Centralized Logging-Patterns Philipp Krenn @xeraa @xeraa
Slide 1
Slide 2
@xeraa
Slide 3
@xeraa
Slide 4
@xeraa
Slide 5
@xeraa
Slide 6
@xeraa
Slide 7
@xeraa
Slide 8
@xeraa
Slide 9
@xeraa
Slide 10
Slide 11
Developer @xeraa
Slide 12
Questions: https://sli.do/xeraa Answers: https://twitter.com/xeraa @xeraa
Slide 13
@xeraa
Slide 14
@xeraa
Slide 15
@xeraa
Slide 16
@xeraa
Slide 17
Slide 18
Disclaimer I build highly monitored Hello World apps @xeraa
Slide 19
Example: Java SLF4J, Logback, MDC @xeraa
Slide 20
And Everywhere Else .NET: NLog JavaScript: Winston Python: structlog PHP: Monolog @xeraa
Slide 21
Anti-Pattern: print System.out.println("Oops"); @xeraa
Slide 22
Anti-Pattern: Coupling @xeraa
Slide 23
Slide 24
Slide 25
Parse @xeraa
Slide 26
@xeraa
Slide 27
Collect Log Lines filebeat.inputs: - type: log paths: - /mnt/logs/*.log #exclude_lines: ['^TRACE'] @xeraa
Slide 28
Slide 29
[2018-09-28 10:30:38.516] ERROR net.xeraa.logging.LogMe [main] user_experience= , session=46, loop=15 Wake me up at night java.lang.RuntimeException: Bad runtime... at net.xeraa.logging.LogMe.main(LogMe.java:30) ^[%{TIMESTAMP_ISO8601:timestamp}]%{SPACE}%{LOGLEVEL:level} %{SPACE}%{USERNAME:logger}%{SPACE}[%{WORD:thread}] %{SPACE}-%{SPACE}%{GREEDYDATA:mdc}%{SPACE}-%{SPACE} %{GREEDYDATA:themessage}(?:\n+(?<stacktrace>(?:.|\r|\n)+))? @xeraa
Slide 30
Elastic Common Schema https://github.com/ elastic/ecs @xeraa
Slide 31
Grok https://github.com/logstash-plugins/logstash-patterns-core/blob/ master/patterns/grok-patterns @xeraa
Slide 32
Dev Tools Grok Debugger @xeraa
Slide 33
Machine Learning Data Visualizer @xeraa
Slide 34
Visualize For example session @xeraa
Slide 35
Log UI @xeraa
Slide 36
Monitoring: Logstash Pipeline Plus other components @xeraa
Slide 37
Pro: No change Con: RegEx, timestamp, multiline @xeraa
Slide 38
Send @xeraa
Slide 39
@xeraa
Slide 40
Pro: No files Con: Outages & coupling @xeraa
Slide 41
Structure @xeraa
Slide 42
@xeraa
Slide 43
Collect JSON filebeat.input: - type: log paths: - /mnt/logs/*.json fields_under_root: true json: message_key: message keys_under_root: true processors: - add_host_metadata: ~ @xeraa
Slide 44
Pro: Right format Con: JSON serialization overhead @xeraa
Slide 45
Containerize @xeraa
Slide 46
@xeraa
Slide 47
Where to put Filebeat? Sidecar @xeraa
Slide 48
@xeraa
Slide 49
Default JSON Log filebeat.input: - type: log paths: - "/var/lib/docker/containers//.log" json.message_key: log json.keys_under_root: true processors: - decode_json_fields: fields: ["message"] target: "" overwrite_keys: true - add_docker_metadata: ~ - add_host_metadata: ~ @xeraa
Slide 50
Metadata { "host": "10.4.15.9", "port": 6379, "docker": { "container": { "id": "382184ecdb385cfd5d1f1a65f78911054c8511ae009635300ac28b4fc357ce51", "name": "my-java", "image": "my-java:1.0.0", "labels": { "app": "java" } } } } @xeraa
Slide 51
@xeraa
Slide 52
Mount Log Path my-java: container_name: my-java hostname: my-java build: ${PWD}/config/my-java networks: ['stack'] command: java -jar my-java.jar volumes: - ./logs/my-java/:/opt/my-java/logs/ filebeat: container_name: filebeat hostname: filebeat image: "docker.elastic.co/beats/filebeat:${ELASTIC_VERSION}" volumes: - ./logs/my-java/:/var/log/my-java/ - ./docker-compose/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro command: filebeat -e networks: ['stack'] @xeraa
Slide 53
Registry File filebeat.registry_file: /usr/share/filebeat/data/registry @xeraa
Slide 54
..-__ ''-._ _.-.. ''-._ .-.-```. ```\/ _.,_ ''-._ ( ' , .-` | `, ) |`-._`-...-` __...-.-.|'_.-'| |-.._ / _.-' |-._ -._-./ .-' .-' |-._-.-.__.-' _.-'_.-'| |-.-._ _.-'_.-' |-._ -._-..-'.-' .-' |-._-.-.__.-' _.-'_.-'| |-.-._ _.-'_.-' |-._ -._-..-'_.-' _.-' -._-..-' _.-' -._ _.-'-..-'
Redis 4.0.9 (00000000/0) 64 bit Running in stand alone mode Port: 6379 PID: 55757
http://redis.io
@xeraa
Slide 55
Configuration Templates filebeat.autodiscover: providers: - type: docker templates: - condition: equals: docker.container.image: redis config: - type: docker containers.ids: - "${data.docker.container.id}" exclude_lines: ["^\s+[\-`('.|_]"] @xeraa
Drop asciiart lines
Slide 56
Infrastructure UI @xeraa
Slide 57
Pro: Hot Con: Complexity @xeraa
Slide 58
Orchestrate @xeraa
Slide 59
@xeraa
Slide 60
Where to put Filebeat? DaemonSet @xeraa
Slide 61
Metadata Either in cluster or not processors: - add_kubernetes_metadata: in_cluster: true - add_kubernetes_metadata: in_cluster: false host: <hostname> kube_config: ${HOME}/.kube/config @xeraa
Slide 62
Metadata { "host": "172.17.0.21", "port": 9090, "kubernetes": { "container": { "id": "382184ecdb385cfd5d1f1a65f78911054c8511ae009635300ac28b4fc357ce51", "image": "my-java:1.0.0", "name": "my-java" }, "labels": { "app": "java", }, "namespace": "default", "node": { "name": "minikube" }, "pod": { "name": "java-2657348378-k1pnh" } }, } @xeraa
Slide 63
Configuration Templates filebeat.autodiscover: providers: - type: kubernetes templates: - condition: equals: kubernetes.namespace: redis config: - type: docker containers.ids: - "${data.kubernetes.container.id}" exclude_lines: ["^\s+[\-`('.|_]"] # Drop asciiart lines @xeraa
Slide 64
Customize Indices output.elasticsearch: index: "%{[kubernetes.namespace]:filebeat}-%{[beat.version]}-%{+yyyy.MM.dd}" @xeraa
Slide 65
Pro: Hot Con: Complexity++ @xeraa
Slide 66
Moar @xeraa
Slide 67
Architecture @xeraa ! "
Slide 68
Slide 69
Slide 70
Slide 71
Frozen Indices https://github.com/elastic/elasticsearch/issues/34352 @xeraa
Slide 72
Centralized Logstash & Beats Management @xeraa
Slide 73
Conclusion @xeraa
Slide 74
Examples https://github.com/xeraa/java-logging @xeraa
Slide 75
Parse Send Structure Containerize Orchestrate @xeraa
Slide 76
Questions? Philipp Krenn @xeraa @xeraa
