システムメトリクス・ログのリアルタイム解析入門 - Elastic Stackを活用して -

OSC広島2017で使用した資料になります。

Transcript

1. ‹#›
   2017/11/25
   Evangelist at Elastic
   Jun Ohtani @johtani
   γεςϜϝτϦΫεɾϩάͷϦΞϧλΠϜ
   ղੳೖ໳ - Elastic StackΛ׆༻ͯ͠ -
   

   View Slide

2. ‹#›
   

   View Slide

3. ΞδΣϯμ
   • γεςϜϝτϦΫεղੳɺϩάղੳΛࢼ͠ʹ΍ͬͯΈΑ͏
   • Beats - Elasticsearch - KibanaͰղੳ
   • ຊ֨తʹղੳΛ΍Δʹ͸ʁ
   • LogstashͰϩάΛதܧɾू໿
   • ͞Βʹ৭ʑࢼͯ͠ΈΔʹ͸ʁ
   • ঎༻ϓϥάΠϯ঺հ
   3
   

   View Slide

4. about
   • Me, Jun Ohtani / Technical Advocate
   ‒ lucene-gosenίϛολʔ
   ‒ ElasticSearch Server೔ຊޠ൛ͷ຋༁
   ‒ http://blog.johtani.info

   • Elasticsearch, founded in 2012
   ‒ Products: Elasticsearch, Logstash, Kibana, Beats 

   X-Pack, Elastic Cloud

   Professional services: Support & development subscriptions
   ‒ Trainings, Consulting, SaaS
   4
   

   View Slide

5. 5
   ElasticελοΫ
   

   View Slide

6. ElasticελοΫʢOpen Sourceʣ
   6
   Kibana
   
   
   
   Elasticsearch
   
   
   
   Logstash Beats
   

   View Slide

7. ElasticελοΫ
   7
   Elastic Cloud
   
   
   
   
   
   X-Pack
   Kibana
   
   
   Elasticsearch
   !
   "
   Logstash Beats
   +
   

   View Slide

8. ϝτϦΫε/ϩάղੳΛ
   ࢝ΊͯΈΑ͏
   

   View Slide

9. ϝτϦΫεɾϩάͷ෼ੳʢ؆қ൛ʣ
   9
   σʔλ Import Parse/

   Store/Search
   Visualize
   

   View Slide

10. ܰྔσʔλγούʔ
    10
    Beats
    

    View Slide

11. 11
    Beats
    ܰྔσʔλγούʔ
    ιʔε͔ΒσʔλΛసૹ సૹ͠Elsaticsearchʹू໿ ม׵ͱύʔεͷͨΊ
    Logstashʹసૹ
    Elastic Cloudʹసૹ
    Libbeat: ΧελϜbeatsͷͨ
    ΊͷAPIϑϨʔϜϫʔΫ
    30Ҏ্ͷίϛϡχςΟbeats
    

    View Slide

12. 12
    FILEBEAT
    ϩάϑΝΠϧ
    METRICBEAT
    ϝτϦοΫ৘ใ
    PACKETBEAT
    ωοτϫʔΫ
    WINGLOGBEAT
    WindowΠϕϯτ
    ͞Βʹ30Λ௒͑ΔίϛϡχςΟ
    Beats͕͋Γɺ૿Ճத
    Apachebeat, dockbeat, httpbeat,
    mysqlbeat, nginxbeat, redis beats,
    twitterbeat, and more
    

    View Slide

13. Collect system
    and application
    metrics
    Metricbeat
    

    View Slide

14. lots of modules
    Metricbeat
    

    View Slide

15. tail log from
    file
    Filebeat
    

    View Slide

16. many modules
    Filebeat
    

    View Slide

17. Capture the
    Packet
    Packetbeat
    

    View Slide

18. Capture the
    Packet
    Packetbeat
    

    View Slide

19. Welcome
    to 1998
    winlogbeat
    

    View Slide

20. Now
    winlogbeat
    

    View Slide

21. 21
    Elasticsearch
    

    View Slide

22. ݕࡧͱͯ͠ͷ

    Elasticsearch
    

    View Slide

23. Elasticsearchͱ͸ʁ
    

    View Slide

24. ϑϦʔϫʔυݕࡧ
    24
    

    View Slide

25. ߜΓࠐΈ
    25
    

    View Slide

26. ϋΠϥΠτ
    26
    

    View Slide

27. ιʔτ
    27
    

    View Slide

28. ϖʔδϯά
    28
    

    View Slide

29. ूܭ
    29
    

    View Slide

30. αδΣετ
    30
    

    View Slide

31. Elasticsearch in 10 seconds
    • εΩʔϚϑϦʔɺ෼ࢄυΩϡϝϯτετΞɺREST & JSON
    • Φʔϓϯιʔε: Apache License 2.0
    • ઃఆͳ͠Ͱ؆୯ʹࢼ͢͜ͱ͕Մೳ
    • JavaͰ࣮૷ɻ֦ு΋༰қ
    31
    

    View Slide

32. Powerful Search at Scale
    32
    

    View Slide

33. ؆୯ͳCRUD
    

    View Slide

34. σʔλొ࿥
    34
    curl -XPUT localhost:9200/books/book/1 -d '
    {
    "title" : "Elasticsearch - The definitive guide",
    "authors" : "Clinton Gormley",
    "started" : "2013-02-04",
    "pages" : 230
    }'
    

    View Slide

35. σʔλߋ৽
    35
    curl -XPUT localhost:9200/books/book/1 -d '
    {
    "title" : "Elasticsearch - The definitive guide",
    "authors" : [ "Clinton Gormley", "Zachary Tong" ],
    "started" : "2013-02-04",
    "pages" : 230
    }'
    

    View Slide

36. σʔλ࡟আ
    36
    curl -X DELETE localhost:9200/books/book/1
    σʔλͷऔಘ
    curl —X GET localhost:9200/books/book/1
    curl —X GET localhost:9200/books/book/1/_source
    

    View Slide

37. ݕࡧ
    37
    curl -XGET localhost:9200/books/_search?q=elasticsearch
    {
    "took" : 2, "timed_out" : false,
    "_shards" : { "total" : 5, "successful" : 5, "failed" : 0 },
    "hits" : {
    "total" : 1, "max_score" : 0.076713204,
    "hits" : [ {
    "_index" : “books", "_type" : “book", "_id" : "1",
    "_score" : 0.076713204, "_source" : {
    "title" : "Elasticsearch - The definitive guide",
    "authors" : [ "Clinton Gormley", "Zachary Tong" ],
    "started" : “2013-02-04", "pages" : 230
    }
    } ]
    

    View Slide

38. ݕࡧ - Query DSL
    38
    curl -XGET ‘localhost:9200/books/book/_search' -d '{
    "query": {
    "filtered" : {
    "query" : {
    "match": {
    "text" : {
    "query" : “To Be Or Not To Be",
    "cutoff_frequency" : 0.01
    }
    }
    },
    "filter" : {
    "range": {
    "price": {
    "gte": 20.0
    "lte": 50.0
    

    View Slide

39. ෼ࢄߏ੒ɺ

    εέʔϧ
    

    View Slide

40. Basic terms
    • ΠϯσοΫε
    ‒ σʔλͷ࿦ཧతͳू߹ɻ

    RDBͷσʔλϕʔεͷΑ͏ͳ΋ͷLogical
    • ϨϓϦέʔγϣϯ
    • ಡΈࠐΈͷεέʔϥϏϦςΟ޲্
    • SPOFͷղফ
    • γϟʔσΟϯά
    • ෳ਺Ϛγϯ΁σʔλΛ෼ׂ

    ॻ͖ࠐΈͷεέʔϥϏϦςΟ޲্

    σʔλϑϩʔ੍ޚ
    40
    

    View Slide

41. γϟʔυͱϨϓϦΧ
    41
    node 1
    orders
    products
    1
    4
    1 2
    2
    3
    curl -X PUT localhost:9200/orders -d '{
    "settings.index.number_of_shards" : 4
    "settings.index.number_of_replicas" : 1
    }'
    curl -X PUT localhost:9200/products -d '{
    "settings.index.number_of_shards" : 2
    "settings.index.number_of_replicas" : 0
    }'
    

    View Slide

42. γϟʔυͱϨϓϦΧ
    42
    node 1
    orders
    products
    1
    4
    1
    node 2
    orders
    products
    2
    2
    3 4
    1 2
    3
    

    View Slide

43. ࣗಈతͳ෼ࢄ
    43
    node 1
    orders
    products
    2
    1
    4
    1
    node 2
    orders
    products
    2
    2
    node 3
    orders
    products
    3 4
    1
    3
    

    View Slide

44. શจݕࡧͱ͸ʁ
    

    View Slide

45. શจݕࡧͱ͸ʁ
    • શจݕࡧʢFull text searchʣͱ͸ɺίϯϐϡʔλʹ͓͍ͯɺෳ਺ͷจॻ
    ʢϑΝΠϧʣ͔ΒಛఆͷจࣈྻΛݕࡧ͢Δ͜ͱɻʮϑΝΠϧ໊ݕࡧʯ΍
    ʮ୯ҰϑΝΠϧ಺ͷจࣈྻݕࡧʯͱҟͳΓɺʮෳ਺จॻʹ·͕ͨͬͯɺจ
    ॻʹؚ·ΕΔશจΛର৅ͱͨ͠ݕࡧʯͱ͍͏ҙຯͰ࢖༻͞ΕΔɻ

    ʢWikipediaΑΓʣ
    45
    

    View Slide

46. ༻ޠ
    • ΠϯσοΫε
    ݕࡧΤϯδϯ͕ݕࡧʹ࢖༻͢Δσʔλͷอଘઌ
    • υΩϡϝϯτʢจॻʣ
    ‒ ݕࡧΤϯδϯʹอଘ͞Εͨσʔλ
    • ϑΟʔϧυ
    ‒ υΩϡϝϯτʹؚ·ΕΔଐੑ
    • ΫΤϦ
    ‒ ݕࡧ৚݅ɺݕࡧࣜ
    46
    

    View Slide

47. ༻ޠ
    • εΩʔϚ
    ‒ υΩϡϝϯτͷߏ଄Λఆٛ͢Δ΋ͷ
    • λʔϜʢTermʣɺτʔΫϯʢTokenʣ
    ‒ ΠϯσοΫεͷΩʔʹͳΔ୯ޠʢจࣈྻʣ
    ‒ จষΛҰఆͷ๏ଇͰ۠੾ͬͨ୯ޠ
    ‒ ୯ޠ͚ͩͰͳ͘ɺ୯ޠͷҐஔͳͲ΋ؚΉ
    47
    

    View Slide

48. υΩϡϝϯτͷొ࿥
    48
    1
    2
    ΧπΦ͸αβΤͷఋ
    αβΤ͸ϫΧϝͷ࢞
    υΩϡϝϯτͷొ࿥
    

    View Slide

49. υΩϡϝϯτͷొ࿥
    49
    1
    2
    ΧπΦ͸αβΤͷఋ
    αβΤ͸ϫΧϝͷ࢞
    1
    2
    ΧπΦ
    αβΤ
    ͸
    ͸
    ͷ
    ͷ
    αβΤ
    ϫΧϝ
    ఋ
    ࢞
    υΩϡϝϯτͷొ࿥
    ୯ޠʹ෼ׂ
    

    View Slide

50. υΩϡϝϯτͷొ࿥
    50
    1
    2
    ΧπΦ͸αβΤͷఋ
    αβΤ͸ϫΧϝͷ࢞
    1
    2
    ΧπΦ
    αβΤ
    ͸
    ͸
    ͷ
    ͷ
    αβΤ
    ϫΧϝ
    ఋ
    ࢞
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ
    ࢞
    ϫΧϝ 2
    1 2
    1 2
    1
    ఋ
    2
    υΩϡϝϯτͷొ࿥
    ୯ޠʹ෼ׂ
    ୯ޠ͔Βidͷ഑ྻ͕
    Ҿ͚ΔΑ͏ʹ
    

    View Slide

51. ݕࡧ
    51
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ
    ࢞
    ϫΧϝ 2
    1 2
    1 2
    1
    ఋ
    2
    ݕࡧ৚݅ೖྗ
    ΧπΦɹαβΤ
    

    View Slide

52. ݕࡧ
    52
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ
    ࢞
    ϫΧϝ 2
    1 2
    1 2
    1
    ఋ
    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ
    

    View Slide

53. ݕࡧ
    53
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ
    ࢞
    ϫΧϝ 2
    1 2
    1 2
    1
    ఋ
    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ
    

    View Slide

54. ݕࡧ
    54
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ
    ࢞
    ϫΧϝ 2
    1 2
    1 2
    1
    ఋ
    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ
    

    View Slide

55. ݕࡧ
    55
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ
    ࢞
    ϫΧϝ 2
    1 2
    1 2
    1
    ఋ
    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ
    

    View Slide

56. ݕࡧ
    56
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ
    ࢞
    ϫΧϝ 2
    1 2
    1 2
    1
    ఋ
    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ
    

    View Slide

57. ݕࡧ
    57
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ
    ࢞
    ϫΧϝ 2
    1 2
    1 2
    1
    ఋ
    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ
    

    View Slide

58. ୯ޠͷ۠੾Γํ
    • ӳޠͷ৔߹
    I am speaking Introduction Elasticsearch.
    

    

    • ೔ຊޠͷ৔߹
    ࢲ͸ೖ໳Elasticsearchʹ͍ͭͯ࿩͍ͯ͠Δɻ

    

    58
    

    View Slide

59. ୯ޠͷ۠੾Γํ
    • ӳޠͷ৔߹
    I am speaking Introduction Elasticsearch.
    

    

    εϖʔε͕੾Ε໨ͱΘ͔Δ
    • ೔ຊޠͷ৔߹
    ࢲ͸ೖ໳Elasticsearchʹ͍ͭͯ࿩͍ͯ͠Δɻ

    Ͳ͜Ͱ۠੾Ε͹Α͍ʁ
    59
    

    View Slide

60. N-Gramͱܗଶૉղੳ
    • సஔΠϯσοΫεͷΩʔͷ࡞Γํ
    ‒ ೔ຊޠ͸୯ޠͷ੾Ε໨͕Θ͔Βͳ͍ͷͰɺసஔΠϯσοΫεͷΩʔ͸
    ओʹ࣍ͷ̎ͭͷख๏Ͱ࡞੒
    • N-Gram
    ‒ NจࣈͣͭจষΛ۠੾Δ
    • ܗଶૉղੳ
    ‒ ࣙॻͳͲΛ༻͍ͯҙຯͷ͋Δ୯ޠͰ۠੾Δ
    60
    

    View Slide

61. ܗଶૉղੳ
    • ϝϦοτɿ
    ‒ ҙຯͷ͋Δ୯ޠͷ੾Ε໨

    ඼ࢺ৘ใΛݩʹ௥Ճॲཧ͕Մೳʢޠװม׵ͳͲʣ
    • σϝϦοτɿ
    ‒ ৽ޠʢະ஌ޠʣʹऑ͍→ࣙॻϕʔεͷ৔߹ɺࣙॻʹͳ͍୯ޠ͸ݕग़ෆ
    ೳɻ
    61
    ΧπΦ͸αβΤͷఋ
    ΧπΦ ͸ ͷ
    αβΤ ఋ
    

    View Slide

62. N-Gram
    • ϝϦοτɿ
    ‒ ະ஌ޠʹରԠՄೳ
    • σϝϦοτɿ
    ‒ ΠϯσοΫεංେԽ
    ‒ ඼ࢺ৘ใʹجͮ͘ॲཧ͕ෆՄೳ
    62
    ΧπΦ͸αβΤͷఋ
    Χπ πΦ Φ͸ ͸α αβ βΤ Τͷ ͷఋ
    

    View Slide

63. ͦͷଞͷػೳ
    

    View Slide

64. elasticsearch
    ͞·͟·ͳܗࣜͷσʔλͰ
    GeoݕࡧՄೳ

    

    Ң౓ܦ౓ɺGeoHashɺ
    GeoShape…
    GEO
    

    View Slide

65. Ecosystem
    • Plugins
    ‒ ϓϥάΠϯʹΑΔػೳͷ௥Ճ
    • ΫϥΠΞϯτϥΠϒϥϦ
    • Java, Ruby, python, php, perl, javascript, .NET
    • Scala, clojure, go
    65
    

    View Slide

66. Elasticsearch - The Definitive guide

    

    http://www.elastic.co/guide/en/
    elasticsearch/guide/current/index.html
    66
    ৄ͘͠஌Γ͍ͨํ͸
    

    View Slide

67. ղੳͱͯ͠ͷElasticsearch
    

    View Slide

68. aggregation
    

    View Slide

69. Aggregationͱ͸
    • 1.0͔Βಋೖ
    • FacetΑΓ΋ڧྗͳूܭͳͲ͕Մೳ
    • ֊૚తͳूܭɺάϧʔϓԽ

    ಈతͳूܭɺάϧʔϓԽ
    • େ͖͘2छྨ
    • BucketɹυΩϡϝϯτΛ஋͝ͱʹ݁ՌΛάϧʔϐϯά
    • Metricɹ υΩϡϝϯτͷ࣋ͭ஋Λूܭ
    69
    

    View Slide

70. ྫɿݴޠ͓Αͼ஍Ҭͷूܭ
    70
    curl -XGET twitter-2014.08.22/_search -d '
    {
    "aggs": {
    "lang": {
    "terms": {"field": "lang" },
    "aggs": {
    "place": {
    "terms": {
    "field": “place.full_name", "size": 10
    }
    }
    }
    }
    }
    }
    

    View Slide

71. ྫɿݴޠ͓Αͼ஍Ҭͷूܭ
    71
    "aggregations": {
    "lang": {
    "buckets": [{…}, {
    "key": "ja",
    "doc_count": 980145,
    "place": {
    "buckets": [
    { "key": "ژ౎ࢢ෬ݟ۠, ژ౎",
    "doc_count":252 },
    { "key": "ઍ୅ా۠, ౦ژ",
    "doc_count": 39 },…
    

    View Slide

72. 72
    KibanaͰՄࢹԽ
    

    View Slide

73. Kibana 5
    • ElasticsearchͷσʔλΛՄࢹԽ
    • Node.js server & JavaScript
    • Apache License 2.0
    • Elastic Stackͷ૭ͷ໾ׂ
    • ༷ʑͳGUIΛPluginͱ͍ͯެ։
    • MarvelɺSenseɺTimelionͳͲ
    73
    

    View Slide

74. Kibana 5
    74
    

    View Slide

75. Combining Search and Analytics
    75
    

    View Slide

76. σϞ for Kibana5
    Access Log
    76
    

    View Slide

77. ຊ֨తʹղੳΛߦ͏ʹ͸ʁ
    

    View Slide

78. View Slide

79. 79
    Logstash
    

    View Slide

80. Logstash in 10 seconds
    • ϩάɾσʔλͷऩूɾ؅ཧ
    • ऩूɺύʔεɾՃ޻ɺૹग़
    • ΦʔϓϯιʔεɿApache License 2.0
    • Ruby app (JRuby)
    80
    

    View Slide

81. Logstash architecture
    81
    Input Output
    Filter
    ? ?
    collect and split alter and enrich store and visualize
    

    View Slide

82. ઃఆ
    82
    input {
    …
    }
    filter {
    …
    }
    output {
    …
    }
    

    View Slide

83. ઃఆɿinput
    83
    input {
    file {
    path => “/Users/johtani/sample/*_log"
    start_position => "beginning"
    }
    }
    

    View Slide

84. 1ߦ1σʔλ
    189.120.xx.xx - - [02/Dec/2014:12:18:29 +0900] "GET /manager/html HTTP/
    1.1" 404 274 "-" "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101
    Firefox/5.0"
    84
    

    View Slide

85. ઃఆɿfilter
    85
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }
    

    View Slide

86. ύʔε
    86
    189.120.xx.xx - - [02/Dec/2014:12:18:29 +0900] "GET /manager/html HTTP/1.1"
    404 274 "-" "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0"
    {…
    "@timestamp": "2015-04-10T09:07:49.325Z",
    "clientip": "189.120.xx.xx",
    "ident": "-",
    "auth": "-",
    "timestamp": "02/Dec/2014:12:18:29 +0900",
    "verb": "GET",
    "request": "/manager/html",
    …
    "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/
    

    View Slide

87. ઃఆɿfilter
    87
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }
    

    View Slide

88. ೔෇ͷύʔε
    88
    {…
    "@timestamp": "2015-04-10T09:07:49.325Z",
    …
    "timestamp": "02/Dec/2014:12:18:29 +0900",
    …
    }
    {…
    "@timestamp": "2014-12-02T03:18:29.000Z",
    …
    "timestamp": "02/Dec/2014:12:18:29 +0900",
    …
    }
    

    View Slide

89. ઃఆɿfilter
    89
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }
    

    View Slide

90. IP͔ΒҢ౓ܦ౓ͳͲ෇༩
    90
    "clientip": "189.120.xx.xx",
    "clientip": "189.120.xx.xx",
    "geoip": {
    "ip": “189.120.xxx.xxx”,
    …
    "country_name": "Brazil",
    "continent_code": "SA",
    "region_name": "27",
    "city_name": "São Paulo",
    "latitude":
    

    View Slide

91. ઃఆɿfilter
    91
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }
    

    View Slide

92. ϢʔβΤʔδΣϯτͷύʔε
    92
    "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv:
    5.0) Gecko/20100101 Firefox/5.0\""
    "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv:
    5.0) Gecko/20100101 Firefox/5.0\""
    "useragent": {
    "name": "Firefox",
    "os": "Windows XP",
    "os_name": "Windows XP",
    "device": "Other",
    "major": "5",
    "minor": "0"
    

    View Slide

93. ઃఆɿoutput
    93
    output {
    elasticsearch {
    hosts => ["localhost"]
    index => “demo_access_log-%{+YYYY.MM.dd}”
    }
    }
    

    View Slide

94. ͞Βʹ׆༻͢Δʹ͸ʁ
    

    View Slide

95. elasticsearch-hadoop
    95
    -
    •  D E H
    •  PD ecd
    ER
    •  g D
    • 
    CH
    •  Ca M DMS
    D FERC
    

    View Slide

96. 96
    X-Pack
    ؆୯ʹΠϯετʔϧ
    Elastic StackΛ֦ு
    αϒεΫϦϓγϣϯʹؚ·ΕΔ
    Security
    Alerting
    Monitoring
    Reporting
    Graph
    Machine Learning
    

    View Slide

97. 97
    Elastic Cloud
    Elasticsearch, Kibanaͷ
    ϚωʔδυαʔϏε
    X-Packͷػೳ΋ར༻Մೳ
    Available in AWS today
    

    View Slide

98. View Slide

99. 99
    Elastic Cloud
    Enterprise
    ෳ਺ͷElastic Stack؀ڥΛࣗࡏʹ࡞੒
    Logging as a serviceΛࣗ૊৫ʹల։
    Public beta; Expected GA Q1 2017
    

    View Slide

100. ࢀߟจݙ
     • Elasticsearch - The Definitive guide
     ‒ http://www.elastic.co/guide/en/elasticsearch/guide/current/index.html
     • ॻ੶ʢ೔ຊޠʣ
     ‒ ElasticSearchServer೔ຊޠ൛
     ‒ αʔό/ΠϯϑϥΤϯδχΞ

     ɹཆ੒ಡຊɹϩάऩू
     100
     

     View Slide

101. ࢀߟจݙ
     • Elasticsearch - The Definitive guide
     ‒ http://www.elastic.co/guide/en/elasticsearch/guide/current/index.html
     • ॻ੶ʢ೔ຊޠʣ
     ‒ ElasticSearchServer೔ຊޠ൛
     ‒ αʔό/ΠϯϑϥΤϯδχΞ

     ɹཆ੒ಡຊɹϩάऩू
     101
     

     View Slide

102. ࢀߟจݙ
     • Elasticsearch - The Definitive guide
     ‒ http://www.elastic.co/guide/en/elasticsearch/guide/current/index.html
     • ॻ੶ʢ೔ຊޠʣ
     ‒ ElasticSearchServer೔ຊޠ൛
     ‒ σʔλ෼ੳج൫ߏஙೖ໳

     2017೥9݄21೔ൃച
     102
     

     View Slide

103. ࢀߟαΠτ
     • Ϣʔεέʔε
     • https://www.elastic.co/use-cases
     • DiscussʢWebϑΥʔϥϜʣ
     • https://discuss.elastic.co
     • Elastic{ON}ͷϏσΦͱࢿྉ
     • https://www.elastic.co/elasticon/videos
     • αϙʔτϝχϡʔ
     • https://www.elastic.co/subscriptions
     103
     

     View Slide

104. Thanks for listening!
     Q & A
     We’re hiring!
     https://www.elastic.co/about/careers/
     We’re helping!
     https://www.elastic.co/subscriptions
     http://training.elastic.co
     

     View Slide