Kibana入門

第2回elasticsearch勉強会の発表資料です。
Kibanaの基本的な使い方について網羅的にまとめました。

Transcript

1. ,JCBOBೖ໳ ਫށ
   ༞հ
   
   !Z@
2. ୭ʁ
3. ! ਫށ༞հ
   .JUP
   :VTVLF
   $00,1"%גࣜձࣾ
   ٕज़෦
   ΞϓϦέʔγϣϯΤϯδχΞ
   Ҏલ͸αʔϏε։ൃɺ࠷ۙ͸3&45
   "1*ͷ։ൃͳͲ Z !Z@
4. ,JCBOB
5. ࠓ೔ͷ͓࿩ wͳͥ,JCBOBʁ
   w,JCBOBͷ࢖͍ํ
   w,JCBOB
   5JQT
6. ࠓ೔ͷ͓࿩ wͳͥ,JCBOBʁ
   w,JCBOBͷ࢖͍ํ
   w,JCBOB
   5JQT
7. ·ͣ͸جຊ৘ใ͔Β
8. ,JCBOBͱ͸ʁ w ϩάղੳՄࢹԽπʔϧ
   w MPHTUBTIͰूΊͨϩάΛՄࢹԽ͢ΔͨΊʹ࡞ΒΕͨ
   w ೥ʹ&MBTUJDTFBSDIͷެࣜπʔϧԽ
   w IUUQTHJUIVCDPNFMBTUJDTFBSDILJCBOB
   w MPHTUBTI΁ͷґଘ͸ͳ͘ɺqVFOUEͳͲ΋؆୯ʹ࿈ܞՄೳ
9. ߏ੒ &MBTUJDTFBSDI ,JCBOB MPHTUBTI qVFOUE
10. ಛ௃ w,JCBOBࣗମ͸)5.-$44+4ͷΈ
    wͭ·Γ8FCαʔό͚ͩͰ഑৴Մೳ XHFU
    IUUQEPXOMPBEFMBTUJDTFBSDIPSHLJCBOBLJCBOBLJCBOBMBUFTU[JQ
    VO[JQ
    LJCBOBMBUFTU[JQ
    SVCZ
    STJOBUSB
    F
    TFU
    QVCMJD@EJS
    lLJCBOBMBUFTU
11. ಛ௃ ύωϧΛ௥Ճͯ͠
    ޷ΈͷμογϡϘʔυΛ࡞ΕΔ
12. ಛ௃ w࡞ͬͨμογϡϘʔυ͸ FMBTUJDTFBSDIʹอଘ
    wετϨʔδෆཁ
13. ,JCBOBΛ࢖͏ཧ༝
14. ϩάΛݟΔͱ͖ʹ
    Α͋͘Δ͜ͱ
15. ຖճݟ͍ͨ৚͕݅มΘΔ ͋ΔϢʔβͷΞΫηεΛ௥੻͍ͨ͠
    ͜ͷϖʔδʹΞΫηε͞Εͨճ਺
    J04ͱ"OESPJEͷΞΫηεൺ཰
    ฏۉϨεϙϯελΠϜ
    FUDʜ
16. ૉૣ͘܏޲Λݟ͍ͨ ϐʔΫλΠϜ͸Կ࣌ࠒʁ
    ٳ೔ͷτϥϑΟοΫ͸ฏ೔ʹൺ΂ͯͲ͏ʁ
    Τϥʔ͸ى͖͍ͯͳ͍ʁ
    FUDʜ
17. Ͱ΋ɺৄࡉ΋ݟ͍ͨ ͜ͷ࣌ͷΫΤϦύϥϝʔλ͸Կʁ
    ͜ͷάϥϑͷεύΠΫ͸Կʁ
    Ͳ͔͜Β͜ͷϖʔδʹདྷͨͷʁ
    FUDʜ
18. ݟ͍ͨ࣌ʹ
    ݟ͍ͨ৘ใΛ
    ૉૣ͘
19. ,JCBOBͳΒશ෦Ͱ͖Δ
20. ࠓ೔ͷ͓࿩ wͳͥ,JCBOBʁ
    w,JCBOBͷ࢖͍ํ
    w,JCBOB
    5JQT
21. αϯϓϧσʔλ
    χίχίσʔληοτ
    ಈըϝλσʔλ
    IUUQXXXOJJBDKQDTDFOUFSJESOJDPOJDPIUNM
22. ఏ
    
    
    
    
    
    
    
    ڙ ג υϫϯΰ
    ࠃཱ৘ใֶݚڀॴ
23. /BWJHBUJPO 3PX 3PX 1BOFM 1BOFM 1BOFM
24. 2VFSZ ݕࡧΫΤϦΛೖྗ͢ΔҰ൪جຊͱͳΔύωϧ
    MVDFOFΫΤϦ͕ॻ͚Δ NPWJF@UZQFNQ NPWJF@UZQFqW
25. 'JMUFSJOH ݱࡏͷΫΤϦʹର͔͔͍ͯͬͯ͠ΔߜΓࠐΈ৚݅Λදࣔ ظؒͷߜΓࠐΈ NPWJF@UZQFͷߜΓࠐΈ
26. 4BWF
    
    -PBE FMBTUJDTFBSDIͷLJCBOBJOUΠϯσοΫε͔ΒอଘͱಡΈࠐΈ μογϡϘʔυΛ࡞ͬͨΒϦϩʔυલʹඞͣอଘʂ
27. )JTUPHSBN ࣌ܥྻσʔλΛදࣔ͢Δ
    Ұ൪࢖͏͜ͱʹͳΔύωϧ -JOFT #BST 1PJOUT
28. )JUT ΫΤϦ͝ͱͷ૯ώοτ݅਺ΛάϥϑԽ
29. 4QBSLMJOFT ΫΤϦ͝ͱͷ܏޲͚ͩΛՄࢹԽ IUUQTUXJUUFSDPNSBTIJELQDTUBUVT
30. 5FSNT GBDFUTͷ݁ՌΛ#BS
    1JF
    5BCMFͰάϥϑԽ ίϝϯτ਺ͷGBDFU
31. 5SFOET ࢦఆͨ࣌͠఺͔Βͷ஋ͷมԽΛදࣔ ʮલ೔ൺ/૿Ճʯ ʮલ೥ൺ.ݮগʯͳͲ
32. .BQ GBDFUͷ݁ՌΛ஍ਤ্ͰՄࢹԽ ೔ຊ஍ਤ͸1VMM
    SFRVFTUΛग़ͨ͠΋ͷͷٞ࿦தʜ
    IUUQTHJUIVCDPNFMBTUJDTFBSDILJCBOBQVMM
33. #FUUFS.BQ Ң౓ɾܦ౓ΛݩʹϚοϐϯά
34. 5BCMF ΫΤϦʹϚονͨ͠υΩϡϝϯτͷ಺༰Λදࣔ
35. $PMVNO ύωϧΛॎʹฒ΂ΒΕΔύωϧ
36. 5FYU )5.-
    NBSLEPXO
    QMBJO
    UFYUͰςΩετΛදࣔ
37. DEMO
38. ΫΤϦͷॻ͖ํ
39. λΠτϧʹʮՎͬͯΈͨʯΛؚΉಈը UJUMF
    lՎͬͯΈͨz ಈըܗࣜNQҎ֎ͷಈը NPWJF@UZQF
    NQ
    ࠶ੜ࣌ؒ෼ະຬͷಈը MFOHUI
    <
    50
    > λΠτϧʹʮՎͬͯΈͨʯΛؚΉNQಈը UJUMF
    lՎͬͯΈͨz
    "/%
    NPWJF@UZQF
    NQ /05 NPWJF@UZQF
    NQ ·ͨ͸ ࠶ੜ࣌ؒ෼ະຬͷಈը MFOHUI
    <
    50
    >
40. ෳ਺ͷΫΤϦͷ݁ՌΛൺֱ
41. ಈըܗࣜͷൺֱ GBDFUͰऔಘͨ͠Ωʔϫʔυ͔Βࣗಈతʹݕࡧ
42. ಈըϑΝΠϧαΠζͷฏۉ஋ ਺஋ϑΟʔϧυͷฏۉ஋ΛάϥϑԽ
    ଞʹɺ࠷େ஋ɺ࠷খ஋ɺ߹ܭ΋ܭࢉՄೳ
43. ࠓ೔ͷ͓࿩ wͳͥ,JCBOBʁ
    w,JCBOBͷ࢖͍ํ
    w,JCBOB
    5JQT
44. JOEFYͱUZQF MPHTUBTI BDDFTT@MPH JOEFY UZQF FWFOU@MPH UZQF MPHTUBTI BDDFTT@MPH JOEFY UZQF FWFOU@MPH UZQF MPHTUBTI BDDFTT@MPH JOEFY UZQF FWFOU@MPH UZQF ͭͷJOEFYʹҟͳΔεΩʔϚΛ࣋ͭσʔλΛೖΕΒΕΔ
    ͭͷJOEFYʹೖΕΔ͜ͱͰάϥϑΛॏͶͯൺֱͳͲ͕Ͱ͖Δ
45. NBQQJOH w NBQQJOH͸ࣗಈతʹఆٛ͞ΕΔ
    w େ֓ɺͪΐͬͱ͏·͍͔͘ͳ͍
    w ਺஋ܕ͕JOUFHFSͰ͸ͳ͘MPOHʹͳΔ
    w ύεจࣈྻ͕෼͔ͪॻ͖͞Εͯ͠·͏
    w ͳͲ
46. {! "template": "logstash-*",! "settings" : {! "number_of_shards" : 1,! "number_of_replicas" : 0! },! "mappings": {! “access_log": { ! "_source": { "compress": true },! "dynamic_templates": [! {! "string_template" : { ! "match" : "*",! "mapping": { "type": "string", "index": "not_analyzed" },! "match_mapping_type" : "string"! } ! }! ],! "properties" : {! "path" : {! "type": "multi_field",! "fields" : {! "analyzed" : {"type":"string", "index" : "analyzed"},! "no_analyzed": {"type":"string", "index" : "not_analyzed"}! }! },! "agent" : {! "type": "multi_field",! "fields" : {! "analyzed" : {"type":"string", "index" : "analyzed"},! "no_analyzed": {"type":"string", "index" : "not_analyzed"}! }! },! "referer" : {! "type": "multi_field",! "fields" : {! "analyzed" : {"type":"string", "index" : "analyzed"},! "no_analyzed": {"type":"string", "index" : "not_analyzed"}! }! },! "@timestamp" : { "type" : "date", "index" : "not_analyzed" }! }! }! }! } curl -XPUT localhost:9200/_template/logstash_template JOEFY
    UFNQMBUF MPHTUBTIͰ࢝·ΔJOEFYʹࣗಈతʹద༻ UZQF͕BDDFTT@MPHͷυΩϡϝϯτʹద༻ ͭͷϓϩύςΟΛෳ਺ͷpFMEʹల։ ෼͔ͪॻ͖Λ͠ͳ͍
47. ੑೳ w &$
    NMBSHF
    ʷ
    ୆
    w ೔ͷΠϯσοΫεαΠζ͕(#Λ௒͑Δ͋ͨΓͰ FMBTUJDTFBSDI͕٧·Γ࢝ΊΔ
    w 0VU0G.FNPSZ&SSPSͳͲΛు͍ͯ΄ͱΜͲJNQPSUΛड͚෇͚ ͳ͘ͳΔ
    w qVFOUEʹσʔλ͕ͨ·ΓόοϑΝΦʔόʔͰσʔλΛࣦ͏ʜ
48. ੑೳ w ͦͷޙɺ+7.ͷ($ύϥϝʔλνϡʔχϯάʹΑΓͳΜͱ͔҆ఆ
    w ϐʔΫ࣌Ͱ.CQTఔ౓ͷτϥϑΟοΫʹ଱͑ΒΕΔ͜ͱΛ֬ೝ νϡʔχϯάͷৄࡉʹ͍ͭͯ͸
    !DPO@NBNF
    
    
    
    
    
    ʹฉ͍͍ͯͩ͘͞ ΦϒδΣΫτ͕େྔʹੜ੒ɺ࡟আ͞ΕΔ͜ͱͰසൟʹ'VMM
    ($͕૸͍ͬͯͨͷ͕ݪҼ
    /FXྖҬͷαΠζΛ޿͛ͯ4DBWFOHF
    ($Ͱճऩ͞ΕΔΑ͏ʹ͢Δ͜ͱͰ'VMM
    ($ͷൃੜ ස౓ΛͰ͖Δ͚ͩԼ͛ΔΑ͏ʹͨ͠
49. ࠷৽৘ใΛ௥͏ w HJUIVCͷNBTUFS
    https://github.com/elasticsearch/kibana
    w ຖ೔ͷΑ͏ʹػೳ௥Ճ΍σβΠϯมߋ͕ى͖͍ͯ·͢
    w ͨ·ʹͪΐͬͱյΕͯ·͢
    w ެࣜCMPH
    http://www.elasticsearch.org/blog/ w ,JCBOBͷهࣄ͸ ϲ݄ʹຊͰ͕͢།Ұͷ৽ػೳ঺հ৘ใͰ͢
    w EFNPLJCBOBPSH
    http://demo.kibana.org/ w खͬऔΓૣ͘࠷৽൛ΛࢼͤΔ