Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up
for free
Kibana入門
Yusuke Mito
November 12, 2013
Technology
63
48k
Kibana入門
第2回elasticsearch勉強会の発表資料です。
Kibanaの基本的な使い方について網羅的にまとめました。
Yusuke Mito
November 12, 2013
Tweet
Share
More Decks by Yusuke Mito
See All by Yusuke Mito
y310
7
2.6k
y310
0
140
y310
11
5.1k
y310
0
2k
y310
2
1.5k
Other Decks in Technology
See All in Technology
bells17
1
690
apcom
1
490
fujiihda
8
1.2k
kilometer
0
160
seto_hi
0
130
sky_joker
0
130
yosuke_furukawa
PRO
48
16k
clustervr
0
210
oracle4engineer
0
2.8k
hololab
0
350
kentaro
1
440
muras
0
120
Featured
See All Featured
garrettdimon
287
110k
pauljervisheath
195
15k
mojombo
358
62k
lara
172
9.5k
cromwellryan
101
5.9k
holman
448
130k
reverentgeek
27
1.9k
denniskardys
220
120k
wjessup
338
16k
philhawksworth
192
8.8k
schacon
145
6.6k
robhawkes
52
2.8k
Transcript
,JCBOBೖ ਫށ༞հ!Z@
୭ʁ
! ਫށ༞հ.JUP:VTVLF $00,1"%גࣜձٕࣾज़෦ ΞϓϦέʔγϣϯΤϯδχΞ ҎલαʔϏε։ൃɺ࠷ۙ3&45"1*ͷ։ൃͳͲ Z !Z@
,JCBOB
ࠓͷ͓ wͳͥ,JCBOBʁ w,JCBOBͷ͍ํ w,JCBOB5JQT
ࠓͷ͓ wͳͥ,JCBOBʁ w,JCBOBͷ͍ํ w,JCBOB5JQT
·ͣجຊใ͔Β
,JCBOBͱʁ w ϩάղੳՄࢹԽπʔϧ w MPHTUBTIͰूΊͨϩάΛՄࢹԽ͢ΔͨΊʹ࡞ΒΕͨ w ʹ&MBTUJDTFBSDIͷެࣜπʔϧԽ w IUUQTHJUIVCDPNFMBTUJDTFBSDILJCBOB w
MPHTUBTIͷґଘͳ͘ɺqVFOUEͳͲ؆୯ʹ࿈ܞՄೳ
ߏ &MBTUJDTFBSDI ,JCBOB MPHTUBTI qVFOUE
ಛ w,JCBOBࣗମ)5.-$44+4ͷΈ wͭ·Γ8FCαʔό͚ͩͰ৴Մೳ XHFUIUUQEPXOMPBEFMBTUJDTFBSDIPSHLJCBOBLJCBOBLJCBOBMBUFTU[JQ VO[JQLJCBOBMBUFTU[JQ SVCZSTJOBUSBFTFUQVCMJD@EJS lLJCBOBMBUFTU
ಛ ύωϧΛՃͯ͠ ΈͷμογϡϘʔυΛ࡞ΕΔ
ಛ w࡞ͬͨμογϡϘʔυ FMBTUJDTFBSDIʹอଘ wετϨʔδෆཁ
,JCBOBΛ͏ཧ༝
ϩάΛݟΔͱ͖ʹ Α͋͘Δ͜ͱ
ຖճݟ͍͕ͨ݅มΘΔ ͋ΔϢʔβͷΞΫηεΛ͍ͨ͠ ͜ͷϖʔδʹΞΫηε͞Εͨճ J04ͱ"OESPJEͷΞΫηεൺ ฏۉϨεϙϯελΠϜ FUDʜ
ૉૣ͘Λݟ͍ͨ ϐʔΫλΠϜԿ࣌ࠒʁ ٳͷτϥϑΟοΫฏʹൺͯͲ͏ʁ Τϥʔى͖͍ͯͳ͍ʁ FUDʜ
Ͱɺৄࡉݟ͍ͨ ͜ͷ࣌ͷΫΤϦύϥϝʔλԿʁ ͜ͷάϥϑͷεύΠΫԿʁ Ͳ͔͜Β͜ͷϖʔδʹདྷͨͷʁ FUDʜ
ݟ͍ͨ࣌ʹ ݟ͍ͨใΛ ૉૣ͘
,JCBOBͳΒશ෦Ͱ͖Δ
ࠓͷ͓ wͳͥ,JCBOBʁ w,JCBOBͷ͍ํ w,JCBOB5JQT
αϯϓϧσʔλ χίχίσʔληοτಈըϝλσʔλ IUUQXXXOJJBDKQDTDFOUFSJESOJDPOJDPIUNM
ఏڙ ג υϫϯΰ ࠃཱใֶݚڀॴ
/BWJHBUJPO 3PX 3PX 1BOFM 1BOFM 1BOFM
2VFSZ ݕࡧΫΤϦΛೖྗ͢ΔҰ൪جຊͱͳΔύωϧ MVDFOFΫΤϦ͕ॻ͚Δ NPWJF@UZQFNQ NPWJF@UZQFqW
'JMUFSJOH ݱࡏͷΫΤϦʹର͔͔͍ͯͬͯ͠ΔߜΓࠐΈ݅Λදࣔ ظؒͷߜΓࠐΈ NPWJF@UZQFͷߜΓࠐΈ
4BWF-PBE FMBTUJDTFBSDIͷLJCBOBJOUΠϯσοΫε͔ΒอଘͱಡΈࠐΈ μογϡϘʔυΛ࡞ͬͨΒϦϩʔυલʹඞͣอଘʂ
)JTUPHSBN ࣌ܥྻσʔλΛදࣔ͢Δ Ұ൪͏͜ͱʹͳΔύωϧ -JOFT #BST 1PJOUT
)JUT ΫΤϦ͝ͱͷ૯ώοτ݅ΛάϥϑԽ
4QBSLMJOFT ΫΤϦ͝ͱͷ͚ͩΛՄࢹԽ IUUQTUXJUUFSDPNSBTIJELQDTUBUVT
5FSNT GBDFUTͷ݁ՌΛ#BS 1JF 5BCMFͰάϥϑԽ ίϝϯτͷGBDFU
5SFOET ࢦఆ͔ͨ࣌͠ΒͷͷมԽΛදࣔ ʮલൺ/૿Ճʯ ʮલൺ.ݮগʯͳͲ
.BQ GBDFUͷ݁ՌΛਤ্ͰՄࢹԽ ຊਤ1VMMSFRVFTUΛग़ͨ͠ͷͷٞதʜ IUUQTHJUIVCDPNFMBTUJDTFBSDILJCBOBQVMM
#FUUFS.BQ ҢɾܦΛݩʹϚοϐϯά
5BCMF ΫΤϦʹϚονͨ͠υΩϡϝϯτͷ༰Λදࣔ
$PMVNO ύωϧΛॎʹฒΒΕΔύωϧ
5FYU )5.- NBSLEPXO QMBJOUFYUͰςΩετΛදࣔ
DEMO
ΫΤϦͷॻ͖ํ
λΠτϧʹʮՎͬͯΈͨʯΛؚΉಈը UJUMFlՎͬͯΈͨz ಈըܗࣜNQҎ֎ͷಈը NPWJF@UZQFNQ ࠶ੜ࣌ؒະຬͷಈը MFOHUI< 50> λΠτϧʹʮՎͬͯΈͨʯΛؚΉNQಈը UJUMFlՎͬͯΈͨz"/%NPWJF@UZQFNQ /05
NPWJF@UZQFNQ ·ͨ ࠶ੜ࣌ؒະຬͷಈը MFOHUI< 50>
ෳͷΫΤϦͷ݁ՌΛൺֱ
ಈըܗࣜͷൺֱ GBDFUͰऔಘͨ͠Ωʔϫʔυ͔Βࣗಈతʹݕࡧ
ಈըϑΝΠϧαΠζͷฏۉ ϑΟʔϧυͷฏۉΛάϥϑԽ ଞʹɺ࠷େɺ࠷খɺ߹ܭܭࢉՄೳ
ࠓͷ͓ wͳͥ,JCBOBʁ w,JCBOBͷ͍ํ w,JCBOB5JQT
JOEFYͱUZQF MPHTUBTI BDDFTT@MPH JOEFY UZQF FWFOU@MPH UZQF MPHTUBTI BDDFTT@MPH JOEFY
UZQF FWFOU@MPH UZQF MPHTUBTI BDDFTT@MPH JOEFY UZQF FWFOU@MPH UZQF ͭͷJOEFYʹҟͳΔεΩʔϚΛ࣋ͭσʔλΛೖΕΒΕΔ ͭͷJOEFYʹೖΕΔ͜ͱͰάϥϑΛॏͶͯൺֱͳͲ͕Ͱ͖Δ
NBQQJOH w NBQQJOHࣗಈతʹఆٛ͞ΕΔ w େ֓ɺͪΐͬͱ͏·͍͔͘ͳ͍ w ܕ͕JOUFHFSͰͳ͘MPOHʹͳΔ w ύεจࣈྻ͕͔ͪॻ͖͞Εͯ͠·͏ w
ͳͲ
{! "template": "logstash-*",! "settings" : {! "number_of_shards" : 1,! "number_of_replicas"
: 0! },! "mappings": {! “access_log": { ! "_source": { "compress": true },! "dynamic_templates": [! {! "string_template" : { ! "match" : "*",! "mapping": { "type": "string", "index": "not_analyzed" },! "match_mapping_type" : "string"! } ! }! ],! "properties" : {! "path" : {! "type": "multi_field",! "fields" : {! "analyzed" : {"type":"string", "index" : "analyzed"},! "no_analyzed": {"type":"string", "index" : "not_analyzed"}! }! },! "agent" : {! "type": "multi_field",! "fields" : {! "analyzed" : {"type":"string", "index" : "analyzed"},! "no_analyzed": {"type":"string", "index" : "not_analyzed"}! }! },! "referer" : {! "type": "multi_field",! "fields" : {! "analyzed" : {"type":"string", "index" : "analyzed"},! "no_analyzed": {"type":"string", "index" : "not_analyzed"}! }! },! "@timestamp" : { "type" : "date", "index" : "not_analyzed" }! }! }! }! } curl -XPUT localhost:9200/_template/logstash_template JOEFYUFNQMBUF MPHTUBTIͰ࢝·ΔJOEFYʹࣗಈతʹద༻ UZQF͕BDDFTT@MPHͷυΩϡϝϯτʹద༻ ͭͷϓϩύςΟΛෳͷpFMEʹల։ ͔ͪॻ͖Λ͠ͳ͍
ੑೳ w &$NMBSHFʷ w ͷΠϯσοΫεαΠζ͕(#Λ͑Δ͋ͨΓͰ FMBTUJDTFBSDI͕٧·Γ࢝ΊΔ w 0VU0G.FNPSZ&SSPSͳͲΛు͍ͯ΄ͱΜͲJNQPSUΛड͚͚ ͳ͘ͳΔ w
qVFOUEʹσʔλ͕ͨ·ΓόοϑΝΦʔόʔͰσʔλΛࣦ͏ʜ
ੑೳ w ͦͷޙɺ+7.ͷ($ύϥϝʔλνϡʔχϯάʹΑΓͳΜͱ͔҆ఆ w ϐʔΫ࣌Ͱ.CQTఔͷτϥϑΟοΫʹ͑ΒΕΔ͜ͱΛ֬ೝ νϡʔχϯάͷৄࡉʹ͍ͭͯ !DPO@NBNFʹฉ͍͍ͯͩ͘͞ ΦϒδΣΫτ͕େྔʹੜɺআ͞ΕΔ͜ͱͰසൟʹ'VMM($͕͍ͬͯͨͷ͕ݪҼ /FXྖҬͷαΠζΛ͛ͯ4DBWFOHF($Ͱճऩ͞ΕΔΑ͏ʹ͢Δ͜ͱͰ'VMM($ͷൃੜ සΛͰ͖Δ͚ͩԼ͛ΔΑ͏ʹͨ͠
࠷৽ใΛ͏ w HJUIVCͷNBTUFShttps://github.com/elasticsearch/kibana w ຖͷΑ͏ʹػೳՃσβΠϯมߋ͕ى͖͍ͯ·͢ w ͨ·ʹͪΐͬͱյΕͯ·͢ w ެࣜCMPHhttp://www.elasticsearch.org/blog/ w
,JCBOBͷهࣄ ϲ݄ʹຊͰ͕͢།Ұͷ৽ػೳհใͰ͢ w EFNPLJCBOBPSHhttp://demo.kibana.org/ w खͬऔΓૣ͘࠷৽൛ΛࢼͤΔ