OSC 大阪 2019でのセッションで使用した資料です。 「マイクロサービス」とありますが、アプリケーションの監視の話がメインですので、アプリケーションの監視やログ解析などに興味のある方にも読んでいただける内容となっています。
!12019/01/25Community Engineer @Elastic Jun Ohtani @johtaniElastic StackͰϚΠΫϩαʔϏεӡ༻Λ ָʹ͢Δʹʁ - Elastic Stackͷೖͱ׆༻ -
View Slide
!2about• Me, Jun Ohtani / Community Engineer‒ lucene-gosenίϛολʔ‒ σʔλੳج൫ߏஙೖ ڞஶ‒ http://blog.johtani.info • Elastic, founded in 2012‒ Products: Elasticsearch, Logstash, Kibana, Beats Elastic APM, Elastic Cloud, Swiftype Professional services: Support & development subscriptions Trainings, Consulting, SaaS
!3ΞδΣϯμ• ϚΠΫϩαʔϏεͱʁ• Elastic Stackͱʁ• ༷ʑͳ؍͔ΒͷΞϓϦέʔγϣϯͷࢹ• ͞Βʹ৭ʑࢼͯ͠ΈΔʹʁ
!4ϚΠΫϩαʔϏεͱ
!5ϚΠΫϩαʔϏε (Wikipedia)https://ja.wikipedia.org/wiki/ϚΠΫϩαʔϏε
!6ϞϊϦγοΫ v.s. ϚΠΫϩαʔϏε
!7ϚΠΫϩαʔϏεʁʁʁ
!8Elastic Stackͱʁ
ElasticStackอଘɺݕࡧɺੳElasticsearchՄࢹԽɺཧKibanaBeats ΠϯδΣετLogstash
MetricsLoggingAPMSite SearchApplicationSearchBusiness AnalyticsEnterprise SearchSecurity AnalyticsFuture ιϦϡʔγϣϯอଘɺݕࡧɺੳՄࢹԽɺཧΠϯδΣετKibanaElasticsearchBeats LogstashElasticStack
MetricsLoggingAPMSite SearchApp SearchBusiness AnalyticsEnterprise SearchSecurity AnalyticsFuture ιϦϡʔγϣϯSaaSElastic CloudSelf ManagedElastic Cloud Enterprise StandaloneσϓϩΠอଘɺݕࡧɺੳՄࢹԽɺཧΠϯδΣετKibanaElasticsearchBeats LogstashElasticStack
อଘɺݕࡧɺੳElasticsearchՄࢹԽɺཧKibanaBeats ΠϯδΣετLogstashMetricsLoggingAPMSite SearchApplicationSearchBusiness AnalyticsEnterprise SearchSecurity AnalyticsFuture ιϦϡʔγϣϯSaaSElastic CloudSelf ManagedElastic Cloud Enterprise StandaloneσϓϩΠElasticStack
!13
14Beatsܰྔσʔλγούʔιʔε͔ΒσʔλΛసૹ సૹ͠Elasticsearchʹू มͱύʔεͷͨΊLogstashʹసૹElastic CloudʹసૹLibbeat: ΧελϜbeatsͷͨΊͷAPIϑϨʔϜϫʔΫ30Ҏ্ͷίϛϡχςΟbeats
The Beats familyHeartbeatUptime monitoringFilebeatLog filesWinlogbeatWindows Event LogsPacketbeatNetwork data+40communityBeatsMetricbeatMetricsAuditbeatAudit data
!16
17LogstashσʔλՃύΠϓϥΠϯશͯͷܗࣜɺαΠζͱσʔλιʔεͷೖύʔεͱಈతͳσʔλม͋ΒΏΔग़ྗʹσʔλసૹ҆શͰ҉߸Խ͞Εͨ σʔλೖྗಠࣗͷύΠϓϥΠϯॲཧͷ࡞200Ҏ্ͷϓϥάΠϯ
!18
19ElasticsearchHeart of the Elastic Stackࢄܕɺεέʔϥϒϧ ߴՄ༻ੑ Ϛϧνςφϯτ։ൃऀϑϨϯυϦʔ ϦΞϧλΠϜɺશจݕࡧ ΞάϦήʔγϣϯ
Elasticsearchͱʁ
ϑϦʔϫʔυݕࡧ!21
ߜΓࠐΈ!22
ϋΠϥΠτ!23
ιʔτ!24
ϖʔδϯά!25
ूܭ!26
αδΣετ!27
Elasticsearch in 10 seconds• εΩʔϚϑϦʔɺࢄυΩϡϝϯτετΞɺREST & JSON• Φʔϓϯιʔε: Apache License 2.0• ઃఆͳ͠Ͱ؆୯ʹࢼ͢͜ͱ͕Մೳ• JavaͰ࣮ɻ֦ு༰қ!28
؆୯ͳCRUD
σʔλొ30curl -XPUT localhost:9200/books/book/1 -d '{"title" : "Elasticsearch - The definitive guide","authors" : "Clinton Gormley","started" : "2013-02-04","pages" : 230}'
σʔλߋ৽31curl -XPUT localhost:9200/books/book/1 -d '{"title" : "Elasticsearch - The definitive guide","authors" : [ "Clinton Gormley", "Zachary Tong" ],"started" : "2013-02-04","pages" : 230}'
σʔλআ!32curl -X DELETE localhost:9200/books/book/1σʔλͷऔಘcurl —X GET localhost:9200/books/book/1curl —X GET localhost:9200/books/book/1/_source
ݕࡧ - Query DSL!33curl -XGET ‘localhost:9200/books/doc/_search' -d '{"query": {"bool": {"must": [{ "match": { "title": "Search" }},{ "match": { "content": "Elasticsearch" }}],"filter": [{ "term": { "status": "published" }},{ "range": { "publish_date": { "gte": "2015-01-01" }}}]}}}'
ࢄߏɺ εέʔϧ
γϟʔυͱϨϓϦΧ!35node 1ordersproducts141 223curl -X PUT localhost:9200/orders -d '{"settings.index.number_of_shards" : 4"settings.index.number_of_replicas" : 1}'curl -X PUT localhost:9200/products -d '{"settings.index.number_of_shards" : 2"settings.index.number_of_replicas" : 0}'
γϟʔυͱϨϓϦΧ!36node 1ordersproducts141node 2ordersproducts223 41 23
ࣗಈతͳࢄ!37node 1ordersproducts2141node 2ordersproducts22node 3ordersproducts3 413
!38
39KibanaWindow into the Elastic StackՄࢹԽͱੳ ཧۭؒ ΧελϚΠζͱϨϙʔτͷڞ༗άϥϑ୳ࡧ Elastic StackͷηΩϡΞͳΞΫηεͱཧΧελϜAppsͷ࡞
!40Kibana 6
!41Elastic StackͷߏBeatsLogFilesMetricsWireDatayour{beat}KibanaInstancesKafkaDistributedMessageQueueNotificationQueues Storage MetricsDataStoreWebAPIsSocial SensorsElasticsearchNodesLogstashNodes
!42ΞϓϦέʔγϣϯͷ ࢹϙΠϯτ
!43ࢹϙΠϯτ• ֎ܗࢹ• ϝτϦοΫʢϝτϦΫεʣ• αʔόʔɺΞϓϦέʔγϣϯ• ϩά• ΞϓϦέʔγϣϯͷϦϦʔελΠϛϯά• ࢄτϨʔγϯά
!44֎ܗࢹ• ࢮ׆ࢹ• ϓϩηε• HTTPαʔόʔ• TCP• ICMP
LightweightShipper forUptimeMonitoringHeartbeat
!46ϝτϦοΫ• αʔόʔ• CPUɺϝϞϦɺσΟεΫɺωοτϫʔΫI/Oɺϓϩηε• ΞϓϦέʔγϣϯ• ϦΫΤετɺίωΫγϣϯɺॲཧ࣌ؒ• ίϯςφʔ• ίϯςφ
Collect systemand applicationmetricsMetricbeat
lots of modulesMetricbeat
!49Metricbeat Ϟδϡʔϧ● Aerospike module● Apache module● Ceph module● Couchbase module● Docker module● Dropwizard module● Elasticsearch module● Etcd module● Golang module● Graphite module● HAProxy module● HTTP module● Jolokia module● Kafka module● Kibana module● Kubernetes module● kvm module● Logstash module● Memcached module● MongoDB module● Munin module● MySQL module● Nginx module●● PHP_FPM module● PostgreSQL module● Prometheus module● RabbitMQ module● Redis module● System module● uwsgi module● vSphere module● Windows module● ZooKeeper module
!50ϩά• ΞΫηεϩά• γεςϜϩά• ೝূϩά• εϩʔϩά• ΞϓϦέʔγϣϯϩά
tail log fromfileFilebeat
many modulesFilebeat
Filebeat modules - v6.4.2• Apache2 module• Auditd module• Icinga module• IIS module• Kafka module• Logstash module• MongoDB module• MySQL module• Nginx module• Osquery module• PostgreSQL module• Redis module• System module• Traefik module
Welcometo 1998winlogbeat
Nowwinlogbeat
Capture thePacketPacketbeat
!58ΞϓϦέʔγϣϯͷϦϦʔελΠϛϯά• όάϑΟοΫεϦϦʔε• ৽ػೳϦϦʔε• ৽αʔϏε։࢝• αʔόʔ૿ڧ
!59ࢄτϨʔγϯά• ϚΠΫϩαʔϏε• 1ͭͷϦΫΤετʹରͯ͠ෳͷϓϩηε͕ؔ• ΞϓϦέʔγϣϯύϑΥʔϚϯεϞχλϦϯάͷ1ͭ
!60
!61Elastic APM
Distributed TracingBeta | Basic (free)શͯͷܭଌ͞ΕͨαʔϏεΛݟΔͨΊͷ౷߹͞ΕͨϏϡʔαϒίϯςΩετͷτϨʔεʹભҠOpenTracing ޓ
!63ͦͷ΄͔ͷศརͳػೳ• Infra UI• Logs UI• Machine Learning• Alerting
Infrastructure SolutionBeta | Basic (free)ΠϯϑϥΦϖϨʔλʔ͚ʹಛԽΛ͑ΔΠϯϑϥͷߏΛ၆ᛌ,VCFSOFUFTɺ%PDLFSͷωΠςΟϒαϙʔτϝτϦοΫɺϩάɺ"1.Ϗϡʔͷ υϦϧɾμϯΞυϗοΫ͓ΑͼߏԽݕࡧ
Logs SolutionBeta | Basic (free)ϥΠϒͰϩάͷτϥϒϧγϡʔςΟϯάΛॿ͚ΔܰྔͳϩάϏϡʔΞʔίϯιʔϧͷΑ͏ͳදࣔUBJMGͷΑ͏ͳϥΠϒɾϩάɾετϦʔϛϯάཤྺϩάͷແݶεΫϩʔϧΞυϗοΫ͓ΑͼߏԽݕࡧ
!66
!67
!68
!69͞Βʹ׆༻͢Δʹʁ
!70
!71
ͦͷଞͷ͍ํ!72
!73σʔλͷొํ๏• Kibanaͷαϯϓϧσʔλʢ6.4͔Βʣ• LogstashͰJDBC input• LogstashͰCSV• FilebeatͰΞΫηεϩά• MetricbeatͰϝτϦοΫ• PacketbeatͰMySQL/PostgreSQLͷύέοτղੳ
!74Kibanaͷαϯϓϧσʔλʢ>= 6.4.0ʣ
!75ϫϯΫϦοΫͰσʔλొ
!76LogstashͰJDBC InputKibanaInstancesDataStoreElasticsearchNodesLogstashNodes
!77JDBC Input
!78LogstashͰCSVKibanaInstancesCSV FileElasticsearchNodesLogstashNodes
!79CSV filter
!80FilebeatͰΞΫηεϩάBeatsLogFilesKibanaInstancesElasticsearchNodes
• 2ͭͷElasticsearchϓϥάΠϯΛΠϯετʔϧͯ͠ElasticsearchΛىಈ• Filebeatͷapache2ϞδϡʔϧΛ༗ޮԽ• modules.d/apache2.ymlʹΞΫηεϩάͷύεΛઃఆ• setupίϚϯυΛ࣮ߦ͔ͯ͠ΒFilebeatΛىಈ!81FilebeatͰΞΫηεϩά
MetricbeatͰϝτϦοΫBeatsMetricsKibanaInstancesElasticsearchNodes
• MetricbeatͷsystemϞδϡʔϧΛ༗ޮԽ• setupίϚϯυΛ࣮ߦ͔ͯ͠ΒFilebeatΛىಈ!83MetricbeatͰϝτϦοΫ
!84PacketbeatͰMySQLɺPostgreSQLͷύέοτղੳBeatsWireDataKibanaInstancesElasticsearchNodes
!85ࢀߟจݙ• Elasticsearch - The Definitive guide‒ http://www.elastic.co/guide/en/elasticsearch/guide/current/index.html• ॻ੶ʢຊޠʣ‒ σʔλੳج൫ߏஙೖ‒ Elasticsearch࣮ફΨΠυ
!86ࢀߟจݙ• ೖ ࢹ ―ϞμϯͳϞχλϦϯάͷͨΊͷσβΠϯύλʔϯ Mike JulianɹஶɺদӜ ൏ਓɹ༁ https://www.oreilly.co.jp/books/9784873118642/
!87ࢀߟαΠτ• Ϣʔεέʔε• https://www.elastic.co/use-cases• DiscussʢWebϑΥʔϥϜʣ• https://discuss.elastic.co• Elastic{ON}ͷϏσΦͱࢿྉ• https://www.elastic.co/elasticon/videos• αϙʔτϝχϡʔ• https://www.elastic.co/subscriptions
Thank you!● Web : https://www.elastic.co/jp/● Forums : https://discuss.elastic.co/● Twitter : @johtani
johtani
mochico
mtyk_15
takumakume
yokawasa
hacomono
bkuhlmann
yukihiromori
igsr5
yusuke
nktamago
adavis
wernerkrauss
quramy
dougneiner
62gerente
destraynor
brettharned
bkeepers
3n
chriscoyier
edds
colly
trishagee
roundedbygravity