Shantanu's Blog

Logsene by sematext is very similar to logstash which is part of ELK stack. It makes hosting and managing data much easier by adding some features like IP addresses white-listing and user management.

logstash

To start pushing logs, you must create a file named /etc/logstash/conf.d/logsene.conf with the below text and restart Logstash.

input {
    file {
        path => "/var/log/messages"
        start_position => "beginning"
    }
}

output {
    elasticsearch {
        hosts => "logsene-receiver.sematext.com:443" # use port 80 for plain HTTP, instead of HTTPS
        ssl => "true"                                # set to false if you don't want to use SSL/HTTPS
        index => "38e31db7-3762-4b9c-937a-3e2e080974"
        manage_template => false
        idle_flush_time => 10
        flush_size => 1000
    }
}


filebeat

The following example tails the /var/log/test.log file and forwards every line to a Logstash beats input. To start pushing logs, you need to replace the config file named filebeat.yml with the one below and restart Filebeat.

filebeat:
  prospectors:
    -
      paths:
        - /var/log/logstash/test.log
        # - c:\logs\test.log
output:
  logstash:
    hosts: ["LOGSTASH_HOST:11111"]
For this to work, Logstash also needs to be configured to accept logs from Filebeat:

input {
  beats {
    port => 11111
  }
}

output {
    elasticsearch {
        hosts => "logsene-receiver.sematext.com:443" # use port 80 for plain HTTP, instead of HTTPS
        ssl => "true"                                # set to false if you don't want to use SSL/HTTPS
        index => "38e31db7-3762-4b9c-937a-3e2e080974"
        manage_template => false
    }
}


collect docker logs

docker run --name sematext-agent --restart=always \
  -e LOGSENE_TOKEN=38e31db7-3762-4b9c-937a-3e2e080974 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /etc/localtime:/etc/localtime:ro \
  -d sematext/sematext-agent-docker


AWS lamabda

https://github.com/sematext/logsene-aws-lambda-s3


Python

import logging
import logging.handlers


handler = logging.handlers.SysLogHandler(address=('logsene-receiver-syslog.sematext.com', 514))
formater = logging.Formatter("38e31db7-3762-4b9c-937a-3e2e080974:%(message)s")
handler.setFormatter(formater)
logger = logging.getLogger('HelloLogsene')
logger.setLevel(logging.DEBUG)
logger.addHandler(handler)


logger.debug("Hello, Logsene!")
logger.info("Hello, Logsene!")
logger.warning("Hello, Logsene!")
logger.error("Hello, Logsene!")



Elasticsearch API

host: logsene-receiver.sematext.com
port: 80 (HTTP) or 443 (HTTPS)
index: 38e31db7-3762-4b9c-937a-3e2e080974d0 (this is your Logsene app token - keep it secure)
curl -XPOST http://logsene-receiver.sematext.com/38e31db7-3762-4b9c-937a-3e2e080974/example/ -d '{
    "message": "Hello, Logsene!"
}'

Here is the list of medals won by each country as on 7 th day of the game.

usa = ['USA', 30, 29, 28]
uk = ['UK', '20', '19', '14']
china = ['china', 19, 17, 20]

# list of lists of each country
gold_silver_bronze = [usa, uk, china]

# create numpy array
import numpy as np
olympic = np.array(gold_silver_bronze)

same as

# olympic = np.array([['USA', 30, 29, 28], ['UK', '20', '19', '14'], ['china', 19, 17, 20]])

# countries participated
olympic[:,0]

# total of gold
sum(np.array(olympic[:,1], np.int))


# welcome pandas
import pandas as pd

>>> df=pd.DataFrame(olympic)
>>> df
       0   1   2   3
0    USA  30  29  28
1     UK  20  19  14
2  china  19  17  20

>>> df.dtypes
country    object
gold       object
silver     object
bronze     object
dtype: object

>>> df.gold=pd.to_numeric(df.gold)

>>> df.dtypes
country    object
gold        int64
silver     object
bronze     object
dtype: object

# which one is easier?

>>> df.gold.sum()
69
>>> sum(np.array(olympic[:,1], np.int))
69


# but how will you find the total of gold medals won by all countries?

>>> x = 0
>>> for i in gold_silver_bronze:
...     y = i[1]
...     x += int(y)
...
>>> x
69
_____


# total of medals won by USA
>>> usa[1:]
[30, 29, 28]
>>> sum(usa[1:])
87

>>> df['total']=df['gold']+df['silver']+df['bronze']
>>> df[['country', 'total']]
  country  total
0     USA     87
1      UK     53
2   china     56

Here is a simple tool to generate JSON very easily. It allows you to quickly build JSON without getting into the complexity of nesting and object types.

http://objgen.com/json?demo=true

nested fields are searchable and correctly queried. If you do not specify a field as "nested" then it is considered as default "object" and is not efficient.

## delete index
curl -XDELETE http://52.86.94.139:9200/deliveryreports_june2016d/

## create index
curl -XPUT http://52.86.94.139:9200/deliveryreports_june2016d/

## declare mapping for the index
curl -XPUT "http://52.86.94.139:9200/deliveryreports_june2016d/_mapping/mydoc" -d'
{
   "properties": {
      "parent": {
         "type": "nested",
         "properties": {
            "mytimestamp": {
               "type": "string",
               "fields": {
                  "raw": {
                     "type": "date",
                     "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||strict_date_optional_time||epoch_millis"
                  }
               }
            }
         }
      }
   }
}'

## check mapping
curl -XGET http://52.86.94.139:9200/deliveryreports_june2016d/_mapping/mydoc | python -m json.tool

## add a record
curl -XPUT "http://52.86.94.139:9200/deliveryreports_june2016d/mydoc/2" -d'
{
   "name": "shantanu",
   "parent": {
      "mytimestamp": "2016-05-18 08:41:49"
   }
}'

## check if record is added
curl -XGET http://52.86.94.139:9200/deliveryreports_june2016d/mydoc/2 | python -m json.tool

## simple query will work on non-nested fields
curl -XPOST "http://52.86.94.139:9200/deliveryreports_june2016d/_search" -d'
{
    "query": {
            "term": {
            "name": "shantanu"
    }}
}'

## This won't work on nested column
curl -XPOST "http://52.86.94.139:9200/deliveryreports_june2016d/mydoc/_search " -d'
{
   "query": {
      "match": {
         "parent.mytimestamp": "2016-05-18 08:41:49"
      }
   }
}'

## This will work because query needs to be declared as "nested" if parent object is nested in mapping
curl -XPOST "http://52.86.94.139:9200/deliveryreports_june2016d/mydoc/_search " -d'
{
    "query": {
        "nested": {
           "path": "parent",
           "query": {
               "match": {
                  "parent.mytimestamp": "2016-05-18 08:41:49"
               }
           }
        }
    }
}' | python -m json.tool


curl -XPOST "http://52.86.94.139:9200/deliveryreports_june2016d/mydoc/_search" -d'
{
   "query": {
      "nested": {
         "path": "parent",
         "query": {
            "filtered": {
               "query": {
                  "match_all": {}
               },
               "filter": {
                  "range": {
                     "parent.mytimestamp.raw": {
                        "gte": "2013-01-01 00:00:00"
                     }
                  }
               }
            }
         }
      }
   }
}' | python -m json.tool