[Openstack-operators] OpenSource ELK configurations

Jesse Pretorius jesse.pretorius at gmail.com
Fri May 29 16:55:23 UTC 2015

On 27 May 2015 at 20:58, Joe Gordon <joe.gordon0 at gmail.com> wrote:

> On Wed, May 27, 2015 at 12:27 PM, Joseph Bajin <josephbajin at gmail.com>
> wrote:
>> I think those from the Infra Project are a great start, but I do think
>> they are missing a lot.
> I am sure they are, and we would love contributions to make them better.
> The filters from the infra project are used every day by developers use to
> hunt down issues. And the more similar the developer and operator
> experience is here the easier it will be for the two groups to talk about
> the same problems.

As part of development for Rackspace Private Cloud we've done a ton of work
in this space and are happy to contribute the work upstream. The current
work is exposed in https://github.com/rcbops/rpc-extras/pull/123 and is
available for anyone to review/comment/consume.

> Instead of breaking down the message into parts, it just breaks down the
>> type (INFO, DEBUG, etc) and then makes the rest of the message greedy.
>> That doesn't help searching or graphing or anything like that (or at least
>> makes it more difficult over time). At least that is what I have seen.
> One of the reasons for this is because most of the log messages are very
> unstructured. But I have a hunch we can do better then what we have today.

We've done quite a bit of this. We extract transaction ID's for each
project we deploy (including swift), response times to API queries, byte
sizes, etc.

> We are using a little bit tweaked version of the godaddy's scripts.  That
>> seems to give us a good amount of detail that we can search and filter on.
>> I'll see if I can post my versions of them to the repo.
We derived some stuff from https://github.com/godaddy/openstack-logstash
and other stuff from https://github.com/osops/tools-logging - I think it's
time that we find a common place to consolidate and standardise.
openstack-infra would appear to be a good place to do this.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-operators/attachments/20150529/ecd09ee3/attachment.html>

More information about the OpenStack-operators mailing list