The problem is that they're all on different servers. Once you use log aggregation stuff like DataDog, Splunk, or Kibana you get it, but before it's hard to see the benefits. Stuff like being able to see a timestamp of when an error first appeared and then from the same place see what other stuff happened around the same time.

[–] Semi-Hemi-Demigod@kbin.social 2 points 1 year ago (1 children)

If I had dozens or hundreds of servers that would make a huge difference, but for under a dozen I think the cost of setting that all up isn't worth the added benefit. Plus if the log aggregation goes down (which I've seen happen with some really hairy issues) you're back to grepping files so it's good to know how.

[–] JackbyDev@programming.dev 3 points 1 year ago

Totally. I'm talking more from the enterprise perspective. Even apart from that I'm not sure if the cost is worth it at that scale. Even using foss solutions the dev hours setting it up might not be worth it.

[–] docAvid@midwest.social 2 points 1 year ago (2 children)

One log file, or all, I want grep or awk, maybe with find in front, possibly throw some jq on top if something is logging big json blobs.

[–] thelastknowngod@lemm.ee 2 points 1 year ago

That's a lot slower at scale than something like Loki.

[–] JackbyDev@programming.dev 2 points 1 year ago

I feel you. The problem with a lot of Elastic style document search engines is that they don't ever let you search by very explicit terms because of how the index is built. I believe the pros outweigh the cons but I often wish I could "drop into" grep, less, and others from within the log aggregation tool.

[–] thelastknowngod@lemm.ee 2 points 1 year ago

Exactly.