Centralized Logging Patterns

A presentation at Jfokus in in Stockholm, Sweden by Philipp Krenn

Most organizations feel the need to centralize their logs — once you have more than a couple of systems, SSH and tail will not serve you well any more. This talk presents multiple approaches and patterns with their advantages and disadvantages:

  • Parse: Take the log files of your applications and extract the relevant pieces of information.
  • Send: Add a log appender to send out your events directly without persisting them to a log file.
  • Structure: Write your events in a structured file, which you can then centralize.
  • Containerize: Keep track of short lived containers and configure their logging correctly.
  • Orchestrate: Stay on top of your logs even when services are short lived and dynamically allocated on Kubernetes.

Video

Resources

The following resources were mentioned during the presentation or are useful additional information.

Buzz and feedback

Here’s what was said about this presentation on Twitter.