Exporting Redis Slowlog to Elasticsearch with a Customized rsbeat

1. Redis Slowlog Overview

Redis provides the SLOWLOG feature to record commands whose execution time exceeds a configurable threshold ( slowlog-log-slower-than, default 10 ms). The log is stored in an in‑memory FIFO queue with a maximum length ( slowlog-max-len, default 128). When the limit is reached, the oldest entries are discarded, which can cause loss of historical data.

Key commands: SLOWLOG GET N – retrieve the most recent N entries. SLOWLOG RESET – clear the log.

2. rsbeat – a Beat for Redis

rsbeat is a community‑maintained Beat that connects to Redis instances, reads slowlog entries and forwards them to Logstash or Elasticsearch. It follows the Beats architecture of lightweight, single‑purpose data shippers.

3. Extending rsbeat for Redis Sentinel and Redis Cluster

The upstream rsbeat only accepted a list of ip:port strings. To support Sentinel‑managed masters and Redis Cluster topologies, three main changes were introduced.

3.1 Configuration format

The configuration field was renamed from ipPort to ipPortName. Each entry now contains:

IP address and port of the Redis node.

An optional name: for Sentinel this is the master name registered in Sentinel; for Cluster this can be a custom cluster identifier or a name from a CMDB.

This allows a single entry such as myredis:6379:my‑master to represent a Sentinel master or a cluster group, avoiding the need to log into each node individually.

3.2 Capturing instance role

After retrieving slowlog entries, rsbeat now issues a ROLE command to the same connection. The response indicates whether the instance is a master or a replica . The role value is added to the Beat event payload under the field role, enabling role‑based filtering in downstream analysis.

3.3 Making slowlog length configurable

The original hard‑coded limit of 128 entries is exposed as a configurable parameter SlowerLen in config.go. The default value remains 128 to preserve existing behavior, but operators can now adjust the limit without recompiling.

3.4 Code changes (illustrative)

// In config.go
type Config struct {
    // other fields …
    SlowerLen int `config:"slowerlen"` // default 128
}

// In rsbeat.go – parsing ipPortName
func parseTarget(t string) (ip string, port string, name string) {
    // split by ':' and assign values
}

// In the collection loop
entries, _ := conn.Do("SLOWLOG", "GET", cfg.SlowerLen)
role, _ := conn.Do("ROLE")
event["role"] = role[0] // "master" or "slave"

4. Analyzing slowlog data with Kibana

When rsbeat ships events to Elasticsearch, Kibana can be used to visualize and filter the data. Typical queries include:

Filtering by the custom name field to isolate a specific Sentinel master or Cluster group.

Adding a filter on the role field to separate master‑only metrics from replica metrics.

Building dashboards that show latency distribution, slowlog entry count over time, and role‑based performance trends.

5. Conclusion

By extending rsbeat to understand Sentinel and Cluster topologies, exposing the slowlog length, and attaching role information, operators can retain a complete history of Redis slowlog entries and perform detailed performance analysis in Kibana. This approach eliminates the loss of historic slow queries caused by the default FIFO limit and provides richer context for troubleshooting Redis latency issues.