Logstash Lunch and Learn

Quick intro to logstash I gave for CMGd at a lunch and learn. The audience already had a basic setup going.

Transcript

1. Logstash Lunch and Learn
   CMGD
   03/22/2012
   

   View Slide

2. whoami
   ●
   @lusis
   ●
   #atl
   ●
   #devops
   ●
   #ruby
   ●
   #monitoringsucks
   ●
   @enstratus
   

   View Slide

3. Logstash
   ●
   Started by Jordan Sissel and Pete Fritchman
   ●
   ~2004
   ●
   Inputs → Filters → Outputs
   ●
   Jruby (and now limited YARV support)
   ●
   UNIX pipe with super powers
   

   View Slide

4. Inputs
   ●
   AMQP
   ●
   Exec
   ●
   File
   ●
   Heroku
   ●
   Pipe
   ●
   Redis
   ●
   STDIN
   ●
   Stomp
   ●
   Syslog*
   ●
   TCP
   ●
   UDP*
   ●
   Twitter
   ●
   XMPP
   ●
   ZeroMQ
   

   View Slide

5. Filters
   ●
   Date*
   ●
   DNS
   ●
   Environment
   ●
   Gelfify
   ●
   Grep*
   ●
   Grok*
   ●
   Grok
   Discovery
   ●
   JSON
   ●
   Multiline*
   ●
   Mutate
   ●
   Split
   ●
   ZeroMQ(!)
   

   View Slide

6. Outputs
   ●
   AMQP
   ●
   ElasticSearch
   ●
   ElasticSearch
   River
   ●
   File
   ●
   Ganglia
   ●
   Graphite
   ●
   Juggernaut
   ●
   Loggly
   ●
   Metric
   Catcher
   ●
   MongoDB
   ●
   Nagios
   ●
   Nagios
   NCSA
   ●
   Pipe
   ●
   Redis
   ●
   Riemann
   ●
   Statsd
   ●
   STDOUT
   ●
   Stomp
   ●
   TCP
   ●
   WebSockets
   ●
   XMPP
   ●
   Zabbix
   ●
   ZeroMQ
   

   View Slide

7. Not just for logs
   ●
   Event (Timestamp + data)
   ●
   Logstash ALL the things
   ●
   It's like …
   

   View Slide

8. View Slide

9. or
   

   View Slide

10. You can do cool stuff like
    

    View Slide

11. or
    

    View Slide

12. Configs
    

    View Slide

13. MOAR CONFIGS
    

    View Slide

14. EVEN MOAR CONFIGS
    

    View Slide

15. !!!!!1111!!1!1111!!!!!
    

    View Slide

16. If you send it to Logstash you
    can ...
    ●
    Slice it
    ●
    Dice it
    ●
    Scatter, Smother, Cover it
    ●
    Love it, Hate it
    ●
    Chew it up
    ●
    Spit it out (wherever you want)
    

    View Slide

17. Question Time!
    (yes this is Comic Sans)
    

    View Slide