ログ収集とパースの基礎

When your applications run, they generate messages about what they're doing. These messages are called logs.

Collecting these logs is crucial for understanding how your app is performing, finding errors, and debugging issues when things go wrong.

Logs can originate from various parts of your system:

• Application Code: Messages your app writes (e.g., user logged in, data saved).
• Server Systems: Operating system events, web server access logs (like Apache or Nginx).
• Databases: Messages about queries, connections, and performance.

Applications typically use logging libraries to generate logs. For demonstration, let's see how simple log-like messages might appear if printed directly by a program.

Try running this example:

Often, the most straightforward way for an application to store its logs is by writing them directly to a local file on the server where it's running.

• Logs are appended chronologically.
• To manage file size, log rotation (creating new files and archiving old ones) is commonly used.

While easy to set up, relying solely on local log files has limitations:

• It's hard to search across logs from many different servers.
• Analyzing trends or spotting patterns becomes very difficult.
• Logs can be lost if a server crashes and the files aren't backed up.

To overcome the challenges of local log files, we use log agents. A log agent is a small, lightweight program that runs on your server alongside your application.

Its main job is to collect log data from various sources and send it to a central logging system for storage and analysis.

Log agents typically 'tail' (continuously read new lines from the end of) log files. When new log lines appear, the agent reads them and forwards them.

• They handle network issues and buffer data if the central system is unavailable.
• Agents can also add useful metadata (like server IP, hostname) to logs before sending them.

Popular examples include Filebeat and Fluentd.

Logs often start as plain, unstructured text strings. Imagine trying to find all 'ERROR' messages related to a specific user in millions of text lines!

Parsing is the process of extracting meaningful pieces of information (like timestamp, log level, message, user ID) from these raw log lines and organizing them into a structured format.

When logs are structured, they become much easier to search, filter, and analyze. Instead of one long text string, you get key-value pairs that are machine-readable.

Example Raw Log:
ERROR: 2023-10-27 10:00:10 Failed to process order #123.

After Basic Parsing:

• level: ERROR
• timestamp: 2023-10-27 10:00:10
• message: Failed to process order #123.

In this lesson, we explored the basics of log collection and parsing:

• Logs are vital for understanding application health and debugging.
• Applications emit logs to files or standard output.
• Log agents collect these logs and forward them to a central location.
• Parsing transforms raw text logs into structured data, making them useful for analysis.

Next, we'll dive deeper into the architecture and benefits of centralized logging systems!