$30 off During Our Annual Pro Sale. View Details »

Loggen mit dem Elastic Stack

Loggen mit dem Elastic Stack

Das aktuell wahrscheinlich verbreitetste und beliebteste Werkzeug für Log-Monitoring und -Analyse ist der Elastic Stack:

* Elasticsearch um große Datenmengen zu analysieren und zu durchsuchen.
* Logstash und Beats alle relevanten Informationen einzusammeln.
* Kibana zur leistungsstarken und flexiblen Visualisierung.

Dieser Vortrag gibt einen Überblick über die vier Technologien, wie sie zusammenarbeiten und wie sie Ihre Probleme lösen können.

Philipp Krenn

June 27, 2017
Tweet

More Decks by Philipp Krenn

Other Decks in Programming

Transcript

  1. 127.0.0.1 - - [27/Jun/2017:00:56:54 +0000] "GET / HTTP/1.1" 200 612

    "-" "Go-http-client/1.1" "referrer": "-", "response_code": "200", "remote_ip": "127.0.0.1", "method": "GET", "user_name": "-", "http_version": "1.1", "body_sent": { "bytes": "612" }, "url": "/", "user_agent": { "os": "Other", "name": "Other", "os_name": "Other", "device": "Other" }
  2. "remote_ip": "34.253.145.46", "geoip": { "continent_name": "North America", "city_name": "Houston", "country_iso_code":

    "US", "region_name": "Texas", "location": { "lon": -95.5858, "lat": 29.6997 } }
  3. Multiline Exception in thread "main" java.lang.IllegalStateException: A book has a

    null property at com.example.myproject.Author.getBookIds(Author.java:38) at com.example.myproject.Bootstrap.main(Bootstrap.java:14) Caused by: java.lang.NullPointerException at com.example.myproject.Book.getId(Book.java:22) at com.example.myproject.Author.getBookIds(Author.java:35) ... 1 more multiline.pattern: '^[[:space:]]+|^Caused by:' multiline.negate: false multiline.match: after
  4. Flows Application layer: Unsupported or encrypted protocols IP / TCP

    / UDP Number of packets & bytes Retransmissions Temporal flow
  5. --- version: '2' services: kibana: image: docker.elastic.co/kibana/kibana:5.4.2 links: - elasticsearch

    ports: - 5601:5601 elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:5.4.2 cap_add: - IPC_LOCK volumes: - esdata1:/usr/share/elasticsearch/data ports: - 9200:9200 volumes: esdata1: driver: local
  6. Elk horn: https://www.theexplora.com/the-irish-elk- megaloceros-giganteus/ Container ship: https://flic.kr/p/hjxW62 Wooden logs: https://flic.kr/p/9vvbKE

    Axe https://flic.kr/p/pBU2VD Files https://flic.kr/p/2EFcQ Metric https://flic.kr/p/9g5h3f Packages https://flic.kr/p/cJFDLN Windows https://flic.kr/p/94Z6y Library https://flic.kr/p/fiXcBj Beats https://flic.kr/p/bWopW7