,JCBOBೖ໳ ਫށ༞հ!Z@

୭ʁ

! ਫށ༞հ.JUP:VTVLF $00,1"%גࣜձٕࣾज़෦ ΞϓϦέʔγϣϯΤϯδχΞ Ҏલ͸αʔϏε։ൃɺ࠷ۙ͸3&45"1*ͷ։ൃͳͲ Z !Z@

,JCBOB

ࠓ೔ͷ͓࿩ wͳͥ,JCBOBʁ w,JCBOBͷ࢖͍ํ w,JCBOB5JQT

ࠓ೔ͷ͓࿩ wͳͥ,JCBOBʁ w,JCBOBͷ࢖͍ํ w,JCBOB5JQT

·ͣ͸جຊ৘ใ͔Β

,JCBOBͱ͸ʁ w ϩάղੳՄࢹԽπʔϧ w MPHTUBTIͰूΊͨϩάΛՄࢹԽ͢ΔͨΊʹ࡞ΒΕͨ w ೥ʹ&MBTUJDTFBSDIͷެࣜπʔϧԽ w IUUQTHJUIVCDPNFMBTUJDTFBSDILJCBOB w MPHTUBTI΁ͷґଘ͸ͳ͘ɺqVFOUEͳͲ΋؆୯ʹ࿈ܞՄೳ

ߏ੒ &MBTUJDTFBSDI ,JCBOB MPHTUBTI qVFOUE

ಛ௃ w,JCBOBࣗମ͸)5.-$44+4ͷΈ wͭ·Γ8FCαʔό͚ͩͰ഑৴Մೳ XHFUIUUQEPXOMPBEFMBTUJDTFBSDIPSHLJCBOBLJCBOBLJCBOBMBUFTU[JQ VO[JQLJCBOBMBUFTU[JQ SVCZSTJOBUSBFTFUQVCMJD@EJS lLJCBOBMBUFTU

ಛ௃ ύωϧΛ௥Ճͯ͠ ޷ΈͷμογϡϘʔυΛ࡞ΕΔ

ಛ௃ w࡞ͬͨμογϡϘʔυ͸ FMBTUJDTFBSDIʹอଘ wετϨʔδෆཁ

,JCBOBΛ࢖͏ཧ༝

ϩάΛݟΔͱ͖ʹ Α͋͘Δ͜ͱ

ຖճݟ͍ͨ৚͕݅มΘΔ ͋ΔϢʔβͷΞΫηεΛ௥੻͍ͨ͠ ͜ͷϖʔδʹΞΫηε͞Εͨճ਺ J04ͱ"OESPJEͷΞΫηεൺ཰ ฏۉϨεϙϯελΠϜ FUDʜ

ૉૣ͘܏޲Λݟ͍ͨ ϐʔΫλΠϜ͸Կ࣌ࠒʁ ٳ೔ͷτϥϑΟοΫ͸ฏ೔ʹൺ΂ͯͲ͏ʁ Τϥʔ͸ى͖͍ͯͳ͍ʁ FUDʜ

Ͱ΋ɺৄࡉ΋ݟ͍ͨ ͜ͷ࣌ͷΫΤϦύϥϝʔλ͸Կʁ ͜ͷάϥϑͷεύΠΫ͸Կʁ Ͳ͔͜Β͜ͷϖʔδʹདྷͨͷʁ FUDʜ

ݟ͍ͨ࣌ʹ ݟ͍ͨ৘ใΛ ૉૣ͘

,JCBOBͳΒશ෦Ͱ͖Δ

ࠓ೔ͷ͓࿩ wͳͥ,JCBOBʁ w,JCBOBͷ࢖͍ํ w,JCBOB5JQT

αϯϓϧσʔλ χίχίσʔληοτಈըϝλσʔλ IUUQXXXOJJBDKQDTDFOUFSJESOJDPOJDPIUNM

ఏڙ ג υϫϯΰ ࠃཱ৘ใֶݚڀॴ

/BWJHBUJPO 3PX 3PX 1BOFM 1BOFM 1BOFM

2VFSZ ݕࡧΫΤϦΛೖྗ͢ΔҰ൪جຊͱͳΔύωϧ MVDFOFΫΤϦ͕ॻ͚Δ NPWJF@UZQFNQ NPWJF@UZQFqW

'JMUFSJOH ݱࡏͷΫΤϦʹର͔͔͍ͯͬͯ͠ΔߜΓࠐΈ৚݅Λදࣔ ظؒͷߜΓࠐΈ NPWJF@UZQFͷߜΓࠐΈ

4BWF-PBE FMBTUJDTFBSDIͷLJCBOBJOUΠϯσοΫε͔ΒอଘͱಡΈࠐΈ μογϡϘʔυΛ࡞ͬͨΒϦϩʔυલʹඞͣอଘʂ

)JTUPHSBN ࣌ܥྻσʔλΛදࣔ͢Δ Ұ൪࢖͏͜ͱʹͳΔύωϧ -JOFT #BST 1PJOUT

)JUT ΫΤϦ͝ͱͷ૯ώοτ݅਺ΛάϥϑԽ

4QBSLMJOFT ΫΤϦ͝ͱͷ܏޲͚ͩΛՄࢹԽ IUUQTUXJUUFSDPNSBTIJELQDTUBUVT

5FSNT GBDFUTͷ݁ՌΛ#BS 1JF 5BCMFͰάϥϑԽ ίϝϯτ਺ͷGBDFU

5SFOET ࢦఆͨ࣌͠఺͔Βͷ஋ͷมԽΛදࣔ ʮલ೔ൺ/૿Ճʯ ʮલ೥ൺ.ݮগʯͳͲ

.BQ GBDFUͷ݁ՌΛ஍ਤ্ͰՄࢹԽ ೔ຊ஍ਤ͸1VMMSFRVFTUΛग़ͨ͠΋ͷͷٞ࿦தʜ IUUQTHJUIVCDPNFMBTUJDTFBSDILJCBOBQVMM

#FUUFS.BQ Ң౓ɾܦ౓ΛݩʹϚοϐϯά

5BCMF ΫΤϦʹϚονͨ͠υΩϡϝϯτͷ಺༰Λදࣔ

$PMVNO ύωϧΛॎʹฒ΂ΒΕΔύωϧ

5FYU )5.- NBSLEPXO QMBJOUFYUͰςΩετΛදࣔ

DEMO

ΫΤϦͷॻ͖ํ

λΠτϧʹʮՎͬͯΈͨʯΛؚΉಈը UJUMFlՎͬͯΈͨz ಈըܗࣜNQҎ֎ͷಈը NPWJF@UZQFNQ ࠶ੜ࣌ؒ෼ະຬͷಈը MFOHUI<50> λΠτϧʹʮՎͬͯΈͨʯΛؚΉNQಈը UJUMFlՎͬͯΈͨz"/%NPWJF@UZQFNQ /05 NPWJF@UZQFNQ ·ͨ͸ ࠶ੜ࣌ؒ෼ະຬͷಈը MFOHUI<50>

ෳ਺ͷΫΤϦͷ݁ՌΛൺֱ

ಈըܗࣜͷൺֱ GBDFUͰऔಘͨ͠Ωʔϫʔυ͔Βࣗಈతʹݕࡧ

ಈըϑΝΠϧαΠζͷฏۉ஋ ਺஋ϑΟʔϧυͷฏۉ஋ΛάϥϑԽ ଞʹɺ࠷େ஋ɺ࠷খ஋ɺ߹ܭ΋ܭࢉՄೳ

ࠓ೔ͷ͓࿩ wͳͥ,JCBOBʁ w,JCBOBͷ࢖͍ํ w,JCBOB5JQT

JOEFYͱUZQF MPHTUBTI BDDFTT@MPH JOEFY UZQF FWFOU@MPH UZQF MPHTUBTI BDDFTT@MPH JOEFY UZQF FWFOU@MPH UZQF MPHTUBTI BDDFTT@MPH JOEFY UZQF FWFOU@MPH UZQF ͭͷJOEFYʹҟͳΔεΩʔϚΛ࣋ͭσʔλΛೖΕΒΕΔ ͭͷJOEFYʹೖΕΔ͜ͱͰάϥϑΛॏͶͯൺֱͳͲ͕Ͱ͖Δ

NBQQJOH w NBQQJOH͸ࣗಈతʹఆٛ͞ΕΔ w େ֓ɺͪΐͬͱ͏·͍͔͘ͳ͍ w ਺஋ܕ͕JOUFHFSͰ͸ͳ͘MPOHʹͳΔ w ύεจࣈྻ͕෼͔ͪॻ͖͞Εͯ͠·͏ w ͳͲ

{! "template": "logstash-*",! "settings" : {! "number_of_shards" : 1,! "number_of_replicas" : 0! },! "mappings": {! “access_log": { ! "_source": { "compress": true },! "dynamic_templates": [! {! "string_template" : { ! "match" : "*",! "mapping": { "type": "string", "index": "not_analyzed" },! "match_mapping_type" : "string"! } ! }! ],! "properties" : {! "path" : {! "type": "multi_field",! "fields" : {! "analyzed" : {"type":"string", "index" : "analyzed"},! "no_analyzed": {"type":"string", "index" : "not_analyzed"}! }! },! "agent" : {! "type": "multi_field",! "fields" : {! "analyzed" : {"type":"string", "index" : "analyzed"},! "no_analyzed": {"type":"string", "index" : "not_analyzed"}! }! },! "referer" : {! "type": "multi_field",! "fields" : {! "analyzed" : {"type":"string", "index" : "analyzed"},! "no_analyzed": {"type":"string", "index" : "not_analyzed"}! }! },! "@timestamp" : { "type" : "date", "index" : "not_analyzed" }! }! }! }! } curl -XPUT localhost:9200/_template/logstash_template JOEFYUFNQMBUF MPHTUBTIͰ࢝·ΔJOEFYʹࣗಈతʹద༻ UZQF͕BDDFTT@MPHͷυΩϡϝϯτʹద༻ ͭͷϓϩύςΟΛෳ਺ͷpFMEʹల։ ෼͔ͪॻ͖Λ͠ͳ͍

ੑೳ w &$NMBSHFʷ୆ w ೔ͷΠϯσοΫεαΠζ͕(#Λ௒͑Δ͋ͨΓͰ FMBTUJDTFBSDI͕٧·Γ࢝ΊΔ w 0VU0G.FNPSZ&SSPSͳͲΛు͍ͯ΄ͱΜͲJNQPSUΛड͚෇͚ ͳ͘ͳΔ w qVFOUEʹσʔλ͕ͨ·ΓόοϑΝΦʔόʔͰσʔλΛࣦ͏ʜ

ੑೳ w ͦͷޙɺ+7.ͷ($ύϥϝʔλνϡʔχϯάʹΑΓͳΜͱ͔҆ఆ w ϐʔΫ࣌Ͱ.CQTఔ౓ͷτϥϑΟοΫʹ଱͑ΒΕΔ͜ͱΛ֬ೝ νϡʔχϯάͷৄࡉʹ͍ͭͯ͸ !DPO@NBNFʹฉ͍͍ͯͩ͘͞ ΦϒδΣΫτ͕େྔʹੜ੒ɺ࡟আ͞ΕΔ͜ͱͰසൟʹ'VMM($͕૸͍ͬͯͨͷ͕ݪҼ /FXྖҬͷαΠζΛ޿͛ͯ4DBWFOHF($Ͱճऩ͞ΕΔΑ͏ʹ͢Δ͜ͱͰ'VMM($ͷൃੜ ස౓ΛͰ͖Δ͚ͩԼ͛ΔΑ͏ʹͨ͠

࠷৽৘ใΛ௥͏ w HJUIVCͷNBTUFShttps://github.com/elasticsearch/kibana w ຖ೔ͷΑ͏ʹػೳ௥Ճ΍σβΠϯมߋ͕ى͖͍ͯ·͢ w ͨ·ʹͪΐͬͱյΕͯ·͢ w ެࣜCMPHhttp://www.elasticsearch.org/blog/ w ,JCBOBͷهࣄ͸ ϲ݄ʹຊͰ͕͢།Ұͷ৽ػೳ঺հ৘ใͰ͢ w EFNPLJCBOBPSHhttp://demo.kibana.org/ w खͬऔΓૣ͘࠷৽൛ΛࢼͤΔ