様々なメトリクスやログを集めてシステム解析  - Elastic Stackの入門と活用 - / Intro Elastic Stack

Slide 1

Slide 1 text

!1 2018/07/06 Developer Advocate at Elastic Jun Ohtani @johtani ༷ʑͳϝτϦΫε΍ϩάΛूΊͯγεςϜղੳ   - Elastic Stackͷೖ໳ͱ׆༻ -

Slide 2

Slide 2 text

Slide 3

Slide 3 text

!3 ΞδΣϯμ • ϝτϦΫεʗϩάͱ͸ʁ • γεςϜϝτϦΫεղੳɺϩάղੳΛࢼ͠ʹ΍ͬͯΈΑ͏ • Beats - Elasticsearch - KibanaͰղੳ • ຊ֨తʹղੳΛ΍Δʹ͸ʁ • LogstashͰϩά΍ϝτϦΫεΛதܧɾू໿ • ͞Βʹ৭ʑࢼͯ͠ΈΔʹ͸ʁ

Slide 4

Slide 4 text

!4 about • Me, Jun Ohtani / Developer Advocate ‒ lucene-gosenίϛολʔ ‒ σʔλ෼ੳج൫ߏஙೖ໳ ڞஶ ‒ http://blog.johtani.info  • Elasticsearch, founded in 2012 ‒ Products: Elasticsearch, Logstash, Kibana, Beats   Elastic APM,   X-Pack, Elastic Cloud, Swiftype   Professional services: Support & development subscriptions  Trainings, Consulting, SaaS

Slide 5

Slide 5 text

!5 ͲΜͳϝτϦΫεɺ  ϩάΛूΊ͍ͯ·͔͢ʁ

Slide 6

Slide 6 text

!6 ϝτϦΫε • CPUɺϝϞϦ࢖༻཰ɺσΟεΫ࢖༻཰ • ΞΫηε਺ɺωοτϫʔΫసૹྔ • Ԡ౴࣌ؒ • ίωΫγϣϯ਺ • τϥϯβΫγϣϯ਺ɺച্ • ίϯςφͷ্ͷ֤छϝτϦΫε

Slide 7

Slide 7 text

!7 ϩά • ೝূϩά • γεςϜϩά • ΞϓϦέʔγϣϯϩά • Slow log • ΞΫηεϩά • ίϯςφͷதͷϩά

Slide 8

Slide 8 text

!8 Ͱ͖Ε͹ϩάͱϝτϦΫεΛ  ·ͱΊͯ1ͭͷը໘Ͱ  ݟ͍ͨͰ͢ΑͶʁ

Slide 9

Slide 9 text

!9 Elastic Stack

Slide 10

Slide 10 text

10 Elastic Stack 100% Φʔϓϯιʔε ʮΤϯλʔϓϥΠζ൛ʯ͸ແ͠ όʔδϣϯ 5.0Ͱ׬શ౷Ұ

Slide 11

Slide 11 text

!11 X-Pack ؆୯ʹΠϯετʔϧ Elastic StackΛ֦ு αϒεΫϦϓγϣϯʹؚ·ΕΔ Security Alerting Monitoring Reporting Graph Machine Learning

Slide 12

Slide 12 text

ఆܕͷϝτϦΫε/ϩάղੳΛ Elastic StackͰ

Slide 13

Slide 13 text

!13 ϝτϦΫεɾϩάͷ෼ੳʢ؆қ൛ʣ σʔλ Import Parse/  Store/Search Visualize

Slide 14

Slide 14 text

!14

Slide 15

Slide 15 text

15 Beats ܰྔσʔλγούʔ ιʔε͔ΒσʔλΛసૹ సૹ͠Elasticsearchʹू໿ ม׵ͱύʔεͷͨΊ Logstashʹసૹ Elastic Cloudʹసૹ Libbeat: ΧελϜbeatsͷͨ ΊͷAPIϑϨʔϜϫʔΫ 30Ҏ্ͷίϛϡχςΟbeats

Slide 16

Slide 16 text

The Beats family Heartbeat Uptime monitoring Filebeat Log files Winlogbeat Windows Event Logs Packetbeat Network data +40 community Beats Metricbeat Metrics Auditbeat Audit data

Slide 17

Slide 17 text

Collect system and application metrics Metricbeat

Slide 18

Slide 18 text

lots of modules Metricbeat

Slide 19

Slide 19 text

tail log from ﬁle Filebeat

Slide 20

Slide 20 text

many modules Filebeat

Slide 21

Slide 21 text

Capture the Packet Packetbeat

Slide 22

Slide 22 text

Capture the Packet Packetbeat

Slide 23

Slide 23 text

Welcome to 1998 winlogbeat

Slide 24

Slide 24 text

Now winlogbeat

Slide 25

Slide 25 text

!25 • Kubernetes module in Metricbeat ‒ CPU, memory, ωοτϫʔΫసૹྔͳͲ • add_docker_metadataϓϩηοα ‒ Container ID, name, image, labels • add_kubernetes_metadataϓϩηοα ‒ Pod name, pod namespace, container name, pod labels Beats <3 ίϯςφ Docker΍KubernetesͰͷσϓϩΠΛ؆୯ʹ

Slide 26

Slide 26 text

!26

Slide 27

Slide 27 text

27 Elasticsearch Heart of the Elastic Stack ෼ࢄܕɺεέʔϥϒϧ ߴՄ༻ੑ Ϛϧνςφϯτ ։ൃऀϑϨϯυϦʔ ϦΞϧλΠϜɺશจݕࡧ ΞάϦήʔγϣϯ

Slide 28

Slide 28 text

Elasticsearchͱ͸ʁ

Slide 29

Slide 29 text

!29 ϑϦʔϫʔυݕࡧ

Slide 30

Slide 30 text

!30 ߜΓࠐΈ

Slide 31

Slide 31 text

!31 ϋΠϥΠτ

Slide 32

Slide 32 text

!32 ιʔτ

Slide 33

Slide 33 text

!33 ϖʔδϯά

Slide 34

Slide 34 text

!34 ूܭ

Slide 35

Slide 35 text

!35 αδΣετ

Slide 36

Slide 36 text

!36 Elasticsearch in 10 seconds • εΩʔϚϑϦʔɺ෼ࢄυΩϡϝϯτετΞɺREST & JSON • Φʔϓϯιʔε: Apache License 2.0 • ઃఆͳ͠Ͱ؆୯ʹࢼ͢͜ͱ͕Մೳ • JavaͰ࣮૷ɻ֦ு΋༰қ

Slide 37

Slide 37 text

؆୯ͳCRUD

Slide 38

Slide 38 text

σʔλొ࿥ 38 curl -XPUT localhost:9200/books/doc/1 -d ' { "title" : "Elasticsearch - The definitive guide", "authors" : "Clinton Gormley", "started" : "2013-02-04", "pages" : 230 }'

Slide 39

Slide 39 text

σʔλߋ৽ 39 curl -XPUT localhost:9200/books/doc/1 -d ' { "title" : "Elasticsearch - The definitive guide", "authors" : [ "Clinton Gormley", "Zachary Tong" ], "started" : "2013-02-04", "pages" : 230 }'

Slide 40

Slide 40 text

σʔλ࡟আ !40 curl -X DELETE localhost:9200/books/doc/1 σʔλͷऔಘ curl —X GET localhost:9200/books/doc/1 curl —X GET localhost:9200/books/doc/1/_source

Slide 41

Slide 41 text

ݕࡧ - Query DSL !41 curl -XGET ‘localhost:9200/books/doc/_search' -d '{ "query": { "bool": { "must": [ { "match": { "title": "Search" }}, { "match": { "content": "Elasticsearch" }} ], "filter": [ { "term": { "status": "published" }}, { "range": { "publish_date": { "gte": "2015-01-01" }}} ] } } }'

Slide 42

Slide 42 text

෼ࢄߏ੒ɺ  εέʔϧ

Slide 43

Slide 43 text

Basic terms • ΠϯσοΫε ‒ σʔλͷ࿦ཧతͳू߹ɻ  RDBͷσʔλϕʔεͷΑ͏ͳ΋ͷLogical • ϨϓϦέʔγϣϯ • ಡΈࠐΈͷεέʔϥϏϦςΟ޲্ • SPOFͷղফ • γϟʔσΟϯά • ෳ਺Ϛγϯ΁σʔλΛ෼ׂ  ॻ͖ࠐΈͷεέʔϥϏϦςΟ޲্  σʔλϑϩʔ੍ޚ !43

Slide 44

Slide 44 text

γϟʔυͱϨϓϦΧ !44 node 1 orders products 1 4 1 2 2 3 curl -X PUT localhost:9200/orders -d '{ "settings.index.number_of_shards" : 4 "settings.index.number_of_replicas" : 1 }' curl -X PUT localhost:9200/products -d '{ "settings.index.number_of_shards" : 2 "settings.index.number_of_replicas" : 0 }'

Slide 45

Slide 45 text

γϟʔυͱϨϓϦΧ !45 node 1 orders products 1 4 1 node 2 orders products 2 2 3 4 1 2 3

Slide 46

Slide 46 text

ࣗಈతͳ෼ࢄ !46 node 1 orders products 2 1 4 1 node 2 orders products 2 2 node 3 orders products 3 4 1 3

Slide 47

Slide 47 text

ͦͷଞͷػೳ

Slide 48

Slide 48 text

elasticsearch ͞·͟·ͳܗࣜͷσʔλͰ GeoݕࡧՄೳ    Ң౓ܦ౓ɺGeoHashɺ GeoShape… GEO

Slide 49

Slide 49 text

Ecosystem • Plugins ‒ ϓϥάΠϯʹΑΔػೳͷ௥Ճ • ΫϥΠΞϯτϥΠϒϥϦ • Java, Ruby, python, php, perl, javascript, .NET • Scala, clojure, go !49

Slide 50

Slide 50 text

Elasticsearch - The Definitive guide    http://www.elastic.co/guide/en/ elasticsearch/guide/current/index.html 50 ৄ͘͠஌Γ͍ͨํ͸

Slide 51

Slide 51 text

!51

Slide 52

Slide 52 text

52 Kibana Window into the Elastic Stack ՄࢹԽͱ෼ੳ ஍ཧۭؒ ΧελϚΠζͱ Ϩϙʔτͷڞ༗ άϥϑ୳ࡧ Elastic Stack΁ͷ ηΩϡΞͳΞΫηεͱ؅ཧ ΧελϜAppsͷ࡞੒

Slide 53

Slide 53 text

!53 Kibana 6

Slide 54

Slide 54 text

!54 σϞ σʔλ౤ೖ͔ΒՄࢹԽ·Ͱ

Slide 55

Slide 55 text

ຊ֨తʹղੳΛߦ͏ʹ͸ʁ

Slide 56

Slide 56 text

!56

Slide 57

Slide 57 text

57 Logstash σʔλՃ޻ύΠϓϥΠϯ શͯͷܗࣜɺαΠζͱσʔλιʔ εͷ౤ೖ ύʔεͱಈతͳ σʔλม׵ ͋ΒΏΔग़ྗʹ σʔλసૹ ҆શͰ҉߸Խ͞Εͨ  σʔλೖྗ ಠࣗͷύΠϓϥΠϯॲཧ ͷ࡞੒ 200Ҏ্ͷϓϥάΠϯ

Slide 58

Slide 58 text

Logstash architecture !58 Input Output Filter ? ? collect and split alter and enrich store and visualize

Slide 59

Slide 59 text

ઃఆ 59 input { … } filter { … } output { … }

Slide 60

Slide 60 text

1ߦ1σʔλ 189.120.xx.xx - - [02/Dec/2014:12:18:29 +0900] "GET /manager/html HTTP/ 1.1" 404 274 "-" "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0" 60

Slide 61

Slide 61 text

ઃఆɿfilter 61 filter { grok { match => { "message" => "%{COMBINEDAPACHELOG}" } break_on_match => false } date { match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"] locale => en } geoip { source => ["clientip"] } useragent { source => "agent" target => "useragent" } }

Slide 62

Slide 62 text

ύʔε !62 189.120.xx.xx - - [02/Dec/2014:12:18:29 +0900] "GET /manager/html HTTP/1.1" 404 274 "-" "Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0" {… "@timestamp": "2015-04-10T09:07:49.325Z", "clientip": "189.120.xx.xx", "ident": "-", "auth": "-", "timestamp": "02/Dec/2014:12:18:29 +0900", "verb": "GET", "request": "/manager/html", … "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/

Slide 63

Slide 63 text

ઃఆɿfilter !63 filter { grok { match => { "message" => "%{COMBINEDAPACHELOG}" } break_on_match => false } date { match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"] locale => en } geoip { source => ["clientip"] } useragent { source => "agent" target => "useragent" } }

Slide 64

Slide 64 text

೔෇ͷύʔε 64 {… "@timestamp": "2015-04-10T09:07:49.325Z", … "timestamp": "02/Dec/2014:12:18:29 +0900", … } {… "@timestamp": "2014-12-02T03:18:29.000Z", … "timestamp": "02/Dec/2014:12:18:29 +0900", … }

Slide 65

Slide 65 text

ઃఆɿfilter !65 filter { grok { match => { "message" => "%{COMBINEDAPACHELOG}" } break_on_match => false } date { match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"] locale => en } geoip { source => ["clientip"] } useragent { source => "agent" target => "useragent" } }

Slide 66

Slide 66 text

IP͔ΒҢ౓ܦ౓ͳͲ෇༩ 66 "clientip": "189.120.xx.xx", "clientip": "189.120.xx.xx", "geoip": { "ip": “189.120.xxx.xxx”, … "country_name": "Brazil", "continent_code": "SA", "region_name": "27", "city_name": "São Paulo", "latitude":

Slide 67

Slide 67 text

ઃఆɿfilter !67 filter { grok { match => { "message" => "%{COMBINEDAPACHELOG}" } break_on_match => false } date { match => ["timestamp", "dd/MMM/YYYY:HH:mm:ss Z"] locale => en } geoip { source => ["clientip"] } useragent { source => "agent" target => "useragent" } }

Slide 68

Slide 68 text

ϢʔβΤʔδΣϯτͷύʔε 68 "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv: 5.0) Gecko/20100101 Firefox/5.0\"" "agent": "\"Mozilla/5.0 (Windows NT 5.1; rv: 5.0) Gecko/20100101 Firefox/5.0\"" "useragent": { "name": "Firefox", "os": "Windows XP", "os_name": "Windows XP", "device": "Other", "major": "5", "minor": "0"

Slide 69

Slide 69 text

ͦͷ΄͔ʹ͸ʁ

Slide 70

Slide 70 text

!70 elasticsearch-hadoop - •  D E H •  PD ecd ER •  g D •  CH •  Ca M DMS D FERC

Slide 71

Slide 71 text

!71

Slide 72

Slide 72 text

!72 X-Pack ؆୯ʹΠϯετʔϧ Elastic StackΛ֦ு αϒεΫϦϓγϣϯʹؚ·ΕΔ Security Alerting Monitoring Reporting Graph Machine Learning

Slide 73

Slide 73 text

!73

Slide 74

Slide 74 text

!74 ࢀߟจݙ • Elasticsearch - The Definitive guide ‒ http://www.elastic.co/guide/en/elasticsearch/guide/current/ index.html • ॻ੶ʢ೔ຊޠʣ ‒ σʔλ෼ੳج൫ߏஙೖ໳ ‒ Elasticsearch࣮ફΨΠυ

Slide 75

Slide 75 text

!75 ࢀߟαΠτ • Ϣʔεέʔε • https://www.elastic.co/use-cases • DiscussʢWebϑΥʔϥϜʣ • https://discuss.elastic.co • Elastic{ON}ͷϏσΦͱࢿྉ • https://www.elastic.co/elasticon/videos • αϙʔτϝχϡʔ • https://www.elastic.co/subscriptions

Slide 76

Slide 76 text

Thanks for listening! Q & A We’re hiring! https://www.elastic.co/about/careers/ We’re helping! https://www.elastic.co/subscriptions http://training.elastic.co