12. Eberhard Wolff - @ewolff
date time level
1988-10-12 19:42:07.350 INFO 683 [http-nio-8080-exec-6] --- c.e.u.service.RegistrationService : email=eberhard.wolff@gmail.com geloesc
pid thread class logmessage
13. Eberhard Wolff - @ewolff
Scaling Elasticsearch
• More servers
• Shards
• Easy to set up
• Index per day or week or month
• Smaller dataset
14. Eberhard Wolff - @ewolff
Ideas about Logstash
• No parsing
• Send JSON
15. Eberhard Wolff - @ewolff
Break Logstash apart
• Logstash does parsing and
communication
• Not too sensible in a distributed
sytem
• Separate process per responsibility
16. Eberhard Wolff - @ewolff
Shipper
• Ship data from logging system
• Logstash
• Beaver
https://github.com/josegonzalez/
beaver
• Woodchuck
https://github.com/danryan/
woodchuck
17. Eberhard Wolff - @ewolff
Broker
• Buffer data for later processing
• Redis
• In-Memory NoSQL database
• Small
• Fast
• ...and then Parse (Logstash)