ELKstackとAthenaの素敵な関係

2017/02/10 JAWS-UG#9で発表した資料になります

Transcript

1. & - , T U B D L ͱ " U I F O B ͷ
   ૉ ఢ ͳ ؔ ܎ JAWS-UGԣ඿ #9 - Operational Excellence 2017/02/10 ੢ଜ ༡
2. ˞ ຊ εϥ Π υ ͸
   & - , T U B D L ͱ " N B [ P O " U I F O B Λ
   ٕ ज़ త ʹ ࿈ ܞ ͞ ͤ ͨ ࿩ Ͱ ͸ ͋ Γ · ͤ Μ
   ͢ ͍ · ͤ Μ ʂ
   ͱ ͍ ͏ ͔ ٕ ज़ త ͳ ࿩ ͋ Γ · ͤ Μ
3. & - , T U B D L Ͱ ͷ ӡ ༻ Ͱ ײ ͡ ͨ ෆ ศ Λ
   " N B [ P O
   " U I F O B ͕
   औ Γ আ ͍ͯ ͘ Ε ͨ ͷ Ͱ
   ײ ಈ Λ ڞ ༗ ͠ ͨ ͍ ͱ ͍ ͏ ࿩
4. ͔ ͍ ͠ Ό ͍ Μ
   ͤ ͍ ΂ ͭ ɿ ͓ ͱ ͜
   Ϩ ϕ ϧ ɿ  
   ) 1
        
   . 1
        ࣗ ݾ ঺ հ ࣾ ձ ਓ ྺ
        
   d
         ɹ % $ Ͱ ؂ ࢹ Φϖ Ϩ ʔ λ ʔ
        
   d
         ɹ ๭ ι ʔ γ ϟϧ ήʔϜ ܥ ձ ࣾ
        
   d
   / 0 8 ɹ ɹ
   ג ࣜ ձ ࣾ " 1 1 - * # 05
   "8 4 ྺ
   
   ໿  ೥ ͳ · ͑ ɹ ɹ ɿ ੢ ଜ ɹ ༡
   ͭ ͍ ͬ ͨ ʔ ɿ !HBDIBSJPO
7. 
   &-,TUBDL
   "NB[PO"UIFOB
   
   FMBTUJDTFBSDI
   
   LJCBOBͰͷϩάࢀর
   
   
   ٹੈओ"UIFOB
   
   ӡ༻5JQTతͳ
   
   ҰԠ৮Ε͓ͯ͘΂͖͜ͱ
   
   ·ͱΊ ໨ ࣍
8. & - , T U B D L • elastic search + log stash + kibana = elk stack • L ͷ෦෼ʢσʔλ౤ೖʣ͸fluentdͩͬͨΓ͢Δͱ EFKͱͳΔΒ͍͠ɻ • elasticsearchʹೖΕͯkibanaͰݟͯΔͷͰ
 εϥΠυ಺Ͱ͸૯শͱͯ͠࢖ͬͯ·͢ɻ
9. " N B [ P O
   " U I F O B • 2016/12/01 ެ։ • US East (Northern Virginia)ͱUS West (Oregon)
 Ͱར༻Մೳ(2017/02/09 ݱࡏ) • S3্ͷσʔλʹϑΟʔϧυΛఆٛͯ͠
 ΫΤϦΛ౤͛Δͱɺ਺ඵͰ݁Ռ͕ฦͬͯ͘Δɻ
10. " N B [ P O
    " U I F O B • 2016/12/01 ެ։ • US East (Northern Virginia)ͱUS West (Oregon)
 Ͱར༻Մೳ(2017/02/09 ݱࡏ) • S3্ͷσʔλʹϑΟʔϧυΛఆٛͯ͠
 ΫΤϦΛ౤͛Δͱɺ਺ඵͰ݁Ռ͕ฦͬͯ͘Δɻ ˢϚδͰ ਆ͡Όͳ͍͔͢
11. FMBTUJDTFBSDI
    
    LJCBOB
    Ͱͷϩάࢀর
12. Ͷ Β ͍ • ͱΓ͋͑ͣௐࠪʹ࢖͏ϩά͸elasticsearch • ֤αʔόͷϩάΛfluentdͰू໿ɺ౤ೖ • ݸʑͷαʔόͷΈʹ͔͠࢒Βͳ͍ϩάΛͳ͘͢
 ໨త΋͋Γ • ͨ·ʹlogstash • ΫΤϦʹΑΔΞϥʔτઃఆʢࣗલεΫϦϓτʣ
13. $ V T U P N
    - 0 (
14. & - #
15. 3 % 4
    
    
16. F M B T U J D T F B S D I ӡ ༻ ϧ ʔ ϧ త ͳ • ೖΕΔσʔλ͸ϑΝΠϧͱͯ͠΋ॻ͖ग़͓ͯ͘͠ʢJSONʣ • dailyͰgzipͯ͠S3΁backup • ྔͷଟ͍ϩάʢ1೔10GBҎ্ʣஷ·Δϩά͸3೔Ͱindexຖ࡟আ • Ҏલɺ௕ظͰݟΕΔΑ͏ʹ͍͕ͯͨ͠ɺkibanaද͕͔ࣔͳΓ஗͘ͳͬͯ͠·ͬͨ • ͦ΋ͦ΋ͦΜͳʹաڈͷΛݟͳ͔ͬͨ • ετϨʔδ΋༰ྔΛऔΒͳͯ͘͸͍͚ͳ͍ͨΊ௕ظؒอ࣋ͨ͘͠ͳ͔ͬͨ • εφοϓγϣοτ͸ͱͬͨΓͱͬͯͳ͔ͬͨΓ(ũųųƅƁ • ͱ͍ͬͯͨ΍ͭ΋Ұिؒ΄ͲͰফ͍ͯͨ͠ɻ • ࠓ͸rundeck͞ΜͰຖ೔ࣗಈ࣮ߦ؅ཧɻS3ʹอଘɻ
17. ໰୊఺
18. ໰ ୊ ఺ • index࡟আޙͷௐࠪ • ݟ͍ͨϩά͸΄ΜͷҰ෦෼ • snapshotͷϦετΞͰ͖ͳ͍৔߹ • ਺ेGBͷϩάΛDLͯ͠ղౚͯ͠grepͯ͠ɾɾɾ
19. ໰ ୊ ఺ • elasticsearchʹೖΕΔͷ΋ͦΕͳΓʹ༻ҙ͕ඞཁ • ύʔαʔ୳ͨ͠Γɺॻ͍ͨΓ • template࡞ͬͨΓ(dynamic templateͰେମରԠ) • ٸͳґཔʹରԠ͖͠Εͳ͍
20. ٹ ੈ ओ
21. ࣄ ྫ
    ໰ ͍ ߹ Θ ͤ ௐ ࠪ ͷ ҝ ɺ
    ա ڈ ͷ " 1 * ϩ ά ͕ Έ ͨ ͍
22. ͦ Ε ͳ Β L J C B O B Ͱ ݟ Ε · ͬ ͤ ʂ
23. ͦ Ε ͳ Β L J C B O B Ͱ ݟ Ε · ͬ ͤ ʂ Ұिؒ΄ͲલͳΜͰ͕͢ʜ
24. T O B Q T I P U ΋ ͏ ͳ ͍ Θ ʜ Ұिؒ΄ͲલͳΜͰ͕͢ʜ
25. 4͔Βϩά (#௒ Λ%-ͯ͠ղౚͯ͠HSFQ ͭΒ͍
26. ٹ ੈ ओ
27. \
    
    
    EBUF
    
    z
    
    
    UISFBE
    lŠl
    
    
    MFWFM
    */'0
    
    
    
    IBOEMFS
    lŠl
    
    
    64&3@*%
    lŠl
    
    
    WFSTJPO
    lŠl
    
    
    4&44*0/@*%
    lŠl
    
    
    OB[P
    
    
    
    NFTTBHF
    l63-IUUQ  
    1BSBNFUFS\
    d
    ུ
    d
    ^
    
    
    IPTUOBNF
    lBQJTEGTGPN
    ^ ݩϩά +40/ܗࣜ
28. $3&"5&
    &95&3/"-
    5"#-&
    *'
    /05
    &9*454
    BQJTFSWFSBQJMPH@@
    
    
    
    AEBUFA
    UJNFTUBNQ
    
    
    AUISFBEA
    TUSJOH
    
    
    AMFWFMA
    TUSJOH
    
    
    AIBOEMFSA
    TUSJOH
    
    
    A64&3@*%A
    TUSJOH
    
    
    AWFSTJPOA
    TUSJOH
    
    
    A4&44*0/@*%A
    TUSJOH
    
    
    AOB[PA
    TUSJOH
    
    
    ANFTTBHFA
    TUSJOH
    
    
    AIPTUOBNFA
    TUSJOH
    
    
    308
    '03."5
    4&3%&
    PSHPQFOYEBUBKTPOTFSEF+TPO4FS%F
    8*5)
    4&3%&1301&35*&4
    
    
    
    TFSJBMJ[BUJPOGPSNBU
    
    
    
    -0$"5*0/
    TMPHCVDLFUBQJTFSWFS %#
    
    5BCMF࡞੒
29. 4&-&$5
    
    '30.
    BQJMPH@@
    8)&3&
    VTFS@JE
    ΫΤϦ࣮ߦ
30. ݁Ռ DTWͰͷ%-΋Մೳ
31. Β͘Β͘ڞ༗
32. ࣄ ྫ 
    4  ͷ ΞΫ η ε ϩ ά ͕ ݟ ͨ ͍
33. %FW 0QT -BNCEBͰը૾ॲཧͯ͠Δ͠
    "1*͔Β΋ૢ࡞͍ͯ͠ΔͷͰɺ
    4ΞΫηεϩάΈ͍ͨͰ͢ʂ XFCϖʔδೖͬͯΔΘ͚Ͱ΋ͳ͍͔ Β0/ʹͯ͠ͳ͔ͬͨΘʜ
    ઃఆ͠·͢
34. MPHHJOH
    0/ 0QT ϩάग़Δ·Ͱʹ਺͔͔࣌ؒΔͱॻ͍ͯ͋Δ
    ˞IUUQEPDTBXTBNB[PODPN ϩάLJCBOBͰݟΕ·͔͢Ͷʁ
    %&-&5&Λߦͳ͍ͬͯΔϦΫΤετ͕ݟ͍ͨ ɹ;Ή
    ɹFMBTUJDTFBSDIʹೖΕͯ
    ɹݕࡧͰ͖ΔΑ͏ʹ͠Α͏ %FW
35. ͯ͞FMBTUJDTFBSDIʹೖΕΔ४උ͠ͱ͔͘ɻ
    ͲΜͳײ͡ͷ΍͚ͭͩͬʁ 0QT φχίϨ
    IUUQEPDTBXTBNB[PODPN KB@KQ"NB[PO4MBUFTUEFW 4ΞΫηεϩά
    ϩάܗࣜαϯϓϧ
    BEGCFEBFGCBDFEGEFEFBDGGEFDEFGCF
    NZCVDLFU
    <'FC 
    >
    
    BEGCFEBFGCBDFEGEFEFBDGGEFDEFGCF
    &'&9".1-&
    3&45(&57&34*0/*/(
    
    (&5
    NZCVDLFU WFSTJPOJOH
    )551
    
    
    
    
    
    
    
    4$POTPMF
    
    
36. MPHTUBTIͰύʔεͰ͖Δ༷ʹͯ͠ʜ FMBTUJDTFBSDIʹೖΕͯʜ LJCBOBͰEBTICPBSE࡞ͬͯʜ
37. %&-&5&ͷϩάΛݟ͍͚ͨͩͳͷʹʜ
    ࣌ؒʜ͔͔Δʜͳ͊
38. ٹ ੈ ओ
39. $3&"5&
    &95&3/"-
    5"#-&
    *'
    /05
    &9*454
    T@BDDFTTMPHSFTPVSTF@CVDLFU
    
    
    
    
    
    
    
    
    
    #VDLFU0XOFS
    TUSJOH
    
    
    
    
    
    
    
    
    
    #VDLFU
    TUSJOH
    
    
    
    
    
    
    
    
    
    3FRVFTU%BUF5JNF
    TUSJOH
    
    
    
    
    
    
    
    
    
    3FNPUF*1
    TUSJOH
    
    
    
    
    
    
    
    
    
    3FRVFTUFS
    TUSJOH
    
    
    
    
    
    
    
    
    
    3FRVFTU*%
    TUSJOH
    
    
    
    
    
    
    
    
    
    0QFSBUJPO
    TUSJOH
    
    
    
    
    
    
    
    
    
    ,FZ
    TUSJOH
    
    
    
    
    
    
    
    
    
    3FRVFTU63*@PQFSBUJPO
    TUSJOH
    
    
    
    
    
    
    
    
    
    3FRVFTU63*@LFZ
    TUSJOH
    
    
    
    
    
    
    
    
    
    3FRVFTU63*@IUUQ1SPUPWFSTJPO
    TUSJOH
    
    
    
    
    
    
    
    
    
    )551TUBUVT
    TUSJOH
    
    
    
    
    
    
    
    
    
    &SSPS$PEF
    TUSJOH
    
    
    
    
    
    
    
    
    
    #ZUFT4FOU
    TUSJOH
    
    
    
    
    
    
    
    
    
    0CKFDU4J[F
    TUSJOH
    
    
    
    
    
    
    
    
    
    5PUBM5JNF
    TUSJOH
    
    
    
    
    
    
    
    
    
    5VSO"SPVOE5JNF
    TUSJOH
    
    
    
    
    
    
    
    
    
    3FGFSSFS
    TUSJOH
    
    
    
    
    
    
    
    
    
    6TFS"HFOU
    TUSJOH
    
    
    
    
    
    
    
    
    
    7FSTJPO*E
    TUSJOH
    
    
    
    308
    '03."5
    4&3%&
    PSHBQBDIFIBEPPQIJWFTFSEF3FHFY4FS%F
    8*5)
    4&3%&1301&35*&4
    
    
    
    
    
    
    
    
    
    TFSJBMJ[BUJPOGPSNBU
    
    
    JOQVUSFHFY
    
     <?
    >
    <?
    >
    aa<  aa>
    <?
    >
    <?
    >
    <?
    >
    <?
    >
    <?
    >
    aaa <?
    >
    <?
    >
    
    c<?
    > aaa
    c<>
    <?
    >
    <?
    >
    <?
    >
    <?
    >
    <?
    >
    <?
    >
    a<?a> a
    <?
    > 
    
    
    -0$"5*0/
    bTBXTMPH4SFTPVSTF@CVDLFU %#
    
    5BCMF ࡞੒
40. 4&-&$5
    SFNPUFJQ
    
    
    
    
    
    
    
    
    
    SFRVFTUFS
    
    
    
    
    
    
    
    
    
    DPVOU 
    DPVOU
    '30.
    SFTPVSTF@CVDLFU
    8)&3&
    SFRVFTUVSJ@PQFSBUJPO
    
    %&-&5&
    HSPVQ
    CZ
    SFNPUFJQ
    SFRVFTUFS ΫΤϦ࣮ߦ
41. 
    
    SFNPUFJQ
    SFRVFTUFS
    DPVOU
    
    
    BSOBXTJBN
    ˎˎˎˎˎˎˎˎVTFSEFWFMPQFS
    
    
    
    
    
    BSOBXTJBN
    ˎˎˎˎˎˎˎˎVTFSEFWFMPQFS
    
    
    
    
    BSOBXTJBN
    ˎˎˎˎˎˎˎˎVTFSEFWFMPQFS
    
    
    d
    ུ
    d
    
    
    BSOBXTJBN
    ˎˎˎˎˎˎˎˎVTFSEFWFMPQFS
    
    
    
    
    ˎˎˎˎˎˎˎˎ
    BSOBXTJBN
    ˎˎˎˎˎˎˎˎVTFSEFWFMPQFS
    
    
    
    
    
    ˎˎˎˎˎˎˎˎ
    BSOBXTJBN
    ˎˎˎˎˎˎˎˎVTFSEFWFMPQFS
    
    
    
    
    
    ˎˎˎˎˎˎˎˎ
    BSOBXTJBN
    ˎˎˎˎˎˎˎˎVTFSEFWFMPQFS
    
    
    
     ݁Ռ
42. ·ͱΊ
43. · ͱ Ί • Amazon AthenaͰS3্ͷϩά͕ଈղੳՄೳঢ়ଶʹ
 AthenaͰݟΔͨΊʹ~ΛS3ʹ͸͘Α͏ʹͯ͠…ͱ͔Ͱ͸ͳ͘ɺ
 ͢ͰʹόοΫΞοϓͱ্͍ͯ͛ͯͨ͠ϩάશ͕ͯࣗಈతʹର৅ͱݴ͑Δɻ
 AWSͷαʔϏε(S3 / CloudFront / ELB / CloudTrail)͔Βॻ͖ग़͢ϩά΋ɺ ௐ͚ࠪͩͳΒ͜ΕͰे෼ɻ • elasticsearch͔Β࡟আͯ͠΋S3ʹϩάϑΝΠϧ͋Ε͹ௐࠪ͸OK
 ௕ظؒݟΕΔ༷ʹ͢ΔͨΊʹ
 αʔόεϖοΫΛ্͓͛ͯ͘ඞཁ͸ແ͘ͳͬͨɻ
 ˠ ຊ౰ʹඞཁͳظؒͷΈͰΑ͘ͳͬͨɻ
 ɹ→ snapshot͸ͪΌΜͱऔΖ͏+͋Δఔ౓ظؒ࣋ͬͯͯ΋Α͔ͬͨ(൓ল)
44. · ͱ Ί • ϦΞϧλΠϜͷϩάղੳ → elasticsearch + kibana • S3ʹ͓͍ͨϩάௐࠪ → Amazon Athena
45. & - , T U B D L Ͱ ͷ ӡ ༻ Ͱ ײ ͡ ͨ ෆ ศ Λ
    " N B [ P O
    " U I F O B ͕
    औ Γ আ ͍ͯ ͘ Ε ͨ ͷ Ͱ
    ײ ಈ Λ ڞ ༗ ͠ ͨ ͍ ͱ ͍ ͏ ࿩ Ͱ ͠ ͨ
46. ޚ ਗ਼ ௌ
    ͋ Γ ͕ ͱ ͏ ͝ ͟ ͍ · ͠ ͨ