Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Don't let your log go away

Don't let your log go away

Talk given at Paris Tech Talk MeetUp

Olivier Dolbeau

March 24, 2015
Tweet

More Decks by Olivier Dolbeau

Other Decks in Programming

Transcript

  1. This is specific to its access logs My roommate uses

    this to colorise his access logs… 12
  2. 13

  3. 14

  4. 15

  5. 16

  6. 17

  7. Inputs Filters Outputs 41 inputs • syslog • udp •

    varnishlog • gelf • … 50 filters • date • geoip • i18n • urldecode • … 55 outputs • elasticsearch • redis • email • graphite • … And there are also some codecs 18
  8. 20

  9. 22

  10. 24

  11. filter { if [type] == "syslog" { grok { match

    => [ "message", "<%{POSINT:syslog_pri}>% {TIMESTAMP_ISO8601:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} % {DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: % {GREEDYDATA:syslog_message}" ] add_field => [ "received_at", "%{@timestamp}" ] add_field => [ "received_from", "%{host}" ] add_tag => [ "rsyslog" ] } } } Logstash - Filter 27
  12. output { elasticsearch_http { host => “my_es.blablacar.com” port => 9200

    index => "logstashv1-%{+YYYY.MM.dd}" manage_template => false } } Logstash - Output 28
  13. 29

  14. 31

  15. 32