Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Logstash ready for use (log/event collection, searching, graphing)

code.google.com

Post reply on HN
Print view View original

1–10 of 12 posts

Re: Logstash ready for use (log/event collection, searching, graphing)

#4

Post by _b8r0 »

bobf wrote: post #2

Jordan is quickly becoming a log guru amongst mortals. Keep an eye on logstash! I'm definitely looking forward to an alternative to Splunk, which is great -- but incredibly expensive at large scale.

I'm thinking with saved and regularly run queries and reports this could take on loglogic or even low end arcsight cases.

Re: Logstash ready for use (log/event collection, searching, graphing)

#5

Post by jordansissel »

_b8r0 wrote: post #3

This looks like a very interesting project. Does anyone know if it supports saved queries?

logstash doesn't currently support saved queries (if you mean letting you save queries you like for later, easy recall), but I'm open to all feature suggestions.

File a request, or email the list: - http://code.google.com/p/logstash/issues/list - logstash-users@googlegroups.com

I'll know what to work on (besides my own priorities) based on requests/feedback :)

Re: Logstash ready for use (log/event collection, searching, graphing)

#6

Post by _b8r0 »

jordansissel wrote: post #5
_b8r0 wrote: post #3

This looks like a very interesting project. Does anyone know if it supports saved queries?

logstash doesn't currently support saved queries (if you mean letting you save queries you like for later, easy recall), but I'm open to all feature suggestions. File a request, or email the list: - http://code.google.com/p/logstash/issues/list - logstash-users@googlegroups.com I'll know what to work on (besides my own priorities) based on requests/feedback :)

I'm not going to have any time for the next few weeks to try it out but I'm really interested in using this as an open source alternative to logrhythm or arcsight for forensics, incident response and intrusion detection.

Believe me, if you can pull this off you will have a massively disruptive tool on your hands.

Re: Logstash ready for use (log/event collection, searching, graphing)

#8

Post by bobf »

philfreo wrote: post #7

Any startups have experience with Splunk? Seems like it might not be too expensive if you're not massive, and some of their demos are impressive. http://www.splunk.com/

I use Splunk, and am a big fan of everything except the cost. It works well, but it gets very expensive, very quickly when you grow beyond the 500MB/day free limit. I'm basically only collecting very limited usage log type information, because of that limit.

Re: Logstash ready for use (log/event collection, searching, graphing)

#9

Post by kaerast »

bobf wrote: post #8
philfreo wrote: post #7

Any startups have experience with Splunk? Seems like it might not be too expensive if you're not massive, and some of their demos are impressive. http://www.splunk.com/

I use Splunk, and am a big fan of everything except the cost. It works well, but it gets very expensive, very quickly when you grow beyond the 500MB/day free limit. I'm basically only collecting very limited usage log type information, because of that limit.

It's not just the size limit that's a problem in Splunk, the user accounting is only in the paid version - the free version is completely open for anybody to browse and it's up to you to secure it.

Re: Logstash ready for use (log/event collection, searching, graphing)

#10

Post by bobf »

kaerast wrote: post #9
bobf wrote: post #8

Earlier quoted context omitted.

I use Splunk, and am a big fan of everything except the cost. It works well, but it gets very expensive, very quickly when you grow beyond the 500MB/day free limit. I'm basically only collecting very limited usage log type information, because of that limit.

It's not just the size limit that's a problem in Splunk, the user accounting is only in the paid version - the free version is completely open for anybody to browse and it's up to you to secure it.

Granular access controls are nice under certain scenarios, but adding a basic ACL isn't hard. "Can use Splunk" and "Can't use Splunk" is enough control for me at the moment, fortunately.
Post reply on HN