Upgrade to Pro — share decks privately, control downloads, hide ads and more …

様々なメトリクスやログを集めてシステム解析 
- Elastic Stackの入門と活用 - / Intro Elastic Stack

Jun Ohtani
July 11, 2018
100

様々なメトリクスやログを集めてシステム解析 
- Elastic Stackの入門と活用 - / Intro Elastic Stack

OSC Hokkaido 2018での発表資料です。

Jun Ohtani

July 11, 2018
Tweet

More Decks by Jun Ohtani

Transcript

  1. !1
    2018/07/06
    Developer Advocate at Elastic
    Jun Ohtani @johtani
    ༷ʑͳϝτϦΫε΍ϩάΛूΊͯγεςϜղੳ 

    - Elastic Stackͷೖ໳ͱ׆༻ -

    View full-size slide

  2. !3
    ΞδΣϯμ
    • ϝτϦΫεʗϩάͱ͸ʁ
    • γεςϜϝτϦΫεղੳɺϩάղੳΛࢼ͠ʹ΍ͬͯΈΑ͏
    • Beats - Elasticsearch - KibanaͰղੳ
    • ຊ֨తʹղੳΛ΍Δʹ͸ʁ
    • LogstashͰϩά΍ϝτϦΫεΛதܧɾू໿
    • ͞Βʹ৭ʑࢼͯ͠ΈΔʹ͸ʁ

    View full-size slide

  3. !4
    about
    • Me, Jun Ohtani / Developer Advocate
    ‒ lucene-gosenίϛολʔ
    ‒ σʔλ෼ੳج൫ߏஙೖ໳ ڞஶ
    ‒ http://blog.johtani.info

    • Elasticsearch, founded in 2012
    ‒ Products: Elasticsearch, Logstash, Kibana, Beats 

    Elastic APM, 

    X-Pack, Elastic Cloud, Swiftype 

    Professional services: Support & development subscriptions

    Trainings, Consulting, SaaS

    View full-size slide

  4. !5
    ͲΜͳϝτϦΫεɺ

    ϩάΛूΊ͍ͯ·͔͢ʁ

    View full-size slide

  5. !6
    ϝτϦΫε
    • CPUɺϝϞϦ࢖༻཰ɺσΟεΫ࢖༻཰
    • ΞΫηε਺ɺωοτϫʔΫసૹྔ
    • Ԡ౴࣌ؒ
    • ίωΫγϣϯ਺
    • τϥϯβΫγϣϯ਺ɺച্
    • ίϯςφͷ্ͷ֤छϝτϦΫε

    View full-size slide

  6. !7
    ϩά
    • ೝূϩά
    • γεςϜϩά
    • ΞϓϦέʔγϣϯϩά
    • Slow log
    • ΞΫηεϩά
    • ίϯςφͷதͷϩά

    View full-size slide

  7. !8
    Ͱ͖Ε͹ϩάͱϝτϦΫεΛ

    ·ͱΊͯ1ͭͷը໘Ͱ

    ݟ͍ͨͰ͢ΑͶʁ

    View full-size slide

  8. !9
    Elastic Stack

    View full-size slide

  9. 10
    Elastic Stack
    100% Φʔϓϯιʔε
    ʮΤϯλʔϓϥΠζ൛ʯ͸ແ͠
    όʔδϣϯ 5.0Ͱ׬શ౷Ұ

    View full-size slide

  10. !11
    X-Pack
    ؆୯ʹΠϯετʔϧ
    Elastic StackΛ֦ு
    αϒεΫϦϓγϣϯʹؚ·ΕΔ
    Security
    Alerting
    Monitoring
    Reporting
    Graph
    Machine Learning

    View full-size slide

  11. ఆܕͷϝτϦΫε/ϩάղੳΛ
    Elastic StackͰ

    View full-size slide

  12. !13
    ϝτϦΫεɾϩάͷ෼ੳʢ؆қ൛ʣ
    σʔλ Import Parse/

    Store/Search
    Visualize

    View full-size slide

  13. 15
    Beats
    ܰྔσʔλγούʔ
    ιʔε͔ΒσʔλΛసૹ సૹ͠Elasticsearchʹू໿ ม׵ͱύʔεͷͨΊ
    Logstashʹసૹ
    Elastic Cloudʹసૹ
    Libbeat: ΧελϜbeatsͷͨ
    ΊͷAPIϑϨʔϜϫʔΫ
    30Ҏ্ͷίϛϡχςΟbeats

    View full-size slide

  14. The Beats family
    Heartbeat
    Uptime monitoring
    Filebeat
    Log files
    Winlogbeat
    Windows Event Logs
    Packetbeat
    Network data
    +40
    community
    Beats
    Metricbeat
    Metrics
    Auditbeat
    Audit data

    View full-size slide

  15. Collect system
    and application
    metrics
    Metricbeat

    View full-size slide

  16. lots of modules
    Metricbeat

    View full-size slide

  17. tail log from
    file
    Filebeat

    View full-size slide

  18. many modules
    Filebeat

    View full-size slide

  19. Capture the
    Packet
    Packetbeat

    View full-size slide

  20. Capture the
    Packet
    Packetbeat

    View full-size slide

  21. Welcome
    to 1998
    winlogbeat

    View full-size slide

  22. Now
    winlogbeat

    View full-size slide

  23. !25
    • Kubernetes module in Metricbeat
    ‒ CPU, memory, ωοτϫʔΫసૹྔͳͲ
    • add_docker_metadataϓϩηοα
    ‒ Container ID, name, image, labels
    • add_kubernetes_metadataϓϩηοα
    ‒ Pod name, pod namespace, container name, pod
    labels
    Beats <3 ίϯςφ
    Docker΍KubernetesͰͷσϓϩΠΛ؆୯ʹ

    View full-size slide

  24. 27
    Elasticsearch
    Heart of the Elastic Stack
    ෼ࢄܕɺεέʔϥϒϧ ߴՄ༻ੑ Ϛϧνςφϯτ
    ։ൃऀϑϨϯυϦʔ ϦΞϧλΠϜɺશจݕࡧ ΞάϦήʔγϣϯ

    View full-size slide

  25. Elasticsearchͱ͸ʁ

    View full-size slide

  26. !29
    ϑϦʔϫʔυݕࡧ

    View full-size slide

  27. !30
    ߜΓࠐΈ

    View full-size slide

  28. !31
    ϋΠϥΠτ

    View full-size slide

  29. !33
    ϖʔδϯά

    View full-size slide

  30. !35
    αδΣετ

    View full-size slide

  31. !36
    Elasticsearch in 10 seconds
    • εΩʔϚϑϦʔɺ෼ࢄυΩϡϝϯτετΞɺREST & JSON
    • Φʔϓϯιʔε: Apache License 2.0
    • ઃఆͳ͠Ͱ؆୯ʹࢼ͢͜ͱ͕Մೳ
    • JavaͰ࣮૷ɻ֦ு΋༰қ

    View full-size slide

  32. σʔλొ࿥
    38
    curl -XPUT localhost:9200/books/doc/1 -d '
    {
    "title" : "Elasticsearch - The definitive guide",
    "authors" : "Clinton Gormley",
    "started" : "2013-02-04",
    "pages" : 230
    }'

    View full-size slide

  33. σʔλߋ৽
    39
    curl -XPUT localhost:9200/books/doc/1 -d '
    {
    "title" : "Elasticsearch - The definitive guide",
    "authors" : [ "Clinton Gormley", "Zachary Tong" ],
    "started" : "2013-02-04",
    "pages" : 230
    }'

    View full-size slide

  34. σʔλ࡟আ
    !40
    curl -X DELETE localhost:9200/books/doc/1
    σʔλͷऔಘ
    curl —X GET localhost:9200/books/doc/1
    curl —X GET localhost:9200/books/doc/1/_source

    View full-size slide

  35. ݕࡧ - Query DSL
    !41
    curl -XGET ‘localhost:9200/books/doc/_search' -d '{
    "query": {
    "bool": {
    "must": [
    { "match": { "title": "Search" }},
    { "match": { "content": "Elasticsearch" }}
    ],
    "filter": [
    { "term": { "status": "published" }},
    { "range": { "publish_date": { "gte": "2015-01-01" }}}
    ]
    }
    }
    }'

    View full-size slide

  36. ෼ࢄߏ੒ɺ

    εέʔϧ

    View full-size slide

  37. Basic terms
    • ΠϯσοΫε
    ‒ σʔλͷ࿦ཧతͳू߹ɻ

    RDBͷσʔλϕʔεͷΑ͏ͳ΋ͷLogical
    • ϨϓϦέʔγϣϯ
    • ಡΈࠐΈͷεέʔϥϏϦςΟ޲্
    • SPOFͷղফ
    • γϟʔσΟϯά
    • ෳ਺Ϛγϯ΁σʔλΛ෼ׂ

    ॻ͖ࠐΈͷεέʔϥϏϦςΟ޲্

    σʔλϑϩʔ੍ޚ
    !43

    View full-size slide

  38. γϟʔυͱϨϓϦΧ
    !44
    node 1
    orders
    products
    1
    4
    1 2
    2
    3
    curl -X PUT localhost:9200/orders -d '{
    "settings.index.number_of_shards" : 4
    "settings.index.number_of_replicas" : 1
    }'
    curl -X PUT localhost:9200/products -d '{
    "settings.index.number_of_shards" : 2
    "settings.index.number_of_replicas" : 0
    }'

    View full-size slide

  39. γϟʔυͱϨϓϦΧ
    !45
    node 1
    orders
    products
    1
    4
    1
    node 2
    orders
    products
    2
    2
    3 4
    1 2
    3

    View full-size slide

  40. ࣗಈతͳ෼ࢄ
    !46
    node 1
    orders
    products
    2
    1
    4
    1
    node 2
    orders
    products
    2
    2
    node 3
    orders
    products
    3 4
    1
    3

    View full-size slide

  41. ͦͷଞͷػೳ

    View full-size slide

  42. elasticsearch
    ͞·͟·ͳܗࣜͷσʔλͰ
    GeoݕࡧՄೳ


    Ң౓ܦ౓ɺGeoHashɺ
    GeoShape…
    GEO

    View full-size slide

  43. Ecosystem
    • Plugins
    ‒ ϓϥάΠϯʹΑΔػೳͷ௥Ճ
    • ΫϥΠΞϯτϥΠϒϥϦ
    • Java, Ruby, python, php, perl, javascript, .NET
    • Scala, clojure, go
    !49

    View full-size slide

  44. Elasticsearch - The Definitive guide


    http://www.elastic.co/guide/en/
    elasticsearch/guide/current/index.html
    50
    ৄ͘͠஌Γ͍ͨํ͸

    View full-size slide

  45. 52
    Kibana
    Window into the Elastic Stack
    ՄࢹԽͱ෼ੳ ஍ཧۭؒ ΧελϚΠζͱ
    Ϩϙʔτͷڞ༗
    άϥϑ୳ࡧ Elastic Stack΁ͷ
    ηΩϡΞͳΞΫηεͱ؅ཧ
    ΧελϜAppsͷ࡞੒

    View full-size slide

  46. !54
    σϞ
    σʔλ౤ೖ͔ΒՄࢹԽ·Ͱ

    View full-size slide

  47. ຊ֨తʹղੳΛߦ͏ʹ͸ʁ

    View full-size slide

  48. 57
    Logstash
    σʔλՃ޻ύΠϓϥΠϯ
    શͯͷܗࣜɺαΠζͱσʔλιʔ
    εͷ౤ೖ
    ύʔεͱಈతͳ
    σʔλม׵
    ͋ΒΏΔग़ྗʹ
    σʔλసૹ
    ҆શͰ҉߸Խ͞Εͨ

    σʔλೖྗ
    ಠࣗͷύΠϓϥΠϯॲཧ
    ͷ࡞੒
    200Ҏ্ͷϓϥάΠϯ

    View full-size slide

  49. Logstash architecture
    !58
    Input Output
    Filter
    ? ?
    collect and split alter and enrich store and visualize

    View full-size slide

  50. ઃఆ
    59
    input {

    }
    filter {

    }
    output {

    }

    View full-size slide

  51. 1ߦ1σʔλ
    189.120.xx.xx - - [02/Dec/2014:12:18:29 +0900] "GET /manager/html HTTP/
    1.1" 404 274 "-" "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101
    Firefox/5.0"
    60

    View full-size slide

  52. ઃఆɿfilter
    61
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }

    View full-size slide

  53. ύʔε
    !62
    189.120.xx.xx - - [02/Dec/2014:12:18:29 +0900] "GET /manager/html HTTP/1.1"
    404 274 "-" "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0"
    {…
    "@timestamp": "2015-04-10T09:07:49.325Z",
    "clientip": "189.120.xx.xx",
    "ident": "-",
    "auth": "-",
    "timestamp": "02/Dec/2014:12:18:29 +0900",
    "verb": "GET",
    "request": "/manager/html",

    "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/

    View full-size slide

  54. ઃఆɿfilter
    !63
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }

    View full-size slide

  55. ೔෇ͷύʔε
    64
    {…
    "@timestamp": "2015-04-10T09:07:49.325Z",

    "timestamp": "02/Dec/2014:12:18:29 +0900",

    }
    {…
    "@timestamp": "2014-12-02T03:18:29.000Z",

    "timestamp": "02/Dec/2014:12:18:29 +0900",

    }

    View full-size slide

  56. ઃఆɿfilter
    !65
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }

    View full-size slide

  57. IP͔ΒҢ౓ܦ౓ͳͲ෇༩
    66
    "clientip": "189.120.xx.xx",
    "clientip": "189.120.xx.xx",
    "geoip": {
    "ip": “189.120.xxx.xxx”,

    "country_name": "Brazil",
    "continent_code": "SA",
    "region_name": "27",
    "city_name": "São Paulo",
    "latitude":

    View full-size slide

  58. ઃఆɿfilter
    !67
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }

    View full-size slide

  59. ϢʔβΤʔδΣϯτͷύʔε
    68
    "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv:
    5.0) Gecko/20100101 Firefox/5.0\""
    "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv:
    5.0) Gecko/20100101 Firefox/5.0\""
    "useragent": {
    "name": "Firefox",
    "os": "Windows XP",
    "os_name": "Windows XP",
    "device": "Other",
    "major": "5",
    "minor": "0"

    View full-size slide

  60. ͦͷ΄͔ʹ͸ʁ

    View full-size slide

  61. !70
    elasticsearch-hadoop
    -
    •  D E H
    •  PD ecd
    ER
    •  g D
    • 
    CH
    •  Ca M DMS
    D FERC

    View full-size slide

  62. !72
    X-Pack
    ؆୯ʹΠϯετʔϧ
    Elastic StackΛ֦ு
    αϒεΫϦϓγϣϯʹؚ·ΕΔ
    Security
    Alerting
    Monitoring
    Reporting
    Graph
    Machine Learning

    View full-size slide

  63. !74
    ࢀߟจݙ
    • Elasticsearch - The Definitive guide
    ‒ http://www.elastic.co/guide/en/elasticsearch/guide/current/
    index.html
    • ॻ੶ʢ೔ຊޠʣ
    ‒ σʔλ෼ੳج൫ߏஙೖ໳
    ‒ Elasticsearch࣮ફΨΠυ

    View full-size slide

  64. !75
    ࢀߟαΠτ
    • Ϣʔεέʔε
    • https://www.elastic.co/use-cases
    • DiscussʢWebϑΥʔϥϜʣ
    • https://discuss.elastic.co
    • Elastic{ON}ͷϏσΦͱࢿྉ
    • https://www.elastic.co/elasticon/videos
    • αϙʔτϝχϡʔ
    • https://www.elastic.co/subscriptions

    View full-size slide

  65. Thanks for listening!
    Q & A
    We’re hiring!
    https://www.elastic.co/about/careers/
    We’re helping!
    https://www.elastic.co/subscriptions
    http://training.elastic.co

    View full-size slide