{"id":225,"date":"2026-10-02T12:00:00","date_gmt":"2026-10-02T12:00:00","guid":{"rendered":"https:\/\/konteynerium.com\/?p=225"},"modified":"2026-10-06T11:34:00","modified_gmt":"2026-10-06T11:34:00","slug":"elastic-stack-elk-ile-container-log-analizi","status":"publish","type":"post","link":"https:\/\/konteynerium.com\/index.php\/2026\/10\/02\/elastic-stack-elk-ile-container-log-analizi\/","title":{"rendered":"Elastic Stack (ELK) ile Container Log Analizi"},"content":{"rendered":"

“Container \u0130zleme ve Loglama” yaz\u0131m\u0131zda Prometheus ve Grafana ile metrikleri<\/em> (CPU, bellek, istek say\u0131s\u0131 gibi say\u0131sal de\u011ferler) nas\u0131l izleyece\u011fimizi g\u00f6rm\u00fc\u015ft\u00fck. Ama bir hatan\u0131n k\u00f6k nedenini bulmak genellikle say\u0131larla de\u011fil, log sat\u0131rlar\u0131yla m\u00fcmk\u00fcn olur \u2014 ve onlarca container’\u0131n loglar\u0131n\u0131 tek tek docker logs<\/code> ile aramak s\u00fcrd\u00fcr\u00fclemez. Elastic Stack<\/strong> (eskiden ELK olarak bilinir), da\u011f\u0131n\u0131k loglar\u0131 merkezi, aranabilir bir yerde toplaman\u0131n end\u00fcstri standard\u0131 \u00e7\u00f6z\u00fcm\u00fcd\u00fcr.<\/p>\n

Elastic Stack’in d\u00f6rt par\u00e7as\u0131<\/h2>\n\n\n\n\n\n\n\n\n
Bile\u015fen<\/th>\nG\u00f6revi<\/th>\n<\/tr>\n<\/thead>\n
Elasticsearch<\/strong><\/td>\nLoglar\u0131 depolayan ve saniyeler i\u00e7inde aranabilir k\u0131lan da\u011f\u0131t\u0131k arama\/analitik motoru.<\/td>\n<\/tr>\n
Logstash<\/strong><\/td>\nLoglar\u0131 toplar, ayr\u0131\u015ft\u0131r\u0131r (parse eder), zenginle\u015ftirir ve Elasticsearch’e yazar \u2014 bir “i\u015fleme hatt\u0131” (pipeline).<\/td>\n<\/tr>\n
Kibana<\/strong><\/td>\nElasticsearch’teki veriyi arama, filtreleme ve g\u00f6rselle\u015ftirme (dashboard) i\u00e7in web aray\u00fcz\u00fc.<\/td>\n<\/tr>\n
Beats<\/strong> (\u00f6rn. Filebeat)<\/td>\nSunucularda\/container’larda \u00e7al\u0131\u015fan hafif ajanlar; log dosyalar\u0131n\u0131 okuyup Logstash’e veya do\u011frudan Elasticsearch’e iletir.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Tipik bir ak\u0131\u015f \u015f\u00f6yle i\u015fler: Filebeat<\/strong> her sunucuda\/container’da log sat\u0131rlar\u0131n\u0131 toplar \u2192 Logstash<\/strong> bu ham loglar\u0131 yap\u0131land\u0131r\u0131lm\u0131\u015f veriye d\u00f6n\u00fc\u015ft\u00fcr\u00fcr (\u00f6rne\u011fin bir Nginx log sat\u0131r\u0131ndan IP, tarih, HTTP durum kodu gibi alanlar\u0131 ay\u0131klar) \u2192 Elasticsearch<\/strong> bu yap\u0131land\u0131r\u0131lm\u0131\u015f veriyi indeksler \u2192 Kibana<\/strong> \u00fczerinden aran\u0131r ve g\u00f6rselle\u015ftirilir.<\/p>\n

Prometheus + Grafana ile ELK aras\u0131ndaki fark<\/h2>\n

Bu iki y\u0131\u011f\u0131n birbirinin yerine de\u011fil, birbirini tamamlay\u0131c\u0131 olarak kullan\u0131l\u0131r:<\/p>\n\n\n\n\n\n\n\n\n
<\/th>\nPrometheus + Grafana<\/th>\nElastic Stack<\/th>\n<\/tr>\n<\/thead>\n
Veri t\u00fcr\u00fc<\/td>\nMetrikler \u2014 say\u0131sal, zaman serisi (CPU %, istek\/sn)<\/td>\nLoglar \u2014 serbest metin, yap\u0131land\u0131r\u0131lm\u0131\u015f olaylar<\/td>\n<\/tr>\n
Tipik soru<\/td>\n“CPU kullan\u0131m\u0131 son 1 saatte nas\u0131l de\u011fi\u015fti?”<\/td>\n“Bu kullan\u0131c\u0131 ID’siyle ilgili hangi hata mesajlar\u0131 ge\u00e7ti?”<\/td>\n<\/tr>\n
Veri toplama<\/td>\nPull tabanl\u0131 (Prometheus hedefleri periyodik olarak sorgular)<\/td>\nPush tabanl\u0131 (Beats\/Logstash veriyi g\u00f6nderir)<\/td>\n<\/tr>\n
Saklama maliyeti<\/td>\nG\u00f6rece d\u00fc\u015f\u00fck (\u00f6zetlenmi\u015f say\u0131sal veri)<\/td>\nG\u00f6rece y\u00fcksek (tam log metni indekslenir)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Olgun bir izleme kurulumu genellikle ikisini bir arada kullan\u0131r: Prometheus\/Grafana “bir sorun VAR m\u0131?” sorusuna (alarmlarla) h\u0131zl\u0131 cevap verir; Elastic Stack “sorun TAM OLARAK NE?” sorusuna, ilgili loglar\u0131 kazarak cevap verir.<\/p>\n

Docker Compose ile h\u0131zl\u0131 bir Elastic Stack kurulumu<\/h2>\n
services:\n  elasticsearch:\n    image: docker.elastic.co\/elasticsearch\/elasticsearch:8.15.0\n    environment:\n      discovery.type: single-node\n      xpack.security.enabled: \"false\"   # sadece yerel\/test ortam\u0131 i\u00e7in\n      ES_JAVA_OPTS: \"-Xms512m -Xmx512m\"\n    ports:\n      - \"9200:9200\"\n    volumes:\n      - es_data:\/usr\/share\/elasticsearch\/data\n\n  kibana:\n    image: docker.elastic.co\/kibana\/kibana:8.15.0\n    environment:\n      ELASTICSEARCH_HOSTS: http:\/\/elasticsearch:9200\n    ports:\n      - \"5601:5601\"\n    depends_on:\n      - elasticsearch\n\n  logstash:\n    image: docker.elastic.co\/logstash\/logstash:8.15.0\n    volumes:\n      - .\/logstash.conf:\/usr\/share\/logstash\/pipeline\/logstash.conf:ro\n    depends_on:\n      - elasticsearch\n\nvolumes:\n  es_data:<\/code><\/pre>\n
\n  i<\/span><\/p>\n
xpack.security.enabled: \"false\"<\/code> sadece yerel deneme\/\u00f6\u011frenme ortam\u0131 i\u00e7in kabul edilebilir \u2014 production’da Elasticsearch’\u00fc kimlik do\u011frulamas\u0131 kapal\u0131 \u015fekilde asla d\u0131\u015far\u0131ya a\u00e7may\u0131n. Ger\u00e7ek bir kurulumda X-Pack g\u00fcvenli\u011fini etkinle\u015ftirip TLS ve kullan\u0131c\u0131 bazl\u0131 eri\u015fim tan\u0131mlaman\u0131z gerekir.<\/p>\n<\/div>\n
Container loglar\u0131n\u0131 Elastic Stack’e ula\u015ft\u0131rman\u0131n iki yolu<\/h2>\n
1. Filebeat ile Docker loglar\u0131n\u0131 otomatik toplamak<\/strong> \u2014 en yayg\u0131n ve \u00f6nerilen y\u00f6ntem: Filebeat’i bir container olarak \u00e7al\u0131\u015ft\u0131r\u0131p, Docker’\u0131n diskte tuttu\u011fu log dosyalar\u0131n\u0131 (varsay\u0131lan json-file<\/code> log s\u00fcr\u00fcc\u00fcs\u00fcyle) otomatik ke\u015ffedip okumas\u0131n\u0131 sa\u011flars\u0131n\u0131z.<\/p>\n
# filebeat.yml\nfilebeat.autodiscover:\n  providers:\n    - type: docker\n      hints.enabled: true\n\noutput.elasticsearch:\n  hosts: [\"elasticsearch:9200\"]<\/code><\/pre>\n
  filebeat:\n    image: docker.elastic.co\/beats\/filebeat:8.15.0\n    user: root\n    volumes:\n      - .\/filebeat.yml:\/usr\/share\/filebeat\/filebeat.yml:ro\n      - \/var\/lib\/docker\/containers:\/var\/lib\/docker\/containers:ro\n      - \/var\/run\/docker.sock:\/var\/run\/docker.sock:ro\n    depends_on:\n      - elasticsearch<\/code><\/pre>\n
2. Docker’\u0131n kendi GELF log s\u00fcr\u00fcc\u00fcs\u00fcyle do\u011frudan Logstash’e g\u00f6ndermek<\/strong> \u2014 ekstra bir ajan container’\u0131 \u00e7al\u0131\u015ft\u0131rmadan, her container’\u0131n loglar\u0131n\u0131 do\u011frudan hedefe y\u00f6nlendirir:<\/p>\n
services:\n  api:\n    image: kullanici-adi\/benim-api:latest\n    logging:\n      driver: gelf\n      options:\n        gelf-address: \"udp:\/\/logstash-sunucu:12201\"\n        tag: \"benim-api\"<\/code><\/pre>\n
Logstash pipeline’\u0131: ham logu yap\u0131land\u0131r\u0131lm\u0131\u015f veriye \u00e7evirmek<\/h2>\n
Logstash’in en de\u011ferli \u00f6zelli\u011fi, serbest metin log sat\u0131rlar\u0131n\u0131 (\u00f6rne\u011fin bir Nginx eri\u015fim logunu) aranabilir alanlara ayr\u0131\u015ft\u0131rabilmesidir:<\/p>\n
# logstash.conf\ninput {\n  beats {\n    port => 5044\n  }\n}\n\nfilter {\n  if [container][name] =~ \"nginx\" {\n    grok {\n      match => { \"message\" => \"%{IPORHOST:istemci_ip} - - \\[%{HTTPDATE:zaman}\\] \\\"%{WORD:metod} %{DATA:yol} HTTP\/%{NUMBER:http_versiyon}\\\" %{NUMBER:durum_kodu} %{NUMBER:boyut}\" }\n    }\n    mutate {\n      convert => { \"durum_kodu\" => \"integer\" }\n    }\n  }\n}\n\noutput {\n  elasticsearch {\n    hosts => [\"elasticsearch:9200\"]\n    index => \"loglar-%{+YYYY.MM.dd}\"\n  }\n}<\/code><\/pre>\n
grok<\/code> filtresi, ham bir Nginx log sat\u0131r\u0131n\u0131 istemci_ip<\/code>, metod<\/code>, durum_kodu<\/code> gibi ayr\u0131 alanlara b\u00f6ler. Bu sayede Kibana’da “sadece 500 durum kodlu istekleri g\u00f6ster” veya “en \u00e7ok iste\u011fi hangi IP g\u00f6nderiyor?” gibi sorgular\u0131 saniyeler i\u00e7inde \u00e7al\u0131\u015ft\u0131rabilirsiniz \u2014 ham metinde arama yapmaktan \u00e7ok daha g\u00fc\u00e7l\u00fc bir y\u00f6ntem.<\/p>\n
Kibana’da loglar\u0131 ke\u015ffetmek<\/h2>\n
    \n
  1. localhost:5601<\/code> adresine gidin, Stack Management \u2192 Index Patterns<\/strong> alt\u0131nda loglar-*<\/code> desenini tan\u0131mlay\u0131n.<\/li>\n
  2. Discover<\/strong> sekmesinde, gelen t\u00fcm loglar\u0131 zaman s\u0131ras\u0131yla g\u00f6r\u00fcrs\u00fcn\u00fcz; sa\u011fdaki alan listesinden durum_kodu<\/code>, container.name<\/code> gibi alanlara t\u0131klayarak h\u0131zl\u0131 filtreler uygulayabilirsiniz.<\/li>\n
  3. Arama \u00e7ubu\u011funa durum_kodu >= 500 and container.name: \"benim-api\"<\/code> gibi bir KQL (Kibana Query Language) sorgusu yazarak, sadece belirli bir servisin hata verdi\u011fi anlar\u0131 saniyeler i\u00e7inde bulabilirsiniz.<\/li>\n
  4. Dashboard<\/strong> sekmesinden, “son 1 saatte durum koduna g\u00f6re istek say\u0131s\u0131” gibi grafikleri bir araya getirip Grafana’daki metrik panolar\u0131na benzer, log tabanl\u0131 bir izleme ekran\u0131 olu\u015fturabilirsiniz.<\/li>\n<\/ol>\n
    Ne zaman Elastic Stack, ne zaman daha basit bir \u00e7\u00f6z\u00fcm?<\/h2>\n
    Elastic Stack g\u00fc\u00e7l\u00fc ama kaynak a\u00e7\u0131s\u0131ndan da (bellek, disk) pahal\u0131d\u0131r \u2014 k\u00fc\u00e7\u00fck bir projede tek ba\u015f\u0131na Elasticsearch’\u00fc ayakta tutmak, uygulaman\u0131z\u0131n kendisinden daha fazla kaynak t\u00fcketebilir. Karar vermeye yard\u0131mc\u0131 bir kaba kural:<\/p>\n
      \n
    • Tek sunucu, az container:<\/strong> docker compose logs -f<\/code> ve docker logs<\/code> \u00e7o\u011fu zaman yeterlidir.<\/li>\n
    • Birka\u00e7 sunucu, orta \u00f6l\u00e7ek:<\/strong> Daha hafif bir alternatif olan Grafana Loki<\/strong> (Prometheus’un log d\u00fcnyas\u0131ndaki kar\u015f\u0131l\u0131\u011f\u0131 gibi d\u00fc\u015f\u00fcn\u00fclebilir, “grep benzeri” indeksleme yapar, Elasticsearch’ten \u00e7ok daha az kaynak t\u00fcketir) iyi bir orta nokta olabilir.<\/li>\n
    • B\u00fcy\u00fck \u00f6l\u00e7ek, karma\u015f\u0131k arama ihtiyac\u0131, uzun s\u00fcreli saklama:<\/strong> Elastic Stack’in tam metin arama g\u00fcc\u00fc ve olgun ekosistemi (g\u00fcvenlik analiti\u011fi, anomali tespiti gibi eklentiler dahil) burada \u00f6ne \u00e7\u0131kar.<\/li>\n<\/ul>\n
      Art\u0131k hem metrikleri (Prometheus + Grafana) hem de loglar\u0131 (Elastic Stack) merkezi olarak izleyip arayabiliyorsunuz. Bu, “U\u00e7tan Uca \u00d6rnek Proje” yaz\u0131m\u0131zdaki production kurulumuna eklenebilecek do\u011fal bir sonraki katman \u2014 sunucu ve altyap\u0131 otomasyonunu (Ansible, Terraform) CI\/CD ile (Jenkins veya GitHub Actions) birle\u015ftirdi\u011finizde, ger\u00e7ek bir production-grade DevOps hatt\u0131n\u0131n t\u00fcm par\u00e7alar\u0131 art\u0131k bu portalda bir arada.<\/p>\n","protected":false},"excerpt":{"rendered":"
      Elasticsearch, Logstash, Kibana ve Filebeat’in nas\u0131l bir araya geldi\u011finden Docker container loglar\u0131n\u0131 merkezi olarak toplamaya, Logstash pipeline’lar\u0131yla ham logu yap\u0131land\u0131r\u0131lm\u0131\u015f veriye \u00e7evirmeye kadar ELK ile log analizini derinlemesine i\u015fliyoruz.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"seviye":[9],"class_list":["post-225","post","type-post","status-publish","format-standard","hentry","category-production-uygulamalar","seviye-ileri"],"_links":{"self":[{"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/posts\/225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/comments?post=225"}],"version-history":[{"count":1,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/posts\/225\/revisions"}],"predecessor-version":[{"id":584,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/posts\/225\/revisions\/584"}],"wp:attachment":[{"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/media?parent=225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/categories?post=225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/tags?post=225"},{"taxonomy":"seviye","embeddable":true,"href":"https:\/\/konteynerium.com\/index.php\/wp-json\/wp\/v2\/seviye?post=225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}