Logging, part 2:

Graylog

One tool to log 'em all


Piotr Przybył
piotr@przybyl.org
piotrprz
WrocławJUG, 2017-11-28

half full, half empty glass
telescope

Logging

can also be remote

syslog-ng, rsyslog
RFC3164 RFC5424 RFC5425 RFC5426

Graylog: Installation

https://www.graylog.org/download

Graylog: Installation

Big picture

Big picture

Big picture

Big picture

Big picture

Big picture

Attaching syslog

Simple

Logging

Programme

With Graylog

Attaching other machines

Log processing

  • streams
  • extractors
  • pipelines with rules

rule "fix timestamp (CET/CEST)"
when
    cidr_match("192.168.1.1/32", to_ip($message.gl2_remote_ip))
then
    let format = "yyyy-MM-dd HH:mm:ss.SSS";
    let recorded_date = to_date($message.timestamp);
    let formatted_date = format_date(recorded_date, format);
    let parsed_date = parse_date(formatted_date, format, "en", "Europe/Warsaw");
    set_field("timestamp", parsed_date);
end

Logging

From

Many

Instances

Searching

Alerts

Dashboards

Bigger picture

Bigger picture

Bigger picture

Bigger picture

Bigger picture

Bigger picture

Bigger picture

Some internal stuff

  • Swagger
  • Grizzly and Jersey
  • Shiro
  • Airlift
  • React.js
  • Guice

Marketplace

  • Plugins
  • Content packs
  • GELF libraries

Let's log something together!

SSID: nice.kitten

PASS: nice.kitten

http://nice.kitten

Graylog: one tool to log 'em all

Thanks a lot

Keep logging!

Piotr Przybył
piotrprz
Wrocław JUG, 2017-11-28
http://przybyl.org/pres/2017/WroclawJUG_graylog
loggerSample  loggerWebSample
qr