Shipping and analysing MongoDB logs using the Streamsets Data Collector, ElasticSearch and Kibana

In order to show that the considerations done in my last post are general for any log shipping purpose, let's see now how the same process applies to a more real use case scenario: the log shipping and analysis of a MongoDB database logs.

MongoDB logs pattern

Starting from the release 3.0 (I am considering the release 3.2 for this post) the MongoDB logs come with the following pattern:

<timestamp> <severity> <component> [<context>] <message>

where:

•     timestamp is in iso8601-local format.
•     severity is the level associated to each log message. It is a single character field. Possible values are F (Fatal), E (Error), W (Warning), I (Informational) and D (Debug).
•     component is for a functional categorization of the log message. Please refer to the specific release of MongoDB you're using to know the full list of possible values.
•     context is the specific context for a message.
•     message: don't think you need some explanation here ;)

So for this kind of logs we can use the following Grok pattern:

%{TIMESTAMP_ISO8601:timestamp} %{WORD:severity} %{WORD:component}  %{DATA:context} %{GREEDYDATA:message}

Please notice that there are 2 spaces between the component and the context.

Create an index on Elasticsearch

Now that we know the pattern of the MongoDB logs we can create an index for them in Elasticsearch:

curl -XPUT 'http://<es_host>:<es_port>/mdblogs' -d '{
    "mappings": {
        "nodelogs" : {
            "properties" : {
                "timestamp": {"type": "date"},
                "severity": {"type": "string"},
                "component": {"type": "string"},
                "context": {"type": "string"},
                "message": {"type": "string"}
            }
        }
    }
}'

Pipeline configuration

As soon as you have all of the required systems (an Elasticsearch cluster, Kibana, Streamsets Data Collector) up and running you can create a new pipeline in SDC cloning the one built in the other post and making just few configuration settings. You need to switch the File Tail origin path to the MongoDB logs directory, then choose the Grok Pattern as Log Format and use the Grok pattern defined above. Finally you have to choose the yyyy'-'MM'-'dd'T'HH':'mm':'ss format for the timestamp conversion in the Timestamp Field Converter stage.

Create a Kibana Dashboard

Create the index in Kibana as explained in the previous post and then you can start to search for the data and implement a custom dashboard like the one shown in the image below: