Skip to main content

Shipping and analysing MongoDB logs using the Streamsets Data Collector, ElasticSearch and Kibana

In order to show that the considerations done in my last post are general for any log shipping purpose, let's see now how the same process applies to a more real use case scenario: the log shipping and analysis of a MongoDB database logs.

MongoDB logs pattern

Starting from the release 3.0 (I am considering the release 3.2 for this post) the MongoDB logs come with the following pattern:

<timestamp> <severity> <component> [<context>] <message>

where:
  •     timestamp is in iso8601-local format.
  •     severity is the level associated to each log message. It is a single character field. Possible values are F (Fatal), E (Error), W (Warning), I (Informational) and D (Debug).
  •     component is for a functional categorization of the log message. Please refer to the specific release of MongoDB you're using to know the full list of possible values.
  •     context is the specific context for a message.
  •     message: don't think you need some explanation here ;)
So for this kind of logs we can use the following Grok pattern:

%{TIMESTAMP_ISO8601:timestamp} %{WORD:severity} %{WORD:component}  %{DATA:context} %{GREEDYDATA:message}

Please notice that there are 2 spaces between the component and the context.

Create an index on Elasticsearch

Now that we know the pattern of the MongoDB logs we can create an index for them in Elasticsearch:

curl -XPUT 'http://<es_host>:<es_port>/mdblogs' -d '{
    "mappings": {
        "nodelogs" : {
            "properties" : {
                "timestamp": {"type": "date"},
                "severity": {"type": "string"},
                "component": {"type": "string"},
                "context": {"type": "string"},
                "message": {"type": "string"}
            }
        }
    }
}'

Pipeline configuration

As soon as you have all of the required systems (an Elasticsearch cluster, Kibana, Streamsets Data Collector) up and running you can create a new pipeline in SDC cloning the one built in the other post and making just few configuration settings. You need to switch the File Tail origin path to the MongoDB logs directory, then choose the Grok Pattern as Log Format and use the Grok pattern defined above. Finally you have to choose the yyyy'-'MM'-'dd'T'HH':'mm':'ss format for the timestamp conversion in the Timestamp Field Converter stage.

Create a Kibana Dashboard

Create the index in Kibana as explained in the previous post and then you can start to search for the data and implement a custom dashboard like the one shown in the image below:
Labels:

Comments

Post a Comment

Popular posts from this blog

Exporting InfluxDB data to a CVS file

Sometimes you would need to export a sample of the data from an InfluxDB table to a CSV file (for example to allow a data scientist to do some offline analysis using a tool like Jupyter, Zeppelin or Spark Notebook). It is possible to perform this operation through the influx command line client. This is the general syntax: sudo /usr/bin/influx -database '<database_name>' -host '<hostname>' -username '<username>'  -password '<password>' -execute 'select_statement' -format '<format>' > <file_path>/<file_name>.csv where the format could be csv , json or column . Example: sudo /usr/bin/influx -database 'telegraf' -host 'localhost' -username 'admin'  -password '123456789' -execute 'select * from mem' -format 'csv' > /home/googlielmo/influxdb-export/mem-export.csv
6 comments
Read more

jOOQ: code generation in Eclipse

jOOQ allows code generation from a database schema through ANT tasks, Maven and shell command tools. But if you're working with Eclipse it's easier to create a new Run Configuration to perform this operation. First of all you have to write the usual XML configuration file for the code generation starting from the database: <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <configuration xmlns="http://www.jooq.org/xsd/jooq-codegen-2.0.4.xsd">   <jdbc>     <driver>oracle.jdbc.driver.OracleDriver</driver>     <url>jdbc:oracle:thin:@dbhost:1700:DBSID</url>     <user>DB_FTRS</user>     <password>password</password>   </jdbc>   <generator>     <name>org.jooq.util.DefaultGenerator</name>     <database>       <name>org.jooq.util.oracle.OracleDatabase</name>     ...
Post a Comment
Read more

Using Rapids cuDF in a Colab notebook

During last Spark+AI Summit Europe 2019 I had a chance to attend a talk from Miguel Martinez  who was presenting Rapids , the new Open Source framework from NVIDIA for GPU accelerated end-to-end Data Science and Analytics. Fig. 1 - Overview of the Rapids eco-system Rapids is a suite of Open Source libraries: cuDF cuML cuGraph cuXFilter I enjoied the presentation and liked the idea of this initiative, so I wanted to start playing with the Rapids libraries in Python on Colab , starting from cuDF, but the first attempt came with an issue that I eventually solved. So in this post I am going to share how I fixed it, with the hope it would be useful to someone else running into the same blocker. I am assuming here you are already familiar with Google Colab. I am using Python 3.x as Python 2 isn't supported by Rapids. Once you have created a new notebook in Colab, you need to check if the runtime for it is set to use Python 3 and uses a GPU as hardware accelerator. You...
5 comments
Read more