take control of logs with...
TRANSCRIPT
![Page 1: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/1.jpg)
TAKE CONTROL OF LOGS WITH ELASTICSEARCH
![Page 2: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/2.jpg)
AGENDA
• Benefits of Collec;ng Log Data
• Why Use Elas;csearch (and the Elas;c Stack)
• Using the Elas;c Stack to Collect Logs
• Learning about your System
![Page 3: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/3.jpg)
Why Collect Log Data?
![Page 4: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/4.jpg)
WHAT LOGS TELL US
• Local error messages
• Isolated data
• Point-in-;me data
![Page 5: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/5.jpg)
LOG SOURCES
• PIA_Access
• Servlet Logs (IDDA)
• APPSRV
• Anything you want
![Page 6: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/6.jpg)
BENEFITS
• Search for log data in one loca;on
• Correlate events between servers
• See trends in log events
• Collect data for future decisions
• Capture overall system health
• Make preSy graphs!
![Page 7: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/7.jpg)
Why Elasticsearch?
![Page 8: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/8.jpg)
ELASTICSEARCH ADVANTAGES
• Control your own data
• You already (or will soon) use Elas;csearch
• Collect only the data you want
• Does not require PeopleSoW Performance Monitor
• Collect more than PeopleSoW data
• Easily build your own metrics
• Free and open source
![Page 9: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/9.jpg)
ELASTICSEARCH VERSIONS
• PeopleTools uses Elas;csearch 2.3.2 • Kibana 4.5, Logstash 2.4
• Elas;c Stack 5.3 is latest
• Can I use my PeopleSoW Elas;c install for logs? • orcl_acl plugin breaks Kibana
• https://community.oracle.com/ideas/16330
• License Restrictions
![Page 10: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/10.jpg)
Using the Elastic Stack
![Page 11: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/11.jpg)
ELASTIC STACK ARCHITECTURE
Enrich Index SearchCollect
![Page 12: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/12.jpg)
INSTALL ELASTIC STACK
Elas%csearch 1. Download Elasticsearch
2. Unzip Elasticsearch
3. Run bin\elasticsearch.bat
Kibana 1. Download Kibana
2. Unzip Kibana
3. Run bin\kibana.bat
![Page 13: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/13.jpg)
INSTALL ELASTIC STACK
Logstash 1. Download Logstash
2. Unzip Logstash
3. Configure Filters
4. Run bin\logstash.bat
![Page 14: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/14.jpg)
INSTALL ELASTIC STACK
Filebeat 1. Download Filebeat
2. Unzip Filebeat
3. Configure Files and Output
4. Run bin\filebeat.bat
Topbeat/Metricbeat 1. Download Topbeat
2. Unzip Topbeat
3. Configure Output
4. Run bin\topbeat.bat
![Page 15: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/15.jpg)
INSTALL FILEBEAT
• Install Filebeat with Puppetpuppet module install pcfens-filebeat
• Configure Logstash output with Puppet class { 'filebeat': outputs => { 'logstash' => { 'hosts' => [ 'elastic.psadmin.io:5044', ], }, }, }
![Page 16: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/16.jpg)
CONFIGURE FILEBEAT
filebeat: prospectors: - paths: - /psoft/logs/HRAPP003P/PIA/PIA_access.log fields: domain: hr92prd server_type: webApp region: PRD host: hrapp003p input_type: log document_type: access_log scan_frequency: 10s tail_files: true
![Page 17: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/17.jpg)
CONFIGURE FILEBEAT
$pia_domain_list.each |$domain_name, $pia_domain_info| { filebeat::prospector {"${domain_name}-web": paths => [ "${pia_domain_info['ps_cfg_home_dir']}/webserv/${domain_name}/servers/PIA/logs/PIA_access.log", ], doc_type => 'access_log', input_type => 'log', ignore_older => '24h', fields_under_root => 'true', tail_files => 'true', fields => { domain => "${domain_name}", server_type => hiera('server_type'), region => hiera('region'), } } }
![Page 18: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/18.jpg)
LOGSTASH CONFIGURATION
• Give structure to incoming data
• Collect, Enrich, Transport • input{} • filter{} • output{}
![Page 19: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/19.jpg)
CONFIGURE LOGSTASH
input { beats { type => beats port => 5044 } } filter { } output { elasticsearch { hosts => [“elastic.psadmin.io:9200”] workers => 4 index => "logstash-%{+YYYY.MM.dd}" } }
![Page 20: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/20.jpg)
LOGSTASH FILTERS
filter { grok { match => { "message" => “%{WL_IO_EXTENDED}"} } grok { match => { "request" => “%{PS_URI_REQUEST}"} } date { match => [ "timestamp", "MMM dd yyyy HH:mm:ss","MMM d yyyy HH:mm:ss", "ISO8601" ] } useragent { source => “useragent”, target => “agent”
} }
![Page 21: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/21.jpg)
GROK EXPRESSIONS
/psc/hr92prd/EMPLOYEE/HRMS/c/ROLE_MANAGER.TL_MSS_EE_SRCH_PRD.GBL
PS_URI_REQUEST %{WORD:servlet}(/%{WORD:site_name})?(/%{WORD:portal}/%{WORD:node}/)?(%{WORD:content_type}/(%{PS_WEBLIB:iscript}|%{WORD:menu}\.%{PS_COMPONENT:component})?)?(\?%{GREEDYDATA:query_string})?
PS_COMPONENT %{WORD:componentName}\.%{WORD:market}
hSp://grokdebug.herokuapp.com
![Page 22: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/22.jpg)
Explore Log Data!
![Page 23: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/23.jpg)
![Page 24: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/24.jpg)
![Page 25: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/25.jpg)
![Page 26: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/26.jpg)
![Page 27: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/27.jpg)
![Page 28: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/28.jpg)
![Page 29: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/29.jpg)
![Page 30: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/30.jpg)
![Page 31: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/31.jpg)
![Page 32: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/32.jpg)
![Page 33: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/33.jpg)
![Page 34: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/34.jpg)
![Page 35: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/35.jpg)
![Page 36: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/36.jpg)
![Page 37: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/37.jpg)
![Page 38: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/38.jpg)
![Page 39: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/39.jpg)
![Page 40: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/40.jpg)
OPERATIONS DASHBOARD
![Page 41: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/41.jpg)
OPERATIONS DASHBOARD
![Page 42: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/42.jpg)
OPERATIONS DASHBOARD
![Page 43: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/43.jpg)
OPERATIONS DASHBOARD
![Page 44: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/44.jpg)
TRAFFIC DASHBOARD
![Page 45: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/45.jpg)
TRAFFIC DASHBOARD
![Page 46: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/46.jpg)
SERVER DASHBOARD
![Page 47: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/47.jpg)
SERVER DASHBOARD
![Page 48: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/48.jpg)
SERVER DASHBOARD
![Page 49: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/49.jpg)
SPONTANEOUS STRESS TEST
![Page 50: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/50.jpg)
SHARE DATA
![Page 51: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/51.jpg)
LOG CORRELATION
![Page 52: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/52.jpg)
LOG CORRELATION
![Page 53: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/53.jpg)
DATA RETENTION
• Elas;c Curator
• Define reten;on ;mes per index • curator --host servername --port 9200 delete indices --older-than 21 --time-unit days
--timestring %%Y.%%m.%%d
![Page 55: TAKE CONTROL OF LOGS WITH ELASTICSEARCHapps.questdirect.org/eweb/upload/CFP_Files/Take_Control_of...• orcl_acl plugin breaks Kibana ... Take Control of PeopleSoft Logs - Reconnect](https://reader031.vdocuments.site/reader031/viewer/2022030414/5a9fa0847f8b9a6c178cfa83/html5/thumbnails/55.jpg)
PleaseCompleteYour SessionEvaluationEvaluatethissessioninyourCOLLABORATEapp.Pullupthissessionandtap"SessionEvaluation" tocompletethesurvey.
SessionID: 100570