Logstash, Beats, Elastic Agent,
Open Telemetry
What’s the Right Choice?
Philipp Krenn @xeraa
Logstash
@xeraa
@xeraa
@xeraa
"Logstash is slow"
@xeraa
Beats
@xeraa
@xeraa
Lightweight Shippers
Filebeat, Metricbeat, Heartbeat, Winlogbeat,
Packetbeat, Auditbeat
@xeraa
With Logstash?
@xeraa
Enrich, Filter, JavaScript on Beats
@xeraa
Beats Modules
nginx, System, Docker, Elasticsearch,...
@xeraa
@xeraa
Ingest pipeline monitoring?
@xeraa
Elastic Agent
@xeraa
One Agent to Rule Them All
Beats + integrations
https://www.elastic.co/integrations/data-integrations
@xeraa
More Than Beats
Endpoint protection, OSQuery, eBPF, OPA
@xeraa
@xeraa
Agent Standalone
YAML
@xeraa
More Coming
v2 architecture, disk spooling, Kafka output,...
@xeraa
Open Telemetry
@xeraa
Traces
Metrics
Logs
@xeraa
"Support Elastic Common Schema
in OpenTelemetry"
https://github.com/open-telemetry/oteps/pull/199
@xeraa
Conclusion
@xeraa
Ingestion Inertia
@xeraa
@xeraa
@xeraa
@xeraa
Logstash, Beats, Elastic Agent,
Open Telemetry
What’s the Right Choice?
Philipp Krenn @xeraa

OSMC 2022 | Logstash, Beats, Elastic Agent, Open Telemetry — what’s the right choice? by Philipp Krenn