UNC CAUSE 2016

Splunk is amazing...and amazingly expensive. Universities and businesses across the country are leaning on the ELK stack (elasticsearch, logstash, kibana) to do interesting things with log data without maxing out their Splunk licenses.



I'll discuss the basics of the ELK stack, why I found it attractive, how it can scale for basic log aggregation and management, how we pair it with other open source software for incident response and some of the pitfalls we have seen with our alpha testing.