Any non-trivial solution will be spread across multiple servers in different data centers. A lot of system administrators use external tools for monitoring, health-checking, and alerts. In this session, we will discuss ways to build your own monitoring and alert system to keep an eye on all kinds of running systems.

1. Real Time Monitoring
December 26, 2015
Dina Abu Khader
1

2. Problem to Solve
2
Enrich Monitoring Visual Alerts History analytics access
Nagios NO NO NO YES NO NO customizable
Ganglia NO YES YES NO NO NO machine health
only
ELK YES YES* YES YES* YES YES customizable
Introduction to tools and services which monitor the Content, Data, Performance and
any attack on your application and alerts you, when you meet your threshold. To
ensure that your operations works smoothly.
* With a plugin

3. Why ELK
Old School
➔ grep/awk/cut/sort/sed
➔ Manually analyze the output
ELK
➔ Define endpoint (input / Ouput)
➔ Store data (Search and Visual)
3

4. Basic ELK Setup for Monitoring
4

5. Beats: Monitoring and Pulse Checks
New Product from Elastic.io, written in GO
Open Source Data shippers for many types of operational data, you can enrich this
data with LogStash, search and analyze in Elasticsearch, and visualize in Kibana.
Available Beats are TopBeats, PacketBeats, FileBeats and WinLogBeats.
5

6. LogStash: Basic stream processing/manipulation
Written in JRuby
It can Process any data from any source.
Centralize data processing of all types
Normalize varying schema and formats
Quickly extend to custom log formats
Easily add plugins for custom data sources
6

7. ElasticSearch: Document indexing/search
Open Source - Real Time Search server written in Java and based on Lucene.
Distributed, multitenant-capable full-text search engine
HTTP web Interface and semi-schema less JSON documents. (Dina Words)
Massive Distributed, High Availability, Document oriented
Per-Operation Persistence
7

8. Kibana: Real-time Visualization
Powerful front-end dashboard for visualizing indexed information from ElasticSearch
Capable to provide historical data in form of graphs, charts..etc
Real-time search of indexed information
8

9. ElastAlerts: Monitoring and Alerts!
ElastAlert, a framework developed in Yelp for alerting on anomalies, spikes or other
patterns of interest from data in Elasticsearch
It is configured by a set of rules, each of which defines a query, a rule type, and a set of
alerts.
Rules vary from frequency, spike, flatline, blacklist/whitelist, any and change.
Alerts types: Command, Email, Jira, SNS, HipChat, Slack and Debug.
9

10. ElasticSearch ELK Used in Industry
GitHub, https://github.com/search, you can look through 8 million repositories, users,
issues, pull requests and source code.
DataDog, Saas Infrasturce monitoring, Can handle up to 110 million events, boost
query performance by 20x
Stack OverFlow, Free text search engine
The Guardian, processing 40 million documents per day in ELK
10

11. Demo
15 minutes to install and run full
architecture
11