The middle thing is not what normies do, it is what enterprises do, because they have other needs than just knowing 'error where?'
Programmer Humor
Post funny things about programming here! (Or just rant about your favourite programming language.)
Rules:
- Posts must be relevant to programming, programmers, or computer science.
- No NSFW content.
- Jokes must be in good taste. No hate speech, bigotry, etc.
Do folks still use logstash here? Filebeat and ES gets you pretty far. I've never been deep in ops land though.
Please excuse my ignorance, but what is grep, what are the do's and dont's of logging and why are people here talking about having an entire team maintain some pipeline just to handle logs?
It's a command line tool which filters for all lines containing the query. So something like
cat log.txt | grep Error5
Would output only lines containing Error5
or if its a complex error cat log.txt|grep keyword1|grep keyword 2 and so on.
You can just do
grep Error5 log.txt
In the back of my mind I know this is there, but the cat | grep
pattern is just muscle memory at this point
for me as well.
Just remember that if you aren't actually concatenating files, cat
is always unnecessary.
I've been 'told off' so many times by the internet for my cat and grep combos that I still do it, then I remove the cat, it still works, and I feel better. shrug
...or as I've come to call it grep+linux
As someone who used to troubleshoot an extremely complex system for my day job, I can say I've worked my way across the entire bell curve.
What the fuck is center even talking about? Is that shit a thing people do?
Yeah, ofc it is.
I'm working in a system that generates 750 MILLION non-debug log messages a day (And this isn't even as many as others).
Good luck grepping that, or making heads or tails of what you need.
We put a lot of work into making the process of digging through logs easier. The absolute minimum we can do it dump it into elastic so it's available in Kibana.
Similarly, in a K8 env you need to get logs off of your pods, ASAP, because pods are transient, disposable. There is no guarantee that a particular pod will live long enough to have introspectable logs on that particular instance (of course there is some log aggregation available in your environment that you could grep. But they actually usefulness of it is questionable especially if you don't know what you need to grep for).
These are dozens, hundreds, more problems that crop up as you scale the number of systems and people working on those systems.
This write-up can be the next KRAZAM skit
A good chunk of it is relating to the elastic search stack, yeah it's a thing people do.
My life got so much better after we abandoned elasticsearch at work
Why grep log files when I can instead force corporate to pay a fuck ton of money for a Splunk license.
It's such an insane amount of money