Monitor your containers with the Elastic Stack
summary
Shows how the Elastic Stack actually collects container data: use filebeat to tail Docker’s json-file logs or mounted volumes, choose syslog/journald/GELF alternatives, run metricbeat as a sidecar to read cgroups or use the Docker API (community dockbeat merged into metricbeat 5.x), and capture HTTP/DB wire metrics with packetbeat. Demonstrates Kibana dashboards, Elasticsearch storage tweaks for metrics, Docker images on Elastic’s registry (no latest tag), and warns about exposed ES instances and recommended firewall/proxy/security plugin fixes.
AI-written summary · about
chapters (17)
- 0:00Start
- 0:47Who uses more than 10 servers / containers?
- 0:57How do you log?
- 1:42What are logs?
- 6:38Elastic Stack
- 9:54Filebeat
- 10:40At-Least-Once, Backpressure, and Graceful Downtime
- 13:08Multiline Filtering JSON Decode
- 13:55Logging with Docker 101 options
- 18:47Read cgroup data from /proc/ Part of the system module
- 19:04No Docker API access required Security
- 19:52Enriches process information automatically with cgroup data
- 21:29In Metricbeat 5.1+
- 24:34Packetbeat
- 45:13PS: Ransom
- 50:02Private network only Firewall
- 52:11Conclusion
related talks
35mFull Stack Visibility with Elastic: Logs, Metrics and Traces
46mMonitoring and metrology for containers
34mMonitor Kubernetes cluster with Elastic
50mMonitoring and metrology for containers
32mELK Stack: Use in Performance Testing and More
28mYou’re monitoring containers wrong
31m360° Monitoring of Your Services
14mCentralized Logs using ELK (Elasticsearch, Logstash, Kibana) Stack
