Türker Yıldırım

elk-stack

  • Laravel 5.6 and logging you can configure

    Deep dive10 min read

    Logging moved into a config file, and stacks are why it matters — a different format per destination, decided without touching a service provider.

  • Alerting that people do not learn to ignore

    Deep dive10 min read

    340 alerts in a month, four of which mattered. An alert channel nobody reads is the same as no alerting, and the cause is alerting on causes.

  • Centralised logging that answers a question

    Deep dive17 min read

    Four servers, eleven log files, and an incident reconstructed from three of them. Shipping first and parsing second, structured events, and the correlation id that makes it useful.

  • Structured logs are the whole decision

    Note2 min read

    A log line written as a sentence has to be parsed back into fields by a regular expression somebody maintains, and that expression breaks whenever the sentence changes.…

  • Filebeat handles rotation; tail does not

    Note1 min read

    A shipper that follows a file by descriptor keeps reading the rotated-away file and never sees the new one; a shipper that reopens by name misses whatever was…

  • Index lifecycle before the disk fills, not after

    Note2 min read

    Daily indices grow linearly and nothing removes them, so a logging cluster works beautifully for four months and then stops accepting writes with a disk watermark error at…

  • Tail a Kibana-bound log with jq

    Snippet1 min read

  • Logstash grok is a regex engine with a bad reputation

    Note1 min read

    Grok is regular expressions with named patterns, and it earns its reputation honestly: a pattern that backtracks on an unexpected line will use an entire CPU and stall…

  • Ship the logs before you need them

    Note2 min read

    The instinct is to set up log aggregation when there is a problem to investigate. By then the interesting logs have rotated away, and the incident is reconstructed…