NoSQL: Why, When, and How
NoSQL: Why, When, and HowNoSQL: Why, When, and How
NoSQL: Why, When, and How
BigBlueHat
 
Ruby and Rails short motivation
Ruby and Rails short motivationRuby and Rails short motivation
Ruby and Rails short motivation
jistr
 

Similar to Logging logs with Logstash - Devops MK 10-02-2016 (20)

Raven db byexample
Raven db byexampleRaven db byexample
Raven db byexample
 
Why databases cry at night
Why databases cry at nightWhy databases cry at night
Why databases cry at night
 
Introduction to MongoDB
Introduction to MongoDBIntroduction to MongoDB
Introduction to MongoDB
 
Log analysis with the elk stack
Log analysis with the elk stackLog analysis with the elk stack
Log analysis with the elk stack
 
Free The Enterprise With Ruby & Master Your Own Domain
Free The Enterprise With Ruby & Master Your Own DomainFree The Enterprise With Ruby & Master Your Own Domain
Free The Enterprise With Ruby & Master Your Own Domain
 
SenchaCon 2016: LinkRest - Modern RESTful API Framework for Ext JS Apps - Rou...
SenchaCon 2016: LinkRest - Modern RESTful API Framework for Ext JS Apps - Rou...SenchaCon 2016: LinkRest - Modern RESTful API Framework for Ext JS Apps - Rou...
SenchaCon 2016: LinkRest - Modern RESTful API Framework for Ext JS Apps - Rou...
 
JavaOne 2009 - Full-Text Search: Human Heaven and Database Savior in the Cloud
JavaOne 2009 - Full-Text Search: Human Heaven and Database Savior in the CloudJavaOne 2009 - Full-Text Search: Human Heaven and Database Savior in the Cloud
JavaOne 2009 - Full-Text Search: Human Heaven and Database Savior in the Cloud
 
Ruby on rails
Ruby on railsRuby on rails
Ruby on rails
 
NoSQL: Why, When, and How
NoSQL: Why, When, and HowNoSQL: Why, When, and How
NoSQL: Why, When, and How
 
MongoDB.local Berlin: Atlas for your Enterprise
MongoDB.local Berlin: Atlas for your EnterpriseMongoDB.local Berlin: Atlas for your Enterprise
MongoDB.local Berlin: Atlas for your Enterprise
 
Ruby and Rails short motivation
Ruby and Rails short motivationRuby and Rails short motivation
Ruby and Rails short motivation
 
Nuxeo Platform 6.0 - What's New - November 2014
Nuxeo Platform 6.0 - What's New - November 2014Nuxeo Platform 6.0 - What's New - November 2014
Nuxeo Platform 6.0 - What's New - November 2014
 
Introducing DynamoDB
Introducing DynamoDBIntroducing DynamoDB
Introducing DynamoDB
 
Not only SQL
Not only SQL Not only SQL
Not only SQL
 
SQL Server 2014 In-Memory Tables (XTP, Hekaton)
SQL Server 2014 In-Memory Tables (XTP, Hekaton)SQL Server 2014 In-Memory Tables (XTP, Hekaton)
SQL Server 2014 In-Memory Tables (XTP, Hekaton)
 
Tableau Architecture
Tableau ArchitectureTableau Architecture
Tableau Architecture
 
XMLDB Building Blocks And Best Practices - Oracle Open World 2008 - Marco Gra...
XMLDB Building Blocks And Best Practices - Oracle Open World 2008 - Marco Gra...XMLDB Building Blocks And Best Practices - Oracle Open World 2008 - Marco Gra...
XMLDB Building Blocks And Best Practices - Oracle Open World 2008 - Marco Gra...
 
Scalable Event Analytics with MongoDB & Ruby on Rails
Scalable Event Analytics with MongoDB & Ruby on RailsScalable Event Analytics with MongoDB & Ruby on Rails
Scalable Event Analytics with MongoDB & Ruby on Rails
 
Introduction to Riak - Red Dirt Ruby Conf Training
Introduction to Riak - Red Dirt Ruby Conf TrainingIntroduction to Riak - Red Dirt Ruby Conf Training
Introduction to Riak - Red Dirt Ruby Conf Training
 
CosmosDB for DBAs & Developers
CosmosDB for DBAs & DevelopersCosmosDB for DBAs & Developers
CosmosDB for DBAs & Developers
 

Recently uploaded

%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
masabamasaba
 
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
masabamasaba
 

Recently uploaded (20)

%in Durban+277-882-255-28 abortion pills for sale in Durban
%in Durban+277-882-255-28 abortion pills for sale in Durban%in Durban+277-882-255-28 abortion pills for sale in Durban
%in Durban+277-882-255-28 abortion pills for sale in Durban
 
%in tembisa+277-882-255-28 abortion pills for sale in tembisa
%in tembisa+277-882-255-28 abortion pills for sale in tembisa%in tembisa+277-882-255-28 abortion pills for sale in tembisa
%in tembisa+277-882-255-28 abortion pills for sale in tembisa
 
Microsoft AI Transformation Partner Playbook.pdf
Microsoft AI Transformation Partner Playbook.pdfMicrosoft AI Transformation Partner Playbook.pdf
Microsoft AI Transformation Partner Playbook.pdf
 
Right Money Management App For Your Financial Goals
Right Money Management App For Your Financial GoalsRight Money Management App For Your Financial Goals
Right Money Management App For Your Financial Goals
 
%in Stilfontein+277-882-255-28 abortion pills for sale in Stilfontein
%in Stilfontein+277-882-255-28 abortion pills for sale in Stilfontein%in Stilfontein+277-882-255-28 abortion pills for sale in Stilfontein
%in Stilfontein+277-882-255-28 abortion pills for sale in Stilfontein
 
W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...
W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...
W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...
 
Architecture decision records - How not to get lost in the past
Architecture decision records - How not to get lost in the pastArchitecture decision records - How not to get lost in the past
Architecture decision records - How not to get lost in the past
 
OpenChain - The Ramifications of ISO/IEC 5230 and ISO/IEC 18974 for Legal Pro...
OpenChain - The Ramifications of ISO/IEC 5230 and ISO/IEC 18974 for Legal Pro...OpenChain - The Ramifications of ISO/IEC 5230 and ISO/IEC 18974 for Legal Pro...
OpenChain - The Ramifications of ISO/IEC 5230 and ISO/IEC 18974 for Legal Pro...
 
call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️
call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️
call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️
 
Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
 
%+27788225528 love spells in Vancouver Psychic Readings, Attraction spells,Br...
%+27788225528 love spells in Vancouver Psychic Readings, Attraction spells,Br...%+27788225528 love spells in Vancouver Psychic Readings, Attraction spells,Br...
%+27788225528 love spells in Vancouver Psychic Readings, Attraction spells,Br...
 
Reassessing the Bedrock of Clinical Function Models: An Examination of Large ...
Reassessing the Bedrock of Clinical Function Models: An Examination of Large ...Reassessing the Bedrock of Clinical Function Models: An Examination of Large ...
Reassessing the Bedrock of Clinical Function Models: An Examination of Large ...
 
%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein
%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein
%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein
 
Direct Style Effect Systems - The Print[A] Example - A Comprehension Aid
Direct Style Effect Systems -The Print[A] Example- A Comprehension AidDirect Style Effect Systems -The Print[A] Example- A Comprehension Aid
Direct Style Effect Systems - The Print[A] Example - A Comprehension Aid
 
VTU technical seminar 8Th Sem on Scikit-learn
VTU technical seminar 8Th Sem on Scikit-learnVTU technical seminar 8Th Sem on Scikit-learn
VTU technical seminar 8Th Sem on Scikit-learn
 
Unlocking the Future of AI Agents with Large Language Models
Unlocking the Future of AI Agents with Large Language ModelsUnlocking the Future of AI Agents with Large Language Models
Unlocking the Future of AI Agents with Large Language Models
 
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
 
%in tembisa+277-882-255-28 abortion pills for sale in tembisa
%in tembisa+277-882-255-28 abortion pills for sale in tembisa%in tembisa+277-882-255-28 abortion pills for sale in tembisa
%in tembisa+277-882-255-28 abortion pills for sale in tembisa
 
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
%+27788225528 love spells in Colorado Springs Psychic Readings, Attraction sp...
 
call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️
call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️
call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️
 

Logging logs with Logstash - Devops MK 10-02-2016

Editor's Notes

  1. Jordan Sissel, dreamhost, a sysadmin who's annoyingly intelligent and imaginative
  2. Jordan saw a problem in his capacity as sysadmin, he had immense problems reading logs.
  3. Not hard to look at single server apache logs
  4. Gets more interesting when you have an nginx server AND apache server
  5. Gets really interesting with apache, nginx AND mysql
  6. End up with hero syndrome, single guy that knows regex well drafted in repeatedly
  7. Empowers developers to look at logs in a coherent, searchable manner
  8. Aggregates logs from multiple sources into one interface, as long as NTP is setup
  9. Allows developers to use the flexible Solr Lucene search syntax, can also focus on specific fields of the logfile.
  10. Allows developers to use the flexible Solr Lucene search syntax, can also focus on specific fields of the logfile.
  11. Logstash is now owned by Elastic.co, who also own Kibana and Elasticsearch. Centralizes looking at logs, analysis and diagnosis in one place
  12. ELK stack allows for clear visualization in whatever medium, bar charts, pie charts, etc
  13. Segregates developers from production environments, keeps them from having to log in or sysadmins to get logs for them.