Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Logs hunting
Search
Olivier Dolbeau
April 09, 2015
Programming
1
2.9k
Logs hunting
Talk given at sfLive 2015 Paris
Olivier Dolbeau
April 09, 2015
Tweet
Share
More Decks by Olivier Dolbeau
See All by Olivier Dolbeau
Throw new \Exception(); Oui, mais laquelle ?
odolbeau
1
240
Jane & Webby
odolbeau
0
400
Translating a monolingual application
odolbeau
2
580
DX: Developer eXperience
odolbeau
1
98
DX: Developer eXperience
odolbeau
1
550
EasyAdminBundle introduction
odolbeau
0
180
REX API Platform
odolbeau
0
1.3k
Features flags at BlaBlaCar
odolbeau
5
1.1k
25+ million members in 22 countries, how to scale with Symfony2
odolbeau
2
510
Other Decks in Programming
See All in Programming
実践AIチャットボットUI実装入門
syumai
7
2.5k
「ちょっと古いから」って避けてた技術書、今だからこそ読もう
mottyzzz
1
160
NetworkXとGNNで学ぶグラフデータ分析入門〜複雑な関係性を解き明かすPythonの力〜
mhrtech
3
1k
iOSエンジニア向けの英語学習アプリを作る!
yukawashouhei
0
180
Web Components で実現する Hotwire とフロントエンドフレームワークの橋渡し / Bridging with Web Components
da1chi
3
1.9k
株式会社 Sun terras カンパニーデック
sunterras
0
230
CSC509 Lecture 03
javiergs
PRO
0
330
猫と暮らすネットワークカメラ生活🐈 ~Vision frameworkでペットを愛でよう~ / iOSDC Japan 2025
yutailang0119
0
220
2分台で1500examples完走!爆速CIを支える環境構築術 - Kaigi on Rails 2025
falcon8823
3
3.3k
Signals & Resource API in Angular: 3 Effective Rules for Your Architecture @BASTA 2025 in Mainz
manfredsteyer
PRO
0
100
プログラミングどうやる? ~テスト駆動開発から学ぶ達人の型~
a_okui
0
190
明日から始めるリファクタリング
ryounasso
0
120
Featured
See All Featured
How STYLIGHT went responsive
nonsquared
100
5.8k
GraphQLとの向き合い方2022年版
quramy
49
14k
Fashionably flexible responsive web design (full day workshop)
malarkey
407
66k
Context Engineering - Making Every Token Count
addyosmani
5
190
Gamification - CAS2011
davidbonilla
81
5.5k
The Cult of Friendly URLs
andyhume
79
6.6k
KATA
mclloyd
32
15k
A Modern Web Designer's Workflow
chriscoyier
697
190k
Building a Modern Day E-commerce SEO Strategy
aleyda
43
7.7k
The Straight Up "How To Draw Better" Workshop
denniskardys
237
140k
BBQ
matthewcrist
89
9.8k
Learning to Love Humans: Emotional Interface Design
aarron
274
40k
Transcript
LOGS HUNTING 1
WHO AM I? Olivier Dolbeau @odolbeau Work at BlaBlaCar 2
THIS IS AN ELK 3
4
5
6
Inputs Filters Outputs 41 inputs • syslog • udp •
varnishlog • gelf • … 50 filters • date • geoip • i18n • urldecode • … 55 outputs • elasticsearch • redis • email • graphite • … And there are also some codecs 7
Kibana 8
9
10
Which logs are we talking about? 11
12 Access Logs Population: High Difficulty: Easy Weapon
13 Application logs Population: Medium / Low Difficulty: Medium Weapon
Monolog <3
syslog 14 Syslog Population: Medium Difficulty: Easy Weapon RSYSLOG
*.* @127.0.0.1:514;RSYSLOG_ForwardFormat 15
input { udp { port => 514 type => syslog
} } Logstash - Input 16
filter { if [type] == "syslog" { grok { match
=> [ "message", "<%{POSINT:syslog_pri}>% {TIMESTAMP_ISO8601:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} % {DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: % {GREEDYDATA:syslog_message}" ] add_field => [ "received_at", "%{@timestamp}" ] add_field => [ "received_from", "%{host}" ] add_tag => [ "rsyslog" ] } } } Logstash - Filter 17
output { elasticsearch_http { host => “my_es.blablacar.com” port => 9200
index => "logstashv1-%{+YYYY.MM.dd}" manage_template => false } } Logstash - Output 18
19
syslog 20
21
@odolbeau 22 On recrute ! https://speakerdeck.com/odolbeau/logs-hunting