$30 off During Our Annual Pro Sale. View Details »

システムメトリクス・ログのリアルタイム解析入門 - Elastic Stackを活用して -

Jun Ohtani
November 26, 2017

システムメトリクス・ログのリアルタイム解析入門 - Elastic Stackを活用して -

OSC広島2017で使用した資料になります。

Jun Ohtani

November 26, 2017
Tweet

More Decks by Jun Ohtani

Other Decks in Technology

Transcript

  1. ‹#›
    2017/11/25
    Evangelist at Elastic
    Jun Ohtani @johtani
    γεςϜϝτϦΫεɾϩάͷϦΞϧλΠϜ
    ղੳೖ໳ - Elastic StackΛ׆༻ͯ͠ -

    View Slide

  2. ‹#›

    View Slide

  3. ΞδΣϯμ
    • γεςϜϝτϦΫεղੳɺϩάղੳΛࢼ͠ʹ΍ͬͯΈΑ͏
    • Beats - Elasticsearch - KibanaͰղੳ
    • ຊ֨తʹղੳΛ΍Δʹ͸ʁ
    • LogstashͰϩάΛதܧɾू໿
    • ͞Βʹ৭ʑࢼͯ͠ΈΔʹ͸ʁ
    • ঎༻ϓϥάΠϯ঺հ
    3

    View Slide

  4. about
    • Me, Jun Ohtani / Technical Advocate
    ‒ lucene-gosenίϛολʔ
    ‒ ElasticSearch Server೔ຊޠ൛ͷ຋༁
    ‒ http://blog.johtani.info

    • Elasticsearch, founded in 2012
    ‒ Products: Elasticsearch, Logstash, Kibana, Beats 

    X-Pack, Elastic Cloud

    Professional services: Support & development subscriptions
    ‒ Trainings, Consulting, SaaS
    4

    View Slide

  5. 5
    ElasticελοΫ

    View Slide

  6. ElasticελοΫʢOpen Sourceʣ
    6
    Kibana



    Elasticsearch



    Logstash Beats

    View Slide

  7. ElasticελοΫ
    7
    Elastic Cloud





    X-Pack
    Kibana


    Elasticsearch
    !
    "
    Logstash Beats
    +

    View Slide

  8. ϝτϦΫε/ϩάղੳΛ
    ࢝ΊͯΈΑ͏

    View Slide

  9. ϝτϦΫεɾϩάͷ෼ੳʢ؆қ൛ʣ
    9
    σʔλ Import Parse/

    Store/Search
    Visualize

    View Slide

  10. ܰྔσʔλγούʔ
    10
    Beats

    View Slide

  11. 11
    Beats
    ܰྔσʔλγούʔ
    ιʔε͔ΒσʔλΛసૹ సૹ͠Elsaticsearchʹू໿ ม׵ͱύʔεͷͨΊ
    Logstashʹసૹ
    Elastic Cloudʹసૹ
    Libbeat: ΧελϜbeatsͷͨ
    ΊͷAPIϑϨʔϜϫʔΫ
    30Ҏ্ͷίϛϡχςΟbeats

    View Slide

  12. 12
    FILEBEAT
    ϩάϑΝΠϧ
    METRICBEAT
    ϝτϦοΫ৘ใ
    PACKETBEAT
    ωοτϫʔΫ
    WINGLOGBEAT
    WindowΠϕϯτ
    ͞Βʹ30Λ௒͑ΔίϛϡχςΟ
    Beats͕͋Γɺ૿Ճத
    Apachebeat, dockbeat, httpbeat,
    mysqlbeat, nginxbeat, redis beats,
    twitterbeat, and more

    View Slide

  13. Collect system
    and application
    metrics
    Metricbeat

    View Slide

  14. lots of modules
    Metricbeat

    View Slide

  15. tail log from
    file
    Filebeat

    View Slide

  16. many modules
    Filebeat

    View Slide

  17. Capture the
    Packet
    Packetbeat

    View Slide

  18. Capture the
    Packet
    Packetbeat

    View Slide

  19. Welcome
    to 1998
    winlogbeat

    View Slide

  20. Now
    winlogbeat

    View Slide

  21. 21
    Elasticsearch

    View Slide

  22. ݕࡧͱͯ͠ͷ

    Elasticsearch

    View Slide

  23. Elasticsearchͱ͸ʁ

    View Slide

  24. ϑϦʔϫʔυݕࡧ
    24

    View Slide

  25. ߜΓࠐΈ
    25

    View Slide

  26. ϋΠϥΠτ
    26

    View Slide

  27. ιʔτ
    27

    View Slide

  28. ϖʔδϯά
    28

    View Slide

  29. ूܭ
    29

    View Slide

  30. αδΣετ
    30

    View Slide

  31. Elasticsearch in 10 seconds
    • εΩʔϚϑϦʔɺ෼ࢄυΩϡϝϯτετΞɺREST & JSON
    • Φʔϓϯιʔε: Apache License 2.0
    • ઃఆͳ͠Ͱ؆୯ʹࢼ͢͜ͱ͕Մೳ
    • JavaͰ࣮૷ɻ֦ு΋༰қ
    31

    View Slide

  32. Powerful Search at Scale
    32

    View Slide

  33. ؆୯ͳCRUD

    View Slide

  34. σʔλొ࿥
    34
    curl -XPUT localhost:9200/books/book/1 -d '
    {
    "title" : "Elasticsearch - The definitive guide",
    "authors" : "Clinton Gormley",
    "started" : "2013-02-04",
    "pages" : 230
    }'

    View Slide

  35. σʔλߋ৽
    35
    curl -XPUT localhost:9200/books/book/1 -d '
    {
    "title" : "Elasticsearch - The definitive guide",
    "authors" : [ "Clinton Gormley", "Zachary Tong" ],
    "started" : "2013-02-04",
    "pages" : 230
    }'

    View Slide

  36. σʔλ࡟আ
    36
    curl -X DELETE localhost:9200/books/book/1
    σʔλͷऔಘ
    curl —X GET localhost:9200/books/book/1
    curl —X GET localhost:9200/books/book/1/_source

    View Slide

  37. ݕࡧ
    37
    curl -XGET localhost:9200/books/_search?q=elasticsearch
    {
    "took" : 2, "timed_out" : false,
    "_shards" : { "total" : 5, "successful" : 5, "failed" : 0 },
    "hits" : {
    "total" : 1, "max_score" : 0.076713204,
    "hits" : [ {
    "_index" : “books", "_type" : “book", "_id" : "1",
    "_score" : 0.076713204, "_source" : {
    "title" : "Elasticsearch - The definitive guide",
    "authors" : [ "Clinton Gormley", "Zachary Tong" ],
    "started" : “2013-02-04", "pages" : 230
    }
    } ]

    View Slide

  38. ݕࡧ - Query DSL
    38
    curl -XGET ‘localhost:9200/books/book/_search' -d '{
    "query": {
    "filtered" : {
    "query" : {
    "match": {
    "text" : {
    "query" : “To Be Or Not To Be",
    "cutoff_frequency" : 0.01
    }
    }
    },
    "filter" : {
    "range": {
    "price": {
    "gte": 20.0
    "lte": 50.0

    View Slide

  39. ෼ࢄߏ੒ɺ

    εέʔϧ

    View Slide

  40. Basic terms
    • ΠϯσοΫε
    ‒ σʔλͷ࿦ཧతͳू߹ɻ

    RDBͷσʔλϕʔεͷΑ͏ͳ΋ͷLogical
    • ϨϓϦέʔγϣϯ
    • ಡΈࠐΈͷεέʔϥϏϦςΟ޲্
    • SPOFͷղফ
    • γϟʔσΟϯά
    • ෳ਺Ϛγϯ΁σʔλΛ෼ׂ

    ॻ͖ࠐΈͷεέʔϥϏϦςΟ޲্

    σʔλϑϩʔ੍ޚ
    40

    View Slide

  41. γϟʔυͱϨϓϦΧ
    41
    node 1
    orders
    products
    1
    4
    1 2
    2
    3
    curl -X PUT localhost:9200/orders -d '{
    "settings.index.number_of_shards" : 4
    "settings.index.number_of_replicas" : 1
    }'
    curl -X PUT localhost:9200/products -d '{
    "settings.index.number_of_shards" : 2
    "settings.index.number_of_replicas" : 0
    }'

    View Slide

  42. γϟʔυͱϨϓϦΧ
    42
    node 1
    orders
    products
    1
    4
    1
    node 2
    orders
    products
    2
    2
    3 4
    1 2
    3

    View Slide

  43. ࣗಈతͳ෼ࢄ
    43
    node 1
    orders
    products
    2
    1
    4
    1
    node 2
    orders
    products
    2
    2
    node 3
    orders
    products
    3 4
    1
    3

    View Slide

  44. શจݕࡧͱ͸ʁ

    View Slide

  45. શจݕࡧͱ͸ʁ
    • શจݕࡧʢFull text searchʣͱ͸ɺίϯϐϡʔλʹ͓͍ͯɺෳ਺ͷจॻ
    ʢϑΝΠϧʣ͔ΒಛఆͷจࣈྻΛݕࡧ͢Δ͜ͱɻʮϑΝΠϧ໊ݕࡧʯ΍
    ʮ୯ҰϑΝΠϧ಺ͷจࣈྻݕࡧʯͱҟͳΓɺʮෳ਺จॻʹ·͕ͨͬͯɺจ
    ॻʹؚ·ΕΔશจΛର৅ͱͨ͠ݕࡧʯͱ͍͏ҙຯͰ࢖༻͞ΕΔɻ

    ʢWikipediaΑΓʣ
    45

    View Slide

  46. ༻ޠ
    • ΠϯσοΫε
    ݕࡧΤϯδϯ͕ݕࡧʹ࢖༻͢Δσʔλͷอଘઌ
    • υΩϡϝϯτʢจॻʣ
    ‒ ݕࡧΤϯδϯʹอଘ͞Εͨσʔλ
    • ϑΟʔϧυ
    ‒ υΩϡϝϯτʹؚ·ΕΔଐੑ
    • ΫΤϦ
    ‒ ݕࡧ৚݅ɺݕࡧࣜ
    46

    View Slide

  47. ༻ޠ
    • εΩʔϚ
    ‒ υΩϡϝϯτͷߏ଄Λఆٛ͢Δ΋ͷ
    • λʔϜʢTermʣɺτʔΫϯʢTokenʣ
    ‒ ΠϯσοΫεͷΩʔʹͳΔ୯ޠʢจࣈྻʣ
    ‒ จষΛҰఆͷ๏ଇͰ۠੾ͬͨ୯ޠ
    ‒ ୯ޠ͚ͩͰͳ͘ɺ୯ޠͷҐஔͳͲ΋ؚΉ
    47

    View Slide

  48. υΩϡϝϯτͷొ࿥
    48
    1
    2
    ΧπΦ͸αβΤͷఋ
    αβΤ͸ϫΧϝͷ࢞
    υΩϡϝϯτͷొ࿥

    View Slide

  49. υΩϡϝϯτͷొ࿥
    49
    1
    2
    ΧπΦ͸αβΤͷఋ
    αβΤ͸ϫΧϝͷ࢞
    1
    2
    ΧπΦ
    αβΤ
    ͸
    ͸
    ͷ
    ͷ
    αβΤ
    ϫΧϝ


    υΩϡϝϯτͷొ࿥
    ୯ޠʹ෼ׂ

    View Slide

  50. υΩϡϝϯτͷొ࿥
    50
    1
    2
    ΧπΦ͸αβΤͷఋ
    αβΤ͸ϫΧϝͷ࢞
    1
    2
    ΧπΦ
    αβΤ
    ͸
    ͸
    ͷ
    ͷ
    αβΤ
    ϫΧϝ


    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ

    ϫΧϝ 2
    1 2
    1 2
    1

    2
    υΩϡϝϯτͷొ࿥
    ୯ޠʹ෼ׂ
    ୯ޠ͔Βidͷ഑ྻ͕
    Ҿ͚ΔΑ͏ʹ

    View Slide

  51. ݕࡧ
    51
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ

    ϫΧϝ 2
    1 2
    1 2
    1

    2
    ݕࡧ৚݅ೖྗ
    ΧπΦɹαβΤ

    View Slide

  52. ݕࡧ
    52
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ

    ϫΧϝ 2
    1 2
    1 2
    1

    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ

    View Slide

  53. ݕࡧ
    53
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ

    ϫΧϝ 2
    1 2
    1 2
    1

    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ

    View Slide

  54. ݕࡧ
    54
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ

    ϫΧϝ 2
    1 2
    1 2
    1

    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ

    View Slide

  55. ݕࡧ
    55
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ

    ϫΧϝ 2
    1 2
    1 2
    1

    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ

    View Slide

  56. ݕࡧ
    56
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ

    ϫΧϝ 2
    1 2
    1 2
    1

    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ

    View Slide

  57. ݕࡧ
    57
    ΧπΦ
    αβΤ
    1
    1 2 ͸
    ͷ

    ϫΧϝ 2
    1 2
    1 2
    1

    2
    ΧπΦ αβΤ
    AND
    ݕࡧ৚݅ೖྗ
    ݕࡧ৚݅ͷύʔε

    ݕࡧΫΤϦԽ
    ΧπΦɹαβΤ

    View Slide

  58. ୯ޠͷ۠੾Γํ
    • ӳޠͷ৔߹
    I am speaking Introduction Elasticsearch.


    • ೔ຊޠͷ৔߹
    ࢲ͸ೖ໳Elasticsearchʹ͍ͭͯ࿩͍ͯ͠Δɻ


    58

    View Slide

  59. ୯ޠͷ۠੾Γํ
    • ӳޠͷ৔߹
    I am speaking Introduction Elasticsearch.


    εϖʔε͕੾Ε໨ͱΘ͔Δ
    • ೔ຊޠͷ৔߹
    ࢲ͸ೖ໳Elasticsearchʹ͍ͭͯ࿩͍ͯ͠Δɻ

    Ͳ͜Ͱ۠੾Ε͹Α͍ʁ
    59

    View Slide

  60. N-Gramͱܗଶૉղੳ
    • సஔΠϯσοΫεͷΩʔͷ࡞Γํ
    ‒ ೔ຊޠ͸୯ޠͷ੾Ε໨͕Θ͔Βͳ͍ͷͰɺసஔΠϯσοΫεͷΩʔ͸
    ओʹ࣍ͷ̎ͭͷख๏Ͱ࡞੒
    • N-Gram
    ‒ NจࣈͣͭจষΛ۠੾Δ
    • ܗଶૉղੳ
    ‒ ࣙॻͳͲΛ༻͍ͯҙຯͷ͋Δ୯ޠͰ۠੾Δ
    60

    View Slide

  61. ܗଶૉղੳ
    • ϝϦοτɿ
    ‒ ҙຯͷ͋Δ୯ޠͷ੾Ε໨

    ඼ࢺ৘ใΛݩʹ௥Ճॲཧ͕Մೳʢޠװม׵ͳͲʣ
    • σϝϦοτɿ
    ‒ ৽ޠʢະ஌ޠʣʹऑ͍→ࣙॻϕʔεͷ৔߹ɺࣙॻʹͳ͍୯ޠ͸ݕग़ෆ
    ೳɻ
    61
    ΧπΦ͸αβΤͷఋ
    ΧπΦ ͸ ͷ
    αβΤ ఋ

    View Slide

  62. N-Gram
    • ϝϦοτɿ
    ‒ ະ஌ޠʹରԠՄೳ
    • σϝϦοτɿ
    ‒ ΠϯσοΫεංେԽ
    ‒ ඼ࢺ৘ใʹجͮ͘ॲཧ͕ෆՄೳ
    62
    ΧπΦ͸αβΤͷఋ
    Χπ πΦ Φ͸ ͸α αβ βΤ Τͷ ͷఋ

    View Slide

  63. ͦͷଞͷػೳ

    View Slide

  64. elasticsearch
    ͞·͟·ͳܗࣜͷσʔλͰ
    GeoݕࡧՄೳ


    Ң౓ܦ౓ɺGeoHashɺ
    GeoShape…
    GEO

    View Slide

  65. Ecosystem
    • Plugins
    ‒ ϓϥάΠϯʹΑΔػೳͷ௥Ճ
    • ΫϥΠΞϯτϥΠϒϥϦ
    • Java, Ruby, python, php, perl, javascript, .NET
    • Scala, clojure, go
    65

    View Slide

  66. Elasticsearch - The Definitive guide


    http://www.elastic.co/guide/en/
    elasticsearch/guide/current/index.html
    66
    ৄ͘͠஌Γ͍ͨํ͸

    View Slide

  67. ղੳͱͯ͠ͷElasticsearch

    View Slide

  68. aggregation

    View Slide

  69. Aggregationͱ͸
    • 1.0͔Βಋೖ
    • FacetΑΓ΋ڧྗͳूܭͳͲ͕Մೳ
    • ֊૚తͳूܭɺάϧʔϓԽ

    ಈతͳूܭɺάϧʔϓԽ
    • େ͖͘2छྨ
    • BucketɹυΩϡϝϯτΛ஋͝ͱʹ݁ՌΛάϧʔϐϯά
    • Metricɹ υΩϡϝϯτͷ࣋ͭ஋Λूܭ
    69

    View Slide

  70. ྫɿݴޠ͓Αͼ஍Ҭͷूܭ
    70
    curl -XGET twitter-2014.08.22/_search -d '
    {
    "aggs": {
    "lang": {
    "terms": {"field": "lang" },
    "aggs": {
    "place": {
    "terms": {
    "field": “place.full_name", "size": 10
    }
    }
    }
    }
    }
    }

    View Slide

  71. ྫɿݴޠ͓Αͼ஍Ҭͷूܭ
    71
    "aggregations": {
    "lang": {
    "buckets": [{…}, {
    "key": "ja",
    "doc_count": 980145,
    "place": {
    "buckets": [
    { "key": "ژ౎ࢢ෬ݟ۠, ژ౎",
    "doc_count":252 },
    { "key": "ઍ୅ా۠, ౦ژ",
    "doc_count": 39 },…

    View Slide

  72. 72
    KibanaͰՄࢹԽ

    View Slide

  73. Kibana 5
    • ElasticsearchͷσʔλΛՄࢹԽ
    • Node.js server & JavaScript
    • Apache License 2.0
    • Elastic Stackͷ૭ͷ໾ׂ
    • ༷ʑͳGUIΛPluginͱ͍ͯެ։
    • MarvelɺSenseɺTimelionͳͲ
    73

    View Slide

  74. Kibana 5
    74

    View Slide

  75. Combining Search and Analytics
    75

    View Slide

  76. σϞ for Kibana5
    Access Log
    76

    View Slide

  77. ຊ֨తʹղੳΛߦ͏ʹ͸ʁ

    View Slide

  78. View Slide

  79. 79
    Logstash

    View Slide

  80. Logstash in 10 seconds
    • ϩάɾσʔλͷऩूɾ؅ཧ
    • ऩूɺύʔεɾՃ޻ɺૹग़
    • ΦʔϓϯιʔεɿApache License 2.0
    • Ruby app (JRuby)
    80

    View Slide

  81. Logstash architecture
    81
    Input Output
    Filter
    ? ?
    collect and split alter and enrich store and visualize

    View Slide

  82. ઃఆ
    82
    input {

    }
    filter {

    }
    output {

    }

    View Slide

  83. ઃఆɿinput
    83
    input {
    file {
    path => “/Users/johtani/sample/*_log"
    start_position => "beginning"
    }
    }

    View Slide

  84. 1ߦ1σʔλ
    189.120.xx.xx - - [02/Dec/2014:12:18:29 +0900] "GET /manager/html HTTP/
    1.1" 404 274 "-" "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101
    Firefox/5.0"
    84

    View Slide

  85. ઃఆɿfilter
    85
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }

    View Slide

  86. ύʔε
    86
    189.120.xx.xx - - [02/Dec/2014:12:18:29 +0900] "GET /manager/html HTTP/1.1"
    404 274 "-" "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0"
    {…
    "@timestamp": "2015-04-10T09:07:49.325Z",
    "clientip": "189.120.xx.xx",
    "ident": "-",
    "auth": "-",
    "timestamp": "02/Dec/2014:12:18:29 +0900",
    "verb": "GET",
    "request": "/manager/html",

    "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/

    View Slide

  87. ઃఆɿfilter
    87
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }

    View Slide

  88. ೔෇ͷύʔε
    88
    {…
    "@timestamp": "2015-04-10T09:07:49.325Z",

    "timestamp": "02/Dec/2014:12:18:29 +0900",

    }
    {…
    "@timestamp": "2014-12-02T03:18:29.000Z",

    "timestamp": "02/Dec/2014:12:18:29 +0900",

    }

    View Slide

  89. ઃఆɿfilter
    89
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }

    View Slide

  90. IP͔ΒҢ౓ܦ౓ͳͲ෇༩
    90
    "clientip": "189.120.xx.xx",
    "clientip": "189.120.xx.xx",
    "geoip": {
    "ip": “189.120.xxx.xxx”,

    "country_name": "Brazil",
    "continent_code": "SA",
    "region_name": "27",
    "city_name": "São Paulo",
    "latitude":

    View Slide

  91. ઃఆɿfilter
    91
    filter {
    grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    }
    date {
    match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"]
    locale => en
    }
    geoip { source => ["clientip"] }
    useragent {
    source => "agent"
    target => "useragent"
    }
    }

    View Slide

  92. ϢʔβΤʔδΣϯτͷύʔε
    92
    "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv:
    5.0) Gecko/20100101 Firefox/5.0\""
    "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv:
    5.0) Gecko/20100101 Firefox/5.0\""
    "useragent": {
    "name": "Firefox",
    "os": "Windows XP",
    "os_name": "Windows XP",
    "device": "Other",
    "major": "5",
    "minor": "0"

    View Slide

  93. ઃఆɿoutput
    93
    output {
    elasticsearch {
    hosts => ["localhost"]
    index => “demo_access_log-%{+YYYY.MM.dd}”
    }
    }

    View Slide

  94. ͞Βʹ׆༻͢Δʹ͸ʁ

    View Slide

  95. elasticsearch-hadoop
    95
    -
    •  D E H
    •  PD ecd
    ER
    •  g D
    • 
    CH
    •  Ca M DMS
    D FERC

    View Slide

  96. 96
    X-Pack
    ؆୯ʹΠϯετʔϧ
    Elastic StackΛ֦ு
    αϒεΫϦϓγϣϯʹؚ·ΕΔ
    Security
    Alerting
    Monitoring
    Reporting
    Graph
    Machine Learning

    View Slide

  97. 97
    Elastic Cloud
    Elasticsearch, Kibanaͷ
    ϚωʔδυαʔϏε
    X-Packͷػೳ΋ར༻Մೳ
    Available in AWS today

    View Slide

  98. 98

    View Slide

  99. 99
    Elastic Cloud
    Enterprise
    ෳ਺ͷElastic Stack؀ڥΛࣗࡏʹ࡞੒
    Logging as a serviceΛࣗ૊৫ʹల։
    Public beta; Expected GA Q1 2017

    View Slide

  100. ࢀߟจݙ
    • Elasticsearch - The Definitive guide
    ‒ http://www.elastic.co/guide/en/elasticsearch/guide/current/index.html
    • ॻ੶ʢ೔ຊޠʣ
    ‒ ElasticSearchServer೔ຊޠ൛
    ‒ αʔό/ΠϯϑϥΤϯδχΞ

    ɹཆ੒ಡຊɹϩάऩू
    100

    View Slide

  101. ࢀߟจݙ
    • Elasticsearch - The Definitive guide
    ‒ http://www.elastic.co/guide/en/elasticsearch/guide/current/index.html
    • ॻ੶ʢ೔ຊޠʣ
    ‒ ElasticSearchServer೔ຊޠ൛
    ‒ αʔό/ΠϯϑϥΤϯδχΞ

    ɹཆ੒ಡຊɹϩάऩू
    101

    View Slide

  102. ࢀߟจݙ
    • Elasticsearch - The Definitive guide
    ‒ http://www.elastic.co/guide/en/elasticsearch/guide/current/index.html
    • ॻ੶ʢ೔ຊޠʣ
    ‒ ElasticSearchServer೔ຊޠ൛
    ‒ σʔλ෼ੳج൫ߏஙೖ໳

    2017೥9݄21೔ൃച
    102

    View Slide

  103. ࢀߟαΠτ
    • Ϣʔεέʔε
    • https://www.elastic.co/use-cases
    • DiscussʢWebϑΥʔϥϜʣ
    • https://discuss.elastic.co
    • Elastic{ON}ͷϏσΦͱࢿྉ
    • https://www.elastic.co/elasticon/videos
    • αϙʔτϝχϡʔ
    • https://www.elastic.co/subscriptions
    103

    View Slide

  104. Thanks for listening!
    Q & A
    We’re hiring!
    https://www.elastic.co/about/careers/
    We’re helping!
    https://www.elastic.co/subscriptions
    http://training.elastic.co

    View Slide