Logstash Lunch and Learn

Quick intro to logstash I gave for CMGd at a lunch and learn. The audience already had a basic setup going.

Transcript

1. Logstash Lunch and Learn CMGD 03/22/2012
2. whoami • @lusis • #atl • #devops • #ruby • #monitoringsucks • @enstratus
3. Logstash • Started by Jordan Sissel and Pete Fritchman • ~2004 • Inputs → Filters → Outputs • Jruby (and now limited YARV support) • UNIX pipe with super powers
4. Inputs • AMQP • Exec • File • Heroku • Pipe • Redis • STDIN • Stomp • Syslog* • TCP • UDP* • Twitter • XMPP • ZeroMQ
5. Filters • Date* • DNS • Environment • Gelfify • Grep* • Grok* • Grok Discovery • JSON • Multiline* • Mutate • Split • ZeroMQ(!)
6. Outputs • AMQP • ElasticSearch • ElasticSearch River • File • Ganglia • Graphite • Juggernaut • Loggly • Metric Catcher • MongoDB • Nagios • Nagios NCSA • Pipe • Redis • Riemann • Statsd • STDOUT • Stomp • TCP • WebSockets • XMPP • Zabbix • ZeroMQ
7. Not just for logs • Event (Timestamp + data) • Logstash ALL the things • It's like …
9. or
10. You can do cool stuff like
11. or
12. Configs
13. MOAR CONFIGS
14. EVEN MOAR CONFIGS
15. !!!!!1111!!1!1111!!!!!
16. If you send it to Logstash you can ... • Slice it • Dice it • Scatter, Smother, Cover it • Love it, Hate it • Chew it up • Spit it out (wherever you want)
17. Question Time! (yes this is Comic Sans)