Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Logstash Lunch and Learn

Logstash Lunch and Learn

Quick intro to logstash I gave for CMGd at a lunch and learn. The audience already had a basic setup going.

6385d06011a9633cd45cab0662ae9eb8?s=128

John Vincent

March 22, 2012
Tweet

Transcript

  1. Logstash Lunch and Learn CMGD 03/22/2012

  2. whoami • @lusis • #atl • #devops • #ruby •

    #monitoringsucks • @enstratus
  3. Logstash • Started by Jordan Sissel and Pete Fritchman •

    ~2004 • Inputs → Filters → Outputs • Jruby (and now limited YARV support) • UNIX pipe with super powers
  4. Inputs • AMQP • Exec • File • Heroku •

    Pipe • Redis • STDIN • Stomp • Syslog* • TCP • UDP* • Twitter • XMPP • ZeroMQ
  5. Filters • Date* • DNS • Environment • Gelfify •

    Grep* • Grok* • Grok Discovery • JSON • Multiline* • Mutate • Split • ZeroMQ(!)
  6. Outputs • AMQP • ElasticSearch • ElasticSearch River • File

    • Ganglia • Graphite • Juggernaut • Loggly • Metric Catcher • MongoDB • Nagios • Nagios NCSA • Pipe • Redis • Riemann • Statsd • STDOUT • Stomp • TCP • WebSockets • XMPP • Zabbix • ZeroMQ
  7. Not just for logs • Event (Timestamp + data) •

    Logstash ALL the things • It's like …
  8. None
  9. or

  10. You can do cool stuff like

  11. or

  12. Configs

  13. MOAR CONFIGS

  14. EVEN MOAR CONFIGS

  15. !!!!!1111!!1!1111!!!!!

  16. If you send it to Logstash you can ... •

    Slice it • Dice it • Scatter, Smother, Cover it • Love it, Hate it • Chew it up • Spit it out (wherever you want)
  17. Question Time! (yes this is Comic Sans)