OHSU is a nationally prominent research university and Oregon’s only academic health center. It educates health professionals and scientists and provides leading-edge patient care, community service, and biomedical research. With the visibility of Elastic and Elastiflow, they are able to see and fix performance and security issues before their users become aware of them. The increased visibility also helped them detect security threats and address weaknesses in network infrastructure. And it’s currently being scaled up to store one year of all network traffic that will be entirely on NVMe storage for expedient queries.

1. Increased visibility:
Opening the black
box of networks
Alexander Germain
Lead Network Architect
Oregon Health & Science University

2. When you run into something
interesting, drop everything
else and study it.
B.F. Skinner
“

6. Segmentation
● Windows 7 end of support
● Segmentation woes
● Trial and error

7. The Plan
● New challenges due to COVID
● Interdepartmental collaboration required
● A better way

8. ● Netflow?
● Elasticsearch + Elastiflow
● ELK?
A Brighter Future

9. ● SUCCESS!
● Wow.
● Endless use cases
Easy as E,L,K

10. ● Deploying at work
● “The next morning..”
● Problem solved
Who needs sleep?

11. ● Visibility is crucial
● Collecting all the things
● Current state
The Bigger Prize

12. Proof of concept environment
● “Commodity” hardware

13. ● ESwhat?
● Lets RACE!
ESrally
10.5.5.5
Benchmark Coordinator)
esrally
esrallyd
10.5.5.7 Load Driver)
Track
Data
esrallyd
10.5.5.6 Load Driver)
Track
Data
esrallyd
10.5.5.11
10.5.5.12
10.5.5.13
Benchmark
Candidate)
High Traffic (Data) Connection
Low Traffic (Control) Connection

14. ● Latency
● TCP & UDP
● Shard size and Bulk Requests
Tuning
Avg ~713μs
Data Center 1
Data Center 2

15. What do use Elasticsearch for?
● Troubleshooting
● Security investigations
● Visualizing and understanding complex systems
● Troubleshooting
● Security investigations
● Visualizing and understanding
complex systems
What do you use Elasticsearch for?

16. ● Volume, performance, bugs
● Elastiflow Unified Collector
Challenges

18. Thank you