{"id":33404,"date":"2025-11-02T12:41:05","date_gmt":"2025-11-02T09:41:05","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=33404"},"modified":"2025-11-02T12:41:05","modified_gmt":"2025-11-02T09:41:05","slug":"logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/","title":{"rendered":"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131)"},"content":{"rendered":"

<\/p>\n

Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131)<\/h2>\n

Giri\u015f: Merkezi Loglaman\u0131n \u00d6nemi ve Logstash’in Rol\u00fc<\/h2>\n

G\u00fcn\u00fcm\u00fcz\u00fcn karma\u015f\u0131k bilgi i\u015flem ortamlar\u0131nda, uygulamalar, sunucular, a\u011f cihazlar\u0131 ve di\u011fer altyap\u0131 bile\u015fenleri s\u00fcrekli olarak log (g\u00fcnl\u00fck) verileri \u00fcretir. Bu loglar, sistemlerin durumu, performans\u0131, g\u00fcvenlik olaylar\u0131 ve hata ay\u0131klama i\u00e7in kritik bilgiler i\u00e7erir. Ancak, bu loglar\u0131n farkl\u0131 formatlarda, farkl\u0131 konumlarda ve y\u00fcksek hacimlerde \u00fcretilmesi, manuel olarak incelenmesini neredeyse imkans\u0131z hale getirir. \u0130\u015fte bu noktada merkezi loglama devreye girer. Merkezi loglama, t\u00fcm bu da\u011f\u0131n\u0131k loglar\u0131 tek bir merkezi konuma toplayarak, kolayca aranabilir, analiz edilebilir ve g\u00f6rselle\u015ftirilebilir hale getirir.<\/p>\n

Merkezi loglama sistemlerinin en pop\u00fcler bile\u015fenlerinden biri olan ELK Stack (Elasticsearch, Logstash, Kibana), bu ihtiyaca g\u00fc\u00e7l\u00fc bir \u00e7\u00f6z\u00fcm sunar. Elasticsearch, log verilerini depolayan ve indeksleyen da\u011f\u0131t\u0131k bir arama motorudur; Kibana, Elasticsearch’teki verileri g\u00f6rselle\u015ftirmek ve analiz etmek i\u00e7in kullan\u0131lan bir kullan\u0131c\u0131 aray\u00fcz\u00fcd\u00fcr. Bu makalenin odak noktas\u0131 olan Logstash ise, log verilerini toplama, i\u015fleme ve zenginle\u015ftirme g\u00f6revini \u00fcstlenen g\u00fc\u00e7l\u00fc bir veri i\u015fleme arac\u0131d\u0131r. Logstash, farkl\u0131 kaynaklardan gelen ham loglar\u0131 al\u0131p, bunlar\u0131 anlaml\u0131 ve yap\u0131land\u0131r\u0131lm\u0131\u015f verilere d\u00f6n\u00fc\u015ft\u00fcrerek Elasticsearch’e g\u00f6ndermeden \u00f6nce \u00f6nemli bir d\u00f6n\u00fc\u015f\u00fcm katman\u0131 sa\u011flar. Bu d\u00f6n\u00fc\u015f\u00fcm s\u00fcreci, “filtreler” arac\u0131l\u0131\u011f\u0131yla ger\u00e7ekle\u015ftirilir.<\/p>\n

Ba\u015flang\u0131\u00e7ta “Logstash Forwarder” ad\u0131 verilen hafif bir ajan, loglar\u0131 do\u011frudan sunuculardan Logstash’e g\u00f6ndermek i\u00e7in kullan\u0131l\u0131yordu. Zamanla, bu rol\u00fc daha verimli ve \u00f6zellik dolu olan “Beats” ailesi, \u00f6zellikle de “Filebeat” devrald\u0131. Ancak, temeldeki prensip ayn\u0131 kalm\u0131\u015ft\u0131r: uzak sunuculardan loglar\u0131 g\u00fcvenli ve verimli bir \u015fekilde Logstash’e aktarmak. Bu makalede, Logstash’in filtreleme yeteneklerinin, merkezi loglama sistemlerinin etkinli\u011fini nas\u0131l art\u0131rd\u0131\u011f\u0131n\u0131 ve log verilerini analiz i\u00e7in nas\u0131l daha de\u011ferli hale getirdi\u011fini detayl\u0131 bir \u015fekilde inceleyece\u011fiz.<\/p>\n

Logstash Forwarder (Beats) ve Veri Ak\u0131\u015f\u0131<\/h2>\n

Merkezi loglama mimarisinin temel ta\u015flar\u0131ndan biri, loglar\u0131 \u00fcreten kaynaklardan Logstash sunucusuna g\u00fcvenli ve verimli bir \u015fekilde aktarmakt\u0131r. Tarihsel olarak, bu g\u00f6rev i\u00e7in “Logstash Forwarder” (daha sonra Lumberjack olarak da bilinen) ad\u0131 verilen hafif bir ajan kullan\u0131l\u0131yordu. Bu ajan, log dosyalar\u0131n\u0131 izler, yeni sat\u0131rlar\u0131 okur ve bunlar\u0131 TLS\/SSL \u015fifrelemesi kullanarak Logstash’e g\u00f6nderirdi. G\u00fcn\u00fcm\u00fczde ise bu rol\u00fc, Elastic’in “Beats” ailesi, \u00f6zellikle de “Filebeat” \u00fcstlenmi\u015ftir. Filebeat, Logstash Forwarder’\u0131n modern ve geli\u015ftirilmi\u015f bir alternatifidir; daha az kaynak t\u00fcketir, daha esnektir ve hata tolerans\u0131 daha y\u00fcksektir. Makalemizin ba\u015fl\u0131\u011f\u0131nda “Logstash Forwarder” belirtilse de, g\u00fcncel uygulamalarda Filebeat’in kullan\u0131ld\u0131\u011f\u0131n\u0131 belirtmek ve bu ba\u011flamda de\u011ferlendirme yapmak \u00f6nemlidir. Ancak, her iki durumda da prensip ayn\u0131d\u0131r: loglar\u0131 toplar ve Logstash’e iletirler.<\/p>\n

Basit bir veri ak\u0131\u015f\u0131 senaryosunda s\u00fcre\u00e7 \u015fu \u015fekildedir:<\/p>\n

1. Log \u00dcretimi:<\/strong> Bir web sunucusu (\u00f6rn. Apache, Nginx), uygulama sunucusu veya i\u015fletim sistemi, log dosyalar\u0131na s\u00fcrekli olarak bilgi yazar.
\n2. Veri Toplama (Filebeat\/Logstash Forwarder):<\/strong> Sunucu \u00fczerinde \u00e7al\u0131\u015fan Filebeat (veya eski Logstash Forwarder), belirli log dosyalar\u0131n\u0131 (\u00f6rn. \/var\/log\/apache2\/access.log<\/code>) izler. Yeni sat\u0131rlar eklendi\u011finde, bunlar\u0131 okur ve bir olay (event) olarak paketler.
\n3. G\u00fcvenli \u0130letim:<\/strong> Filebeat, bu olaylar\u0131 TLS\/SSL \u015fifrelemesi kullanarak Logstash sunucusuna g\u00f6nderir. Bu, verilerin a\u011f \u00fczerinde g\u00fcvenli bir \u015fekilde aktar\u0131lmas\u0131n\u0131 sa\u011flar.
\n4. Logstash Giri\u015fi (Input):<\/strong> Logstash sunucusunda, bir “input” eklentisi (genellikle beats<\/code> input eklentisi), Filebeat’ten gelen ba\u011flant\u0131lar\u0131 dinler ve gelen olaylar\u0131 kabul eder.
\n5. Logstash Filtreleme (Filter):<\/strong> Gelen ham log olaylar\u0131, Logstash’in “filter” a\u015famas\u0131na girer. Bu a\u015famada, loglar ayr\u0131\u015ft\u0131r\u0131l\u0131r, zenginle\u015ftirilir, d\u00f6n\u00fc\u015ft\u00fcr\u00fcl\u00fcr ve yap\u0131land\u0131r\u0131l\u0131r. Bu makalenin ana odak noktas\u0131 buras\u0131d\u0131r.
\n6. Logstash \u00c7\u0131k\u0131\u015f\u0131 (Output):<\/strong> \u0130\u015flenmi\u015f ve yap\u0131land\u0131r\u0131lm\u0131\u015f log olaylar\u0131, Logstash’in “output” a\u015famas\u0131na ge\u00e7er. Genellikle bu a\u015famada, veriler Elasticsearch’e g\u00f6nderilir. Ancak, Kafka, Redis, S3 gibi farkl\u0131 hedeflere de g\u00f6nderilebilir.
\n7. Depolama ve Analiz:<\/strong> Elasticsearch, gelen yap\u0131land\u0131r\u0131lm\u0131\u015f loglar\u0131 indeksler ve depolar. Kibana arac\u0131l\u0131\u011f\u0131yla bu veriler sorgulanabilir, analiz edilebilir ve g\u00f6rselle\u015ftirilebilir.<\/p>\n

Bu ak\u0131\u015fta, Logstash’in filtre a\u015famas\u0131, ham ve genellikle okunaks\u0131z log verilerini, analize uygun, tutarl\u0131 ve de\u011ferli bilgilere d\u00f6n\u00fc\u015ft\u00fcren kritik bir k\u00f6pr\u00fc g\u00f6revi g\u00f6r\u00fcr. Filtreler olmadan, Elasticsearch’te depolanan veriler b\u00fcy\u00fck \u00f6l\u00e7\u00fcde ham ve kullan\u0131\u015fs\u0131z kalacakt\u0131r.<\/p>\n

Logstash Filtrelerinin G\u00fcc\u00fc ve Neden \u0130htiya\u00e7 Duyulur?<\/h2>\n

Ham log verileri genellikle yap\u0131land\u0131r\u0131lmam\u0131\u015f metinlerdir. Bir Apache eri\u015fim logu sat\u0131r\u0131 \u015f\u00f6yle g\u00f6r\u00fcnebilir:<\/p>\n

192.168.1.1 - - [10\/Nov\/2023:14:30:01 +0300] \"GET \/index.html HTTP\/1.1\" 200 1234 \"-\" \"Mozilla\/5.0\"<\/code><\/p>\n

Bu sat\u0131r, insan g\u00f6z\u00fcyle okundu\u011funda baz\u0131 bilgiler i\u00e7erse de, bir makine taraf\u0131ndan do\u011frudan analiz edilmesi zordur. Belirli alanlar\u0131 (IP adresi, zaman damgas\u0131, HTTP metodu, URL, durum kodu, boyut) \u00e7\u0131karmak, bunlar\u0131 ayr\u0131 alanlar olarak etiketlemek ve veri tiplerini d\u00f6n\u00fc\u015ft\u00fcrmek gerekir. Aksi takdirde, Elasticsearch’te bu veriler \u00fczerinde “kaynak IP’ye g\u00f6re trafik da\u011f\u0131l\u0131m\u0131n\u0131 g\u00f6ster” veya “son 5 dakikada 5xx durum kodu d\u00f6nen URL’leri listele” gibi karma\u015f\u0131k sorgular \u00e7al\u0131\u015ft\u0131ramazs\u0131n\u0131z.<\/p>\n

Logstash filtrelerinin temel amac\u0131, bu ham log verilerini al\u0131p \u015funlar\u0131 yapmakt\u0131r:<\/p>\n

1. Yap\u0131land\u0131rma (Parsing):<\/strong> Ham metin loglar\u0131n\u0131, anahtar-de\u011fer \u00e7iftleri veya JSON nesneleri gibi yap\u0131land\u0131r\u0131lm\u0131\u015f verilere d\u00f6n\u00fc\u015ft\u00fcrmek. Bu, loglardaki belirli bilgileri (\u00f6rn. IP adresi, kullan\u0131c\u0131 ad\u0131, hata kodu) ayr\u0131 alanlar olarak \u00e7\u0131karmay\u0131 i\u00e7erir.
\n2. Normalle\u015ftirme:<\/strong> Farkl\u0131 log kaynaklar\u0131ndan gelen benzer bilgileri (\u00f6rn. zaman damgas\u0131, seviye) tutarl\u0131 bir format ve alan ad\u0131 alt\u0131nda birle\u015ftirmek. Bu, farkl\u0131 sistemlerden gelen loglar\u0131n birlikte analiz edilmesini kolayla\u015ft\u0131r\u0131r.
\n3. Zenginle\u015ftirme (Enrichment):<\/strong> Log verilerine ek bilgiler eklemek. \u00d6rne\u011fin, bir IP adresinden co\u011frafi konum bilgisi (\u00fclke, \u015fehir) eklemek veya bir hata koduna a\u00e7\u0131klay\u0131c\u0131 bir metin eklemek.
\n4. D\u00f6n\u00fc\u015ft\u00fcrme ve Temizleme:<\/strong> Alanlar\u0131n veri tiplerini de\u011fi\u015ftirmek (\u00f6rn. metni say\u0131ya d\u00f6n\u00fc\u015ft\u00fcrmek), gereksiz alanlar\u0131 kald\u0131rmak, hassas bilgileri maskelemek veya alan adlar\u0131n\u0131 yeniden adland\u0131rmak.
\n5. Ko\u015fullu \u0130\u015fleme:<\/strong> Belirli kriterlere uyan loglar\u0131 farkl\u0131 \u015fekillerde i\u015flemek veya tamamen atmak.<\/p>\n

Bu i\u015flemler olmadan, merkezi loglama sisteminiz bir “veri \u00e7\u00f6pl\u00fc\u011f\u00fcne” d\u00f6n\u00fc\u015febilir. Filtreler, log verilerinizin kalitesini, kullan\u0131labilirli\u011fini ve analitik de\u011ferini do\u011frudan art\u0131r\u0131r. Ayr\u0131ca, gereksiz verileri atarak veya \u00f6zetleyerek depolama maliyetlerini d\u00fc\u015f\u00fcrmeye ve Elasticsearch’teki indeksleme performans\u0131n\u0131 optimize etmeye yard\u0131mc\u0131 olurlar.<\/p>\n

Temel Logstash Filtreleri ve Kullan\u0131m Senaryolar\u0131<\/h2>\n

Logstash, \u00e7ok \u00e7e\u015fitli filtre eklentileri sunar. \u0130\u015fte en yayg\u0131n ve g\u00fc\u00e7l\u00fc olanlardan baz\u0131lar\u0131:<\/p>\n

grok<\/code> Filtresi: Yap\u0131land\u0131r\u0131lmam\u0131\u015f Veriyi Yap\u0131land\u0131rmak<\/h3>\n

grok<\/code> filtresi, Logstash’in en g\u00fc\u00e7l\u00fc ve en s\u0131k kullan\u0131lan filtrelerinden biridir. Yap\u0131land\u0131r\u0131lmam\u0131\u015f metin loglar\u0131n\u0131, \u00f6nceden tan\u0131mlanm\u0131\u015f veya \u00f6zel olarak olu\u015fturulmu\u015f d\u00fczenli ifade (regex) desenleri kullanarak yap\u0131land\u0131r\u0131lm\u0131\u015f alanlara d\u00f6n\u00fc\u015ft\u00fcr\u00fcr. Logstash, Apache, Nginx, Syslog gibi yayg\u0131n log formatlar\u0131 i\u00e7in y\u00fczlerce haz\u0131r grok deseniyle birlikte gelir.<\/p>\n

Kullan\u0131m Senaryosu:<\/strong> Web sunucusu eri\u015fim loglar\u0131, sistem loglar\u0131, \u00f6zel uygulama loglar\u0131.<\/p>\n

\u00d6rnek Yap\u0131land\u0131rma (Apache Eri\u015fim Logu):<\/strong><\/p>\n

filter {\n  grok {\n    match => { \"message\" => \"%{COMBINEDAPACHELOG}\" }\n  }\n}<\/code><\/pre>\n
Bu \u00f6rnekte, message<\/code> alan\u0131ndaki log sat\u0131r\u0131, Logstash’in dahili COMBINEDAPACHELOG<\/code> deseniyle e\u015fle\u015ftirilir. Bu desen, log sat\u0131r\u0131n\u0131 otomatik olarak clientip<\/code>, ident<\/code>, auth<\/code>, timestamp<\/code>, verb<\/code>, request<\/code>, httpversion<\/code>, response<\/code>, bytes<\/code>, referrer<\/code>, agent<\/code> gibi alanlara ay\u0131r\u0131r.<\/p>\n
\u00d6zel Grok Deseni:<\/strong> E\u011fer haz\u0131r desenler log format\u0131n\u0131za uymuyorsa, kendi desenlerinizi tan\u0131mlayabilirsiniz.<\/p>\n
filter {\n  grok {\n    match => { \"message\" => \"(?\\w+): %{GREEDYDATA:log_message}\" }\n  }\n}<\/code><\/pre>\n
Bu \u00f6rnek, INFO: Bu bir mesajd\u0131r.<\/code> gibi bir log sat\u0131r\u0131n\u0131 log_level<\/code> ve log_message<\/code> alanlar\u0131na ay\u0131r\u0131r. (?desen)<\/code> s\u00f6zdizimi, yakalanan grubun ad\u0131n\u0131 belirler.<\/p>\n
date<\/code> Filtresi: Zaman Damgalar\u0131n\u0131 Do\u011fru Y\u00f6netmek<\/h3>\n
Loglar\u0131n do\u011fru zaman damgas\u0131na sahip olmas\u0131, olaylar\u0131 kronolojik s\u0131raya koymak, zaman aral\u0131\u011f\u0131na g\u00f6re arama yapmak ve korelasyon analizi yapmak i\u00e7in hayati \u00f6neme sahiptir. date<\/code> filtresi, log olaylar\u0131ndaki metin tabanl\u0131 zaman damgalar\u0131n\u0131 ayr\u0131\u015ft\u0131r\u0131r ve Logstash’in dahili @timestamp<\/code> alan\u0131na atar. Bu alan, Elasticsearch’te zaman bazl\u0131 indeksleme ve sorgulama i\u00e7in kullan\u0131l\u0131r.<\/p>\n
Kullan\u0131m Senaryosu:<\/strong> Neredeyse t\u00fcm log t\u00fcrleri i\u00e7in gereklidir.<\/p>\n
\u00d6rnek Yap\u0131land\u0131rma:<\/strong><\/p>\n
filter {\n  date {\n    match => [ \"timestamp\", \"dd\/MMM\/yyyy:HH:mm:ss Z\" ]\n    target => \"@timestamp\"\n  }\n}<\/code><\/pre>\n
Bu \u00f6rnek, timestamp<\/code> adl\u0131 bir alandaki 10\/Nov\/2023:14:30:01 +0300<\/code> format\u0131ndaki zaman damgas\u0131n\u0131 ayr\u0131\u015ft\u0131r\u0131r ve @timestamp<\/code> alan\u0131na atar. match<\/code> parametresi birden fazla format alabilir, b\u00f6ylece farkl\u0131 kaynaklardan gelen farkl\u0131 zaman damgas\u0131 formatlar\u0131n\u0131 i\u015fleyebilirsiniz.<\/p>\n
mutate<\/code> Filtresi: Alanlar\u0131 Manip\u00fcle Etmek<\/h3>\n
mutate<\/code> filtresi, mevcut alanlar\u0131 de\u011fi\u015ftirmek, yeni alanlar eklemek, alanlar\u0131 yeniden adland\u0131rmak, kald\u0131rmak veya veri tiplerini d\u00f6n\u00fc\u015ft\u00fcrmek i\u00e7in kullan\u0131lan \u00e7ok y\u00f6nl\u00fc bir filtredir.<\/p>\n
Kullan\u0131m Senaryosu:<\/strong> Veri temizli\u011fi, normalle\u015ftirme, depolama optimizasyonu.<\/p>\n
\u00d6rnek Yap\u0131land\u0131rma:<\/strong><\/p>\n
filter {\n  mutate {\n    add_field => { \"env\" => \"production\" } # Yeni alan ekle\n    remove_field => [ \"some_unnecessary_field\", \"path\" ] # Alanlar\u0131 kald\u0131r\n    rename => { \"clientip\" => \"source_ip\" } # Alan\u0131 yeniden adland\u0131r\n    convert => { \"response\" => \"integer\" } # Veri tipini d\u00f6n\u00fc\u015ft\u00fcr\n    gsub => [ \"message\", \"\\s+\", \" \" ] # Metin i\u00e7inde de\u011fi\u015ftirme yap (regex)\n  }\n}<\/code><\/pre>\n
*   add_field<\/code>: Olaylara sabit bir de\u011ferle yeni bir alan ekler.
\n*   remove_field<\/code>: Belirtilen alanlar\u0131 olaydan kald\u0131r\u0131r. Bu, depolama alan\u0131ndan tasarruf etmek i\u00e7in faydal\u0131d\u0131r.
\n*   rename<\/code>: Bir alan\u0131n ad\u0131n\u0131 de\u011fi\u015ftirir.
\n*   convert<\/code>: Bir alan\u0131n veri tipini de\u011fi\u015ftirir (\u00f6rn. string<\/code> to integer<\/code>, float<\/code>, boolean<\/code>).
\n*   gsub<\/code>: Bir alan\u0131n de\u011ferinde d\u00fczenli ifade kullanarak metin de\u011fi\u015ftirme i\u015flemi yapar.<\/p>\n
json<\/code> Filtresi: JSON Verilerini Ayr\u0131\u015ft\u0131rmak<\/h3>\n
Uygulamalar genellikle loglar\u0131n\u0131 do\u011frudan JSON format\u0131nda \u00fcretirler. json<\/code> filtresi, bir alandaki JSON dizesini ayr\u0131\u015ft\u0131rarak, bu dizedeki her anahtar-de\u011fer \u00e7iftini olay\u0131n ayr\u0131 bir alan\u0131 haline getirir.<\/p>\n
Kullan\u0131m Senaryosu:<\/strong> Yap\u0131land\u0131r\u0131lm\u0131\u015f uygulama loglar\u0131, API loglar\u0131.<\/p>\n
\u00d6rnek Yap\u0131land\u0131rma:<\/strong><\/p>\n
filter {\n  json {\n    source => \"message\"\n    target => \"json_data\" # \u0130ste\u011fe ba\u011fl\u0131, ayr\u0131\u015ft\u0131r\u0131lan JSON'\u0131 belirtilen bir alt alana koyar\n  }\n}<\/code><\/pre>\n
E\u011fer message<\/code> alan\u0131 {\"level\": \"info\", \"message\": \"User logged in\", \"user_id\": 123}<\/code> gibi bir JSON dizesi i\u00e7eriyorsa, bu filtre, level<\/code>, message<\/code> ve user_id<\/code> alanlar\u0131n\u0131 do\u011frudan olay\u0131n k\u00f6k seviyesine (veya target<\/code> belirtilmi\u015fse json_data<\/code> alt\u0131na) ekler.<\/p>\n
kv<\/code> Filtresi: Anahtar-De\u011fer \u00c7iftlerini Ayr\u0131\u015ft\u0131rmak<\/h3>\n
kv<\/code> (key-value) filtresi, key=value key2=\"value with spaces\"<\/code> gibi anahtar-de\u011fer \u00e7iftleri i\u00e7eren log sat\u0131rlar\u0131n\u0131 ayr\u0131\u015ft\u0131rmak i\u00e7in kullan\u0131l\u0131r.<\/p>\n
Kullan\u0131m Senaryosu:<\/strong> G\u00fcvenlik cihaz\u0131 loglar\u0131, \u00f6zel uygulama loglar\u0131, Windows olay loglar\u0131.<\/p>\n
\u00d6rnek Yap\u0131land\u0131rma:<\/strong><\/p>\n
filter {\n  kv {\n    source => \"message\"\n    field_split => \"& \" # Anahtar-de\u011fer \u00e7iftlerini ay\u0131ran karakterler\n    value_split => \"=\" # Anahtar ve de\u011feri ay\u0131ran karakter\n  }\n}<\/code><\/pre>\n
Bu, message<\/code> alan\u0131ndaki event=login user=john status=success<\/code> gibi bir dizeden event<\/code>, user<\/code>, status<\/code> alanlar\u0131n\u0131 \u00e7\u0131kar\u0131r.<\/p>\n
geoip<\/code> Filtresi: Co\u011frafi Bilgi Eklemek<\/h3>\n
geoip<\/code> filtresi, bir IP adresini kullanarak co\u011frafi konum bilgilerini (\u00fclke, \u015fehir, enlem, boylam vb.) olaya ekler. Bu, loglar\u0131 harita \u00fczerinde g\u00f6rselle\u015ftirmek veya co\u011frafi konuma g\u00f6re analiz yapmak i\u00e7in \u00e7ok de\u011ferlidir.<\/p>\n
Kullan\u0131m Senaryosu:<\/strong> Web sunucusu eri\u015fim loglar\u0131, g\u00fcvenlik loglar\u0131 (sald\u0131r\u0131lar\u0131n co\u011frafi kayna\u011f\u0131n\u0131 belirlemek), a\u011f trafi\u011fi analizi.<\/p>\n
\u00d6rnek Yap\u0131land\u0131rma:<\/strong><\/p>\n
filter {\n  geoip {\n    source => \"clientip\" # IP adresini i\u00e7eren alan\n  }\n}<\/code><\/pre>\n
Bu, clientip<\/code> alan\u0131ndaki IP adresinden geoip<\/code> adl\u0131 yeni bir alan olu\u015fturur ve bu alana country_name<\/code>, city_name<\/code>, location<\/code> (co\u011frafi koordinatlar) gibi bilgileri ekler.<\/p>\n
drop<\/code> Filtresi: \u0130stenmeyen Loglar\u0131 Atmak<\/h3>\n
drop<\/code> filtresi, belirli ko\u015fullar\u0131 kar\u015f\u0131layan log olaylar\u0131n\u0131 tamamen siler. Bu, gereksiz g\u00fcr\u00fclt\u00fcy\u00fc azaltmak, depolama alan\u0131ndan tasarruf etmek ve sadece \u00f6nemli loglara odaklanmak i\u00e7in kullan\u0131\u015fl\u0131d\u0131r.<\/p>\n
Kullan\u0131m Senaryosu:<\/strong> Sa\u011fl\u0131k kontrol\u00fc loglar\u0131, bilinen bot trafi\u011fi, \u00e7ok s\u0131k tekrarlayan \u00f6nemsiz hata mesajlar\u0131.<\/p>\n
\u00d6rnek Yap\u0131land\u0131rma:<\/strong><\/p>\n
filter {\n  if [message] =~ \"HEALTHCHECK\" {\n    drop {}\n  }\n}<\/code><\/pre>\n
Bu \u00f6rnek, message<\/code> alan\u0131nda “HEALTHCHECK” kelimesini i\u00e7eren t\u00fcm log olaylar\u0131n\u0131 Logstash pipeline’\u0131ndan atar.<\/p>\n
if<\/code> Ko\u015fullar\u0131 ve Filtre Zincirleri<\/h3>\n
Logstash filtreleri, if<\/code> ko\u015fullar\u0131 ile birlikte kullan\u0131ld\u0131\u011f\u0131nda \u00e7ok daha g\u00fc\u00e7l\u00fc hale gelir. Bu, farkl\u0131 log t\u00fcrlerine veya belirli alan de\u011ferlerine g\u00f6re farkl\u0131 filtre setleri uygulaman\u0131z\u0131 sa\u011flar.<\/p>\n
\u00d6rnek Yap\u0131land\u0131rma:<\/strong><\/p>\n
filter {\n  if [type] == \"apache_access\" {\n    grok {\n      match => { \"message\" => \"%{COMBINEDAPACHELOG}\" }\n    }\n    date {\n      match => [ \"timestamp\", \"dd\/MMM\/yyyy:HH:mm:ss Z\" ]\n    }\n    geoip {\n      source => \"clientip\"\n    }\n  } else if [type] == \"syslog\" {\n    grok {\n      match => { \"message\" => \"%{SYSLOGBASE} %{SYSLOGPROG}: %{GREEDYDATA:syslog_message}\" }\n    }\n    date {\n      match => [ \"syslog_timestamp\", \"MMM  d HH:mm:ss\", \"MMM dd HH:mm:ss\" ]\n    }\n  } else {\n    # Di\u011fer loglar i\u00e7in varsay\u0131lan i\u015flem\n    mutate {\n      add_tag => [ \"_grokparsefailure\" ]\n    }\n  }\n}<\/code><\/pre>\n
Bu \u00f6rnekte, type<\/code> alan\u0131na g\u00f6re (genellikle Filebeat taraf\u0131ndan eklenir) farkl\u0131 filtreler uygulan\u0131r. Bu sayede, Logstash ayn\u0131 pipeline i\u00e7inde farkl\u0131 formatlardaki loglar\u0131 do\u011fru bir \u015fekilde i\u015fleyebilir. else<\/code> blo\u011fu, hi\u00e7bir ko\u015fula uymayan loglar\u0131 i\u015faretlemek i\u00e7in kullan\u0131labilir, bu da hata ay\u0131klama s\u0131ras\u0131nda yard\u0131mc\u0131 olur.<\/p>\n
Logstash Filtre Yap\u0131land\u0131rmas\u0131 ve En \u0130yi Uygulamalar<\/h2>\n
Logstash’in yap\u0131land\u0131rmas\u0131, input<\/code>, filter<\/code> ve output<\/code> b\u00f6l\u00fcmlerinden olu\u015fur. Filtrelerin do\u011fru bir \u015fekilde s\u0131ralanmas\u0131 ve verimli bir \u015fekilde kullan\u0131lmas\u0131, Logstash pipeline’\u0131n\u0131n performans\u0131n\u0131 ve log analizinin do\u011frulu\u011funu do\u011frudan etkiler.<\/p>\n
Logstash Pipeline Yap\u0131s\u0131<\/h3>\n
Bir Logstash yap\u0131land\u0131rma dosyas\u0131 (genellikle .conf<\/code> uzant\u0131l\u0131), temel olarak \u00fc\u00e7 ana b\u00f6l\u00fcmden olu\u015fur:<\/p>\n
*   input<\/code>:<\/strong> Logstash’in verileri nereden alaca\u011f\u0131n\u0131 tan\u0131mlar (\u00f6rn. beats<\/code>, file<\/code>, syslog<\/code>, kafka<\/code>).
\n*   filter<\/code>:<\/strong> Gelen verilerin nas\u0131l i\u015flenece\u011fini, ayr\u0131\u015ft\u0131r\u0131laca\u011f\u0131n\u0131 ve d\u00f6n\u00fc\u015ft\u00fcr\u00fclece\u011fini tan\u0131mlar. Bu makalenin ana odak noktas\u0131d\u0131r.
\n*   output<\/code>:<\/strong> \u0130\u015flenmi\u015f verilerin nereye g\u00f6nderilece\u011fini tan\u0131mlar (\u00f6rn. elasticsearch<\/code>, stdout<\/code>, file<\/code>, kafka<\/code>).<\/p>\n
\u00d6rnek Basit Yap\u0131land\u0131rma:<\/strong><\/p>\n
input {\n  beats {\n    port => 5044\n  }\n}\n\nfilter {\n  # Filtreler buraya gelecek\n}\n\noutput {\n  elasticsearch {\n    hosts => [\"localhost:9200\"]\n    index => \"my-app-logs-%{+YYYY.MM.dd}\"\n  }\n  stdout { codec => rubydebug } # Hata ay\u0131klama i\u00e7in\n}<\/code><\/pre>\n
Filtrelerin S\u0131ralamas\u0131: Performans ve Do\u011fruluk<\/h3>\n
Filtreler, yap\u0131land\u0131rma dosyas\u0131nda g\u00f6r\u00fcnd\u00fckleri s\u0131raya g\u00f6re uygulan\u0131r. Bu s\u0131ralama kritik \u00f6neme sahiptir:<\/p>\n
1.  \u00d6n Ko\u015fullar:<\/strong> Genellikle, bir sonraki filtrenin \u00e7al\u0131\u015fmas\u0131 i\u00e7in belirli bir alan\u0131n var olmas\u0131 gerekiyorsa, bu alan\u0131 olu\u015fturan filtre \u00f6nce gelmelidir. \u00d6rne\u011fin, grok<\/code> filtresiyle bir IP adresi \u00e7\u0131kar\u0131ld\u0131ktan sonra geoip<\/code> filtresi uygulanmal\u0131d\u0131r.
\n2.  En Kapsaml\u0131dan En Dar Kapsaml\u0131ya:<\/strong> Geni\u015f kapsaml\u0131 desenler veya i\u015flemler \u00f6nce, daha spesifik olanlar sonra gelmelidir.
\n3.  Performans:<\/strong> Kaynak yo\u011fun filtreler (\u00f6rn. karma\u015f\u0131k regex’ler i\u00e7eren grok<\/code>), m\u00fcmk\u00fcnse daha az log olay\u0131na uygulanacak \u015fekilde if<\/code> ko\u015fullar\u0131yla s\u0131n\u0131rland\u0131r\u0131lmal\u0131d\u0131r. drop<\/code> filtreleri, gereksiz loglar\u0131 pipeline’\u0131n ba\u015flar\u0131nda atmak i\u00e7in kullan\u0131labilir, bu da sonraki filtrelerin daha az veri \u00fczerinde \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flayarak performans\u0131 art\u0131r\u0131r.<\/p>\n
if<\/code> Ko\u015fullar\u0131 ile Verimli Ak\u0131\u015f Kontrol\u00fc<\/h3>\n
Daha \u00f6nce de belirtildi\u011fi gibi, if<\/code> ko\u015fullar\u0131 Logstash’in en g\u00fc\u00e7l\u00fc \u00f6zelliklerinden biridir. Farkl\u0131 log kaynaklar\u0131 veya formatlar\u0131 i\u00e7in ayr\u0131 ayr\u0131 filtre bloklar\u0131 tan\u0131mlayarak, Logstash’in sadece ilgili filtreleri \u00e7al\u0131\u015ft\u0131rmas\u0131n\u0131 sa\u011flars\u0131n\u0131z. Bu, hem yap\u0131land\u0131rmay\u0131 daha okunabilir hale getirir hem de gereksiz filtre i\u015flemlerini \u00f6nleyerek performans\u0131 art\u0131r\u0131r.<\/p>\n
filter {\n  if [fields][log_type] == \"apache_access\" {\n    # Apache loglar\u0131 i\u00e7in filtreler\n  } else if [fields][log_type] == \"nginx_error\" {\n    # Nginx hata loglar\u0131 i\u00e7in filtreler\n  } else {\n    # Hi\u00e7birine uymayan loglar i\u00e7in varsay\u0131lan veya hata i\u015fleme\n  }\n}<\/code><\/pre>\n
[fields][log_type]<\/code> gibi i\u00e7 i\u00e7e alanlara eri\u015fim, \u00f6zellikle Filebeat gibi ajanlar\u0131n ekledi\u011fi meta verilerle \u00e7al\u0131\u015f\u0131rken yayg\u0131nd\u0131r.<\/p>\n
Test Etme ve Hata Ay\u0131klama<\/h3>\n
Logstash filtreleri karma\u015f\u0131k olabilir ve do\u011fru \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131klar\u0131n\u0131 test etmek \u00f6nemlidir:<\/p>\n
*   stdout<\/code> \u00c7\u0131kt\u0131s\u0131 (codec => rubydebug<\/code>):<\/strong> Geli\u015ftirme a\u015famas\u0131nda, output<\/code> blo\u011funa stdout { codec => rubydebug }<\/code> eklemek, i\u015flenmi\u015f log olaylar\u0131n\u0131n konsola okunabilir bir JSON format\u0131nda yaz\u0131lmas\u0131n\u0131 sa\u011flar. Bu, filtrelerinizin bekledi\u011finiz gibi alanlar\u0131 \u00e7\u0131kar\u0131p \u00e7\u0131karmad\u0131\u011f\u0131n\u0131 g\u00f6rmek i\u00e7in paha bi\u00e7ilmezdir.
\n*   Grok Debugger:<\/strong> Grok desenlerini test etmek i\u00e7in \u00e7evrimi\u00e7i Grok Debugger ara\u00e7lar\u0131n\u0131 (\u00f6rn. Grok Debugger by Elastic) kullan\u0131n. Bu ara\u00e7lar, desenlerinizi ham log sat\u0131rlar\u0131n\u0131z \u00fczerinde ger\u00e7ek zamanl\u0131 olarak test etmenizi ve hatalar\u0131 ay\u0131klaman\u0131z\u0131 sa\u011flar.
\n*   Sentetik Veri:<\/strong> Ger\u00e7ek log verilerinizin k\u00fc\u00e7\u00fck, temsili \u00f6rneklerini kullanarak filtrelerinizi test edin.
\n*   Logstash Loglar\u0131:<\/strong> Logstash’in kendi loglar\u0131n\u0131 (\/var\/log\/logstash\/logstash-plain.log<\/code>) d\u00fczenli olarak kontrol edin. Filtre hatalar\u0131 veya yap\u0131land\u0131rma sorunlar\u0131 burada g\u00f6r\u00fcnecektir.<\/p>\n
Performans \u0130pu\u00e7lar\u0131<\/h3>\n
*   grok<\/code> Verimlili\u011fi:<\/strong> grok<\/code> desenlerinizin m\u00fcmk\u00fcn oldu\u011funca spesifik olmas\u0131n\u0131 sa\u011flay\u0131n. GREEDYDATA<\/code> gibi \u00e7ok geni\u015f desenleri dikkatli kullan\u0131n, \u00e7\u00fcnk\u00fc bunlar performans\u0131 d\u00fc\u015f\u00fcrebilir. M\u00fcmk\u00fcnse, daha k\u0131sa ve hedefe y\u00f6nelik desenler tercih edin.
\n*   Filtre S\u0131ras\u0131:<\/strong> En s\u0131k e\u015fle\u015fen veya en az kaynak t\u00fcketen filtreleri pipeline’\u0131n ba\u015flar\u0131na yerle\u015ftirin. drop<\/code> filtrelerini erken kullanmak, gereksiz i\u015flem y\u00fck\u00fcn\u00fc azalt\u0131r.
\n*   Ko\u015fullu Filtreleme:<\/strong> Her log olay\u0131na t\u00fcm filtreleri uygulamak yerine, if<\/code> ko\u015fullar\u0131 kullanarak sadece ilgili filtreleri \u00e7al\u0131\u015ft\u0131r\u0131n.
\n*   Tekrarlayan \u0130\u015flemlerden Ka\u00e7\u0131n\u0131n:<\/strong> Ayn\u0131 i\u015flemi birden fazla filtrede yapmaktan ka\u00e7\u0131n\u0131n.
\n*   Bellek ve CPU:<\/strong> Logstash’e yeterli bellek ve CPU kaynaklar\u0131 ay\u0131r\u0131n. Filtrelerin karma\u015f\u0131kl\u0131\u011f\u0131 artt\u0131k\u00e7a, Logstash’in kaynak ihtiyac\u0131 da artar.<\/p>\n
Ger\u00e7ek D\u00fcnya Senaryolar\u0131 ve \u00d6rnek Uygulamalar<\/h2>\n
Logstash filtrelerinin ger\u00e7ek d\u00fcnyadaki uygulamalar\u0131n\u0131 birka\u00e7 \u00f6rnekle inceleyelim.<\/p>\n
Apache Eri\u015fim Loglar\u0131n\u0131n \u0130\u015flenmesi<\/h3>\n
Apache eri\u015fim loglar\u0131, web sunucusu etkinli\u011fi hakk\u0131nda zengin bilgiler i\u00e7erir. Bu loglar\u0131 do\u011fru bir \u015fekilde ayr\u0131\u015ft\u0131rmak, web sitesi trafi\u011fini, kullan\u0131c\u0131 davran\u0131\u015flar\u0131n\u0131 ve potansiyel g\u00fcvenlik tehditlerini anlamak i\u00e7in kritik \u00f6neme sahiptir.<\/p>\n
Hedef:<\/strong> Apache combined<\/code> log format\u0131n\u0131 ayr\u0131\u015ft\u0131rmak, zaman damgas\u0131n\u0131 ayarlamak, IP adresinden co\u011frafi bilgi eklemek ve gereksiz alanlar\u0131 kald\u0131rmak.<\/p>\n
input {\n  beats {\n    port => 5044\n  }\n}\n\nfilter {\n  if [fields][log_type] == \"apache_access\" {\n    grok {\n      match => { \"message\" => \"%{COMBINEDAPACHELOG}\" }\n      # E\u011fer grok ba\u015far\u0131s\u0131z olursa, bir etiket ekle\n      add_tag => [ \"_grokparsefailure_apache\" ]\n    }\n    date {\n      match => [ \"timestamp\", \"dd\/MMM\/yyyy:HH:mm:ss Z\" ]\n      target => \"@timestamp\"\n      # Ba\u015far\u0131s\u0131z olursa etiket ekle\n      add_tag => [ \"_dateparsefailure_apache\" ]\n    }\n    geoip {\n      source => \"clientip\"\n      # Ba\u015far\u0131s\u0131z olursa etiket ekle\n      add_tag => [ \"_geoipfailure\" ]\n    }\n    mutate {\n      # Baz\u0131 alanlar\u0131 say\u0131ya d\u00f6n\u00fc\u015ft\u00fcr\n      convert => { \"bytes\" => \"integer\" }\n      convert => { \"response\" => \"integer\" }\n      # Gereksiz alanlar\u0131 kald\u0131r\n      remove_field => [ \"ident\", \"auth\", \"timestamp\" ]\n    }\n  }\n}\n\noutput {\n  elasticsearch {\n    hosts => [\"localhost:9200\"]\n    index => \"apache-access-%{+YYYY.MM.dd}\"\n  }\n}<\/code><\/pre>\n
Bu yap\u0131land\u0131rma, Apache loglar\u0131n\u0131 al\u0131r, ayr\u0131\u015ft\u0131r\u0131r, co\u011frafi bilgi ekler, veri tiplerini d\u00f6n\u00fc\u015ft\u00fcr\u00fcr ve gereksiz alanlar\u0131 temizler. Ba\u015far\u0131s\u0131z olan filtreler i\u00e7in etiketler eklenmesi, sorun gidermeyi kolayla\u015ft\u0131r\u0131r.<\/p>\n
Syslog Loglar\u0131n\u0131n Yap\u0131land\u0131r\u0131lmas\u0131<\/h3>\n
Syslog, Linux sistemlerinde ve a\u011f cihazlar\u0131nda yayg\u0131n olarak kullan\u0131lan bir loglama protokol\u00fcd\u00fcr. Farkl\u0131 cihazlardan gelen syslog mesajlar\u0131 genellikle benzer bir yap\u0131ya sahiptir ancak mesaj i\u00e7eri\u011fi b\u00fcy\u00fck \u00f6l\u00e7\u00fcde de\u011fi\u015febilir.<\/p>\n
Hedef:<\/strong> Syslog mesajlar\u0131n\u0131 ayr\u0131\u015ft\u0131rmak, ana makine ad\u0131n\u0131 \u00e7\u0131karmak, zaman damgas\u0131n\u0131 ayarlamak ve mesaj i\u00e7eri\u011fini daha fazla i\u015flemek.<\/p>\n
input {\n  beats {\n    port => 5044\n  }\n}\n\nfilter {\n  if [fields][log_type] == \"syslog\" {\n    grok {\n      # Syslog ba\u015fl\u0131\u011f\u0131n\u0131 ayr\u0131\u015ft\u0131r\n      match => { \"message\" => \"<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{PROG:syslog_program}(?:\\[%{POSINT:syslog_pid}\\])?: %{GREEDYDATA:syslog_message}\" }\n      add_tag => [ \"_grokparsefailure_syslog\" ]\n    }\n    date {\n      match => [ \"syslog_timestamp\", \"MMM  d HH:mm:ss\", \"MMM dd HH:mm:ss\", \"ISO8601\" ]\n      target => \"@timestamp\"\n      add_tag => [ \"_dateparsefailure_syslog\" ]\n    }\n    # E\u011fer syslog_message i\u00e7inde anahtar-de\u011fer \u00e7iftleri varsa, onlar\u0131 da ayr\u0131\u015ft\u0131r\n    if \"syslog_message\" in [tags] { # Sadece grok ba\u015far\u0131l\u0131 olduysa devam et\n      kv {\n        source => \"syslog_message\"\n        field_split => \", \"\n        value_split => \"=\"\n        # Ayr\u0131\u015ft\u0131r\u0131lan alanlar\u0131 syslog_data alt alan\u0131na koy\n        target => \"syslog_data\"\n        # Baz\u0131 alanlar\u0131 kald\u0131r\n        remove_field => [ \"syslog_message\" ]\n      }\n    }\n    mutate {\n      remove_field => [ \"syslog_timestamp\", \"syslog_pri\" ]\n    }\n  }\n}\n\noutput {\n  elasticsearch {\n    hosts => [\"localhost:9200\"]\n    index => \"syslog-%{+YYYY.MM.dd}\"\n  }\n}<\/code><\/pre>\n
Bu \u00f6rnek, syslog mesaj\u0131n\u0131n ba\u015fl\u0131\u011f\u0131n\u0131 ayr\u0131\u015ft\u0131r\u0131r, ard\u0131ndan mesaj\u0131n i\u00e7eri\u011finde anahtar-de\u011fer \u00e7iftleri varsa kv<\/code> filtresiyle bunlar\u0131 da i\u015fler.<\/p>\n
\u00d6zel Uygulama Loglar\u0131n\u0131n Ayr\u0131\u015ft\u0131r\u0131lmas\u0131<\/h3>\n
Bir\u00e7ok uygulama, kendi \u00f6zel formatlar\u0131nda loglar \u00fcretir. Bu loglar genellikle JSON, XML veya \u00f6zel ayr\u0131lm\u0131\u015f metin format\u0131nda olabilir.<\/p>\n
Hedef:<\/strong> \u00d6zel bir uygulaman\u0131n virg\u00fclle ayr\u0131lm\u0131\u015f loglar\u0131n\u0131 (CSV benzeri) ayr\u0131\u015ft\u0131rmak.<\/p>\n
input {\n  beats {\n    port => 5044\n  }\n}\n\nfilter {\n  if [fields][log_type] == \"my_app_log\" {\n    csv {\n      separator => \",\"\n      columns => [\"timestamp\", \"log_level\", \"user_id\", \"action\", \"status\", \"message\"]\n      add_tag => [ \"_csvparsefailure_myapp\" ]\n    }\n    date {\n      match => [ \"timestamp\", \"ISO8601\" ]\n      target => \"@timestamp\"\n      add_tag => [ \"_dateparsefailure_myapp\" ]\n    }\n    mutate {\n      convert => { \"user_id\" => \"integer\" }\n    }\n    # Belirli bir seviyenin alt\u0131ndaki loglar\u0131 at\n    if [log_level] == \"DEBUG\" or [log_level] == \"TRACE\" {\n      drop {}\n    }\n  }\n}\n\noutput {\n  elasticsearch {\n    hosts => [\"localhost:9200\"]\n    index => \"my-app-logs-%{+YYYY.MM.dd}\"\n  }\n}<\/code><\/pre>\n
Bu \u00f6rnekte, csv<\/code> filtresi kullan\u0131larak virg\u00fclle ayr\u0131lm\u0131\u015f loglar ayr\u0131\u015ft\u0131r\u0131l\u0131r, zaman damgas\u0131 ayarlan\u0131r, user_id<\/code> alan\u0131 tam say\u0131ya d\u00f6n\u00fc\u015ft\u00fcr\u00fcl\u00fcr ve “DEBUG” veya “TRACE” seviyesindeki loglar at\u0131l\u0131r.<\/p>\n
Sonu\u00e7: Geli\u015fmi\u015f Loglama ve Analiz \u0130\u00e7in Filtrelerin \u00d6nemi<\/h2>\n
Merkezi loglama, modern IT altyap\u0131lar\u0131n\u0131n vazge\u00e7ilmez bir par\u00e7as\u0131d\u0131r. Logstash, bu ekosistemin kalbinde yer alarak, ham ve da\u011f\u0131n\u0131k log verilerini anlaml\u0131, yap\u0131land\u0131r\u0131lm\u0131\u015f ve analiz edilebilir bilgilere d\u00f6n\u00fc\u015ft\u00fcrme g\u00f6revini \u00fcstlenir. Bu d\u00f6n\u00fc\u015f\u00fcm s\u00fcrecinin anahtar\u0131 ise Logstash filtreleridir.<\/p>\n
grok<\/code> ile yap\u0131land\u0131r\u0131lmam\u0131\u015f metinleri ayr\u0131\u015ft\u0131rmaktan, date<\/code> ile zaman damgalar\u0131n\u0131 standardize etmeye, mutate<\/code> ile alanlar\u0131 manip\u00fcle etmeye, json<\/code> ve kv<\/code> ile yap\u0131land\u0131r\u0131lm\u0131\u015f verileri i\u015flemeye, geoip<\/code> ile co\u011frafi zenginle\u015ftirme yapmaya ve drop<\/code> ile gereksiz g\u00fcr\u00fclt\u00fcy\u00fc temizlemeye kadar, Logstash filtreleri geni\u015f bir yelpazede yetenekler sunar. if<\/code> ko\u015fullar\u0131yla birle\u015fti\u011finde, bu filtreler son derece esnek ve g\u00fc\u00e7l\u00fc pipeline’lar olu\u015fturulmas\u0131na olanak tan\u0131r.<\/p>\n
Logstash filtrelerini etkin bir \u015fekilde kullanmak, sadece loglar\u0131n Elasticsearch’e g\u00f6nderilmesini sa\u011flamakla kalmaz, ayn\u0131 zamanda:<\/p>\n
*   Analitik De\u011feri Art\u0131r\u0131r:<\/strong> Yap\u0131land\u0131r\u0131lm\u0131\u015f veriler \u00fczerinde daha karma\u015f\u0131k sorgular ve g\u00f6rselle\u015ftirmeler yap\u0131lmas\u0131n\u0131 sa\u011flar.
\n*   Sorun Gidermeyi H\u0131zland\u0131r\u0131r:<\/strong> Anlaml\u0131 alanlar sayesinde, belirli bir hatay\u0131 veya olay\u0131 h\u0131zla bulmay\u0131 ve k\u00f6k nedenini belirlemeyi kolayla\u015ft\u0131r\u0131r.
\n*   G\u00fcvenli\u011fi \u0130yile\u015ftirir:<\/strong> G\u00fcvenlik olaylar\u0131n\u0131, anormal davran\u0131\u015flar\u0131 veya sald\u0131r\u0131 giri\u015fimlerini tespit etmek i\u00e7in loglar\u0131 daha etkin bir \u015fekilde analiz etmeye olanak tan\u0131r.
\n*   Performans\u0131 ve Depolama Verimlili\u011fini Art\u0131r\u0131r:<\/strong> Gereksiz verileri atarak veya \u00f6zetleyerek hem depolama maliyetlerini d\u00fc\u015f\u00fcr\u00fcr hem de Elasticsearch’teki indeksleme performans\u0131n\u0131 optimize eder.
\n*   Veri Tutarl\u0131l\u0131\u011f\u0131n\u0131 Sa\u011flar:<\/strong> Farkl\u0131 kaynaklardan gelen loglar\u0131 standardize ederek, tutarl\u0131 bir analiz \u00e7er\u00e7evesi sunar.<\/p>\n
Logstash Forwarder (veya g\u00fcncel olarak Filebeat) gibi hafif ajanlar loglar\u0131 toplarken, Logstash filtreleri bu ham verileri bilgiye d\u00f6n\u00fc\u015ft\u00fcren beyin g\u00f6revini \u00fcstlenir. Bu filtrelerin do\u011fru bir \u015fekilde tasarlanmas\u0131, uygulanmas\u0131 ve s\u00fcrd\u00fcr\u00fclmesi, merkezi loglama sisteminizin ba\u015far\u0131s\u0131 i\u00e7in kritik \u00f6neme sahiptir. Unutulmamal\u0131d\u0131r ki, iyi bir loglama stratejisi, sadece loglar\u0131 toplamakla kalmaz, ayn\u0131 zamanda onlar\u0131 anlaml\u0131 hale getirerek i\u015f ve operasyonel kararlar i\u00e7in de\u011ferli bir kaynak haline getirir.<\/p>\n
<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131)\nGiri\u015f: Merkezi Loglaman\u0131n \u00d6nemi ve Logstash’in Rol\u00fc","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-33404","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nLogstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131) - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131)\" \/>\n<meta property=\"og:description\" content=\"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131) Giri\u015f: Merkezi Loglaman\u0131n \u00d6nemi ve Logstash'in Rol\u00fc\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-02T09:41:05+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"20 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131)\",\"datePublished\":\"2025-11-02T09:41:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/\"},\"wordCount\":3228,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/\",\"name\":\"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131) - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-11-02T09:41:05+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131) - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/","og_locale":"tr_TR","og_type":"article","og_title":"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131)","og_description":"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131) Giri\u015f: Merkezi Loglaman\u0131n \u00d6nemi ve Logstash'in Rol\u00fc","og_url":"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-11-02T09:41:05+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"20 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131)","datePublished":"2025-11-02T09:41:05+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/"},"wordCount":3228,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/","url":"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/","name":"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131) - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-11-02T09:41:05+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/logstash-filtreleri-ile-merkezi-loglamayi-iyilestirmek-logstash-forwarder-kullanimi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Logstash Filtreleri ile Merkezi Loglamay\u0131 \u0130yile\u015ftirmek (Logstash Forwarder Kullan\u0131m\u0131)"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=33404"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33404\/revisions"}],"predecessor-version":[{"id":33405,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33404\/revisions\/33405"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=33404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=33404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=33404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}