Blog Marcina Bojko

During my talks with multiple clients, there always was a lot of jam about ‚Observability‚ buzzword, mostly followed by ‚prometheus’, ‚grafana’, ‚sensu’, ‚datadog’ tags. However the statement above is quite right, the second question asked by me was ‚what about logs’. Here answers were not so unanimous. So we could get:

• What about them?
• Yes, we have them, on hosts
• We don’t care about logs, only (prometheus/sensu/grafana/metrics) matters!
• We’re sending them to some Linux host via Syslog and we can browse them later

Sounds familiar? Yup.

More advanced answers were dancing around ELK stack, some of them mentioned cloud-native solutions like Google’s StackDriver, Amazon CloudWatch Logs, Azure Monitor.
For simples cases (regarding: on-premise or cloud-based) we can use a smaller setup of Graylog – https://www.graylog.org/

It can be used as Enterprise Licensed stack for up to 5 GB of data per day. You can have advanced analytics, archiving (long term – as long as you please), alerts & event management, all in one box.

Sure, for production usage it’s recommended to rebuild this setup, having more than 1 node, but for simpler and non-performance-greedy usage this can be a good start.

You can deliver logs (WindowsLogs, TextFile logs, and AuditLogs using proper Beats – https://www.elastic.co/beats/)

• Filebeat (Text logs) – https://www.elastic.co/beats/filebeat
• WinLogBeats (Windows Event Viewer) – https://www.elastic.co/downloads/beats/winlogbeat
• Auditbeats – https://www.elastic.co/beats/auditbeat

As a simple starter you can try using this setup – available as Traefik proxied setup:

https://github.com/marcinbojko/graylog