Case study
Early Detection of Unusual System Behavior for a Bank
How SquareShift enriched a bank's application and infrastructure data, gave it real-time visibility, and used anomaly detection to flag unusual behavior early.
Book a session →
Client
A bank that needed to monitor its applications and infrastructure in real time and to track key banking metrics.
Industry
Financial Services
Services
Stack
Elastic Stack · Logstash · Elastic Canvas · Elastic Machine Learning (anomaly detection) · Grok · Dissect
How SquareShift delivered it.
The challenge
The bank wanted to monitor logs and metrics from multiple applications and see application and infrastructure events in real time. It also wanted to track key banking metrics, such as transaction, success and failure counts, and to surface unusual transaction, application and infrastructure patterns.
Different applications needed common log enrichment as well as their own parsing. Application behavior had to be correlated with infrastructure metrics. The bank expected live visibility, a clear visual sign of anomaly severity, and drill-down dashboards to help teams investigate and resolve issues.
What we delivered
SquareShift held discovery sessions with each application team and documented the monitoring and alerting requirements. Logstash was the main processing layer. It received the input data, applied common enrichment, used Grok and Dissect to extract application-specific fields, and prepared the data for the Elastic monitoring platform.
SquareShift configured Elastic anomaly detection for transaction, rare-event and infrastructure metrics, all running on the enriched data. Canvas dashboards showed alerts with visual severity indicators, so the bank's IT operations team could see how serious an anomaly was. Drill-down dashboards supported further investigation.
Work went through a packaging and approval process, and the dashboards were built through multiple checkpoints. Test cases were written for Logstash and the dashboards. The IT operations team tested for accuracy before production, and SquareShift supported the production deployment. For anomaly detection and monitoring on Elastic, see our Elastic search and observability services.
The outcome
The bank gained real-time visibility into application and infrastructure behavior. Logs were standardized with common enrichment while keeping application-specific parsing, and application and infrastructure metrics could be monitored together. Anomaly detection identified deviations from normal behavior, and Canvas showed them visually.
The IT operations team could use live Canvas views, anomaly indicators and drill-down dashboards to identify and investigate unusual patterns more quickly. The solution also supported proactive management and early detection of unusual application and infrastructure behavior.
Anomaly detection has to learn what normal looks like before it can flag what is not. Common enrichment across the bank's applications, with parsing kept specific to each one, gave it consistent data to learn from.
Observability & Reliability Practice Lead, SquareShift
