What is the best logging system?

Question

ubuntu

Colleagues, good afternoon.
Tell me, what system of logs is better in this case? I look towards grafana + loki, but it seems that not everything is so clear here and setting up some kind of elk will be easier than my proposed scheme. Or maybe graylog is simpler?

the task is as follows: there is a log file that needs to be parsed and drawn in a certain way in garfan / elk / somewhere else:

1.StartDate,StartTime,EndDate,EndTime:
-total number of rows that match the specified time sorting conditions
-delta between StartDate ,StartTime and EndDate,EndTime, i.e. session time
2. Organization:
- number of matches for the period
3. IP
- number of matches for all ranks of the ip address
-number of matches for all ranks of the ip address except 4

I'm not sure that grafana can do this, even in conjunction with loki. What would you suggest?

Log example:

StartDate','StartTime','EndDate','EndTime','IP','MediaID','SubscriberLogin','device','uTimeStart','uTimeEnd','Organization
2020/03/27','10:53:34','2020/03/27','10:55:48','192.168.0.1','3221227049','prod.19003c8d9a9b415ea8729255bab92097','DmpPlayer/20.0.25.13_(Android_8.0.0;_91d24574-1cf9-40e7-88e1-ff0ecc270d01;_ANE-LX1)','1585295614','1585295748','"Providername1"
2020/03/27','10:58:18','2020/03/27','10:59:30','192.168.0.2','3221227049','prod.19003c8d9a9b415ea8729255bab92097','DmpPlayer/20.0.25.13_(Android_8.0.0;_91d24574-1cf9-40e7-88e1-ff0ecc270d01;_ANE-LX1)','1585295898','1585295970','"Providername2"
2020/03/27','10:52:16','2020/03/27','10:53:31','192.168.0.3','3221230099','prod.19003c8d9a9b415ea8729255bab92097','DmpPlayer/20.0.25.13_(Android_8.0.0;_91d24574-1cf9-40e7-88e1-ff0ecc270d01;_ANE-LX1)','1585295536','1585295611','"Providername3"
2020/03/22','19:37:03','2020/03/22','20:46:20','91.186.109.163','3221226087','unknown_4610','','1584895023','1584899180','"undefined"

Answer 1

Try ELK, and when you can't get something concrete out of it, come and ask more clearly formulated questions. "Which system is better" is not something that can be unambiguously answered.

Answer 2

ELK is the easiest
system to use, literally two or three in different combinations (including Greilog),
the struggle in combinations is mainly with the loss of logs / not writing fast enough,
start with ELK since it has the most documentation, another for more loaded projects