SlideShare a Scribd company logo
1 of 39
Download to read offline
Side  by  Side  with
Elasticsearch &  Solr
Part  2  -­ Performance  &  Scalability
Radu  Gheorghe
Rafał  Kuć
Who  are  we?
Radu Rafał
Logsene
cftweia
Last  year
Last  year  conclusions
One  year  progress
Facet  by  function
https://issues.apache.org/jira/browse/SOLR-­1581
Analytics  component
https://issues.apache.org/jira/browse/SOLR-­5302
Solr  as  standalone  application
https://issues.apache.org/jira/browse/SOLR-­4792
top_hits  aggregation
https://github.com/elastic/elasticsearch/pull/6124
minimum_should_match on  has_child
https://github.com/elastic/elasticsearch/pull/6019
filters  aggregation
https://github.com/elastic/elasticsearch/pull/6118
That's  not  all
JSON  facets
https://issues.apache.org/jira/browse/SOLR-­7214
Backup  +  restore
https://issues.apache.org/jira/browse/SOLR-­5750
Streaming  aggregations
https://issues.apache.org/jira/browse/SOLR-­7082
Moving  averages  aggregation
https://github.com/elastic/elasticsearch/pull/10002
Computation  on  aggregations
https://github.com/elastic/elasticsearch/pull/9876
Cluster  state  diff  support
https://github.com/elastic/elasticsearch/pull/6295
Cross  data  center  replication
https://issues.apache.org/jira/browse/SOLR-­6273
Shadow  replicas
https://github.com/elastic/elasticsearch/pull/8976
This year’s agenda
Horizontal scaling
Products use-­case
Logs use-­case
Horizontal scaling in  theory
Node
shard
Horizontal scaling  in  theory
Node
shard
Node
shard
Horizontal scaling  in  theory
Node
shard
Node
shard
Node
shard
Horizontal scaling  in  theory
Node
shard shard
shard shard
Node
shard shard
shard shard
Node
shard shard
shard shard
Horizontal scaling  in  theory
Node
shard shard
shard shard
replica
replica
replica
replica
Node
shard shard
shard shard
replica
replica
replica
replica
Node
shard shard
shard shard
replica
replica
replica
replica
Horizontal scaling  -­ the  API
Create /  remove replicas  on  the  fly  -­
Collections  API
Moving  shards  around the  cluster  using  
add  /  delete  replica
Create /  remove replicas  on  the  fly  -­
Update  Indices  Settings
Moving  shards  around the  cluster  using  
Cluster  Reroute  API
Shard  splitting using  
Collections  API
Automatic  shard  balancing
by  default
Migrating  data with  a  given  routing  key
to  another  collection  using  API
Shard  allocation  awareness &  rule  
based  shard  placement
The  products  -­ assumptions
Steady  data  growth
Common,  known  
data  structure
Large  QPS
Spikes  in  traffic
Hardware  and  data
2  x  EC2  c3.large  instances
(2vCPU,  3.5GB  RAM,
2x16GB  SSD  in  RAID0)
vs
Wikipedia
Test  requests
One,  common query
https://github.com/sematext/berlin-­buzzwords-­samples/tree/master/2015
Dictionary  of  common and  
uncommon terms
JMeter hammering
Product  search  @  5 threads
The  products  -­ summary
prepare
for  high
QPS
plan  for  
data  
growth
Both are fast,  but  with  wikipedia
<
The  products  -­ summary
prepare
for  high
QPS
plan  for  
data  
growth
Both are fast,  but  with  wikipedia
<
Hardware  and  data (2nd  try)
2  x  EC2  c3.large  instances
(2vCPU,  3.5GB  RAM,
2x16GB  SSD  in  RAID0)
vs
Video
search
video video
video video
video video
video
video
Real product search  @  20 threads
Real product search  @  20 threads
The  products  – real summary
prepare
for  high
QPS
plan  for  
data  
growth
With  video  both are fast and  
configuration matters
The  logs  -­ assumptions
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs Logs
Logs
Lots  of  data
No  updates
Low  query  count
Time  oriented  
data
Hardware  and  data
2  x  EC2  c3.large  instances
(2vCPU,  3.5GB  RAM,
2x16GB  SSD  in  RAID0)
vs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs
Logs Logs
Logs
Apache  logs
Tuning
refresh_interval:  5s
doc_values:  truedocValues:  true
soft  autocommit: 5s
catch  all  field:  on _all:  enabled
hard autocommit:  200mb flush_threshold_size:  200mb
Test  requests
Filters Aggregations/Facets
filter  by  client    IP date  histogram
filter  by  word  in  user  
agent
top  10  response  codes
wildcard  filter  on  domain #  of  unique  IPs
top  IPs  per  response  per  time
https://github.com/sematext/berlin-­buzzwords-­samples/tree/master/2015
Test  runs
1. Write  throughput
2. Capacity of  a  single  index
3. Capacity with  time-­based indices on  
hot/cold setup
Single  index  write  throughput
Single  index  @  max EPS
Single  index  @  400 EPS
Time-­based indices
smaller  indices
lighter  indexing
easier  to  isolate  hot  data  from  cold  data
easier  to  relocate
bigger  indices
less  RAM
less  management  overhead
smaller  cluster  state
Hot  /  Cold in  practice
cron job does everything
creates indices in  advance,  on  the  hot  
nodes (createNodeSet property)
Uses node properties (e.g.  node.tag)
index templates +  shard allocation
awareness =  new indices go  to  hot  
nodes automagically
Optimizes old indices,  creates N  new
replicas of  each shard on  the  cold nodes
Removes all the  replicas from  the  hot  
nodes
Cron job optimizes old indices and  
changes shard allocation attributes =>  
shards get moved and  Do on  the  cold
nodes
Time-­based:  2  hot and  2  cold
Before
AfterAfter
Before
Time-­based:  2  hot and  2  cold
The  logs  -­ summary
Faceting
use  time  
based  indices
use  hot  /  cold  
nodes  policy
Filtering
One  summary to  rule them all
Differences in  configuration often matter
more than differences in  products
Before the  tests we  expected results to  be  
totally opposite in  both use cases
Do  your own tests with  your data and  
queries before jumping  into conclusions
We  are  hiring
Dig  Search?
Dig  Analytics?
Dig  Big  Data?
Dig  Performance?
Dig  Logging?
Dig  working  with  and  in  open  – source?
We’re  hiring  world  – wide!
http://sematext.com/about/jobs.html
Call  me,  maybe?
Radu Gheorghe
@radu0gheorghe
radu.gheorghe@sematext.com
Rafał Kuć
@kucrafal
rafal.kuc@sematext.com
Sematext
@sematext
http://sematext.com

More Related Content

What's hot

Designing ETL Pipelines with Structured Streaming and Delta Lake—How to Archi...
Designing ETL Pipelines with Structured Streaming and Delta Lake—How to Archi...Designing ETL Pipelines with Structured Streaming and Delta Lake—How to Archi...
Designing ETL Pipelines with Structured Streaming and Delta Lake—How to Archi...
Databricks
 

What's hot (20)

Designing ETL Pipelines with Structured Streaming and Delta Lake—How to Archi...
Designing ETL Pipelines with Structured Streaming and Delta Lake—How to Archi...Designing ETL Pipelines with Structured Streaming and Delta Lake—How to Archi...
Designing ETL Pipelines with Structured Streaming and Delta Lake—How to Archi...
 
Flink vs. Spark
Flink vs. SparkFlink vs. Spark
Flink vs. Spark
 
Evening out the uneven: dealing with skew in Flink
Evening out the uneven: dealing with skew in FlinkEvening out the uneven: dealing with skew in Flink
Evening out the uneven: dealing with skew in Flink
 
The Parquet Format and Performance Optimization Opportunities
The Parquet Format and Performance Optimization OpportunitiesThe Parquet Format and Performance Optimization Opportunities
The Parquet Format and Performance Optimization Opportunities
 
Everyday I'm Shuffling - Tips for Writing Better Spark Programs, Strata San J...
Everyday I'm Shuffling - Tips for Writing Better Spark Programs, Strata San J...Everyday I'm Shuffling - Tips for Writing Better Spark Programs, Strata San J...
Everyday I'm Shuffling - Tips for Writing Better Spark Programs, Strata San J...
 
Presto: Optimizing Performance of SQL-on-Anything Engine
Presto: Optimizing Performance of SQL-on-Anything EnginePresto: Optimizing Performance of SQL-on-Anything Engine
Presto: Optimizing Performance of SQL-on-Anything Engine
 
Building a SIMD Supported Vectorized Native Engine for Spark SQL
Building a SIMD Supported Vectorized Native Engine for Spark SQLBuilding a SIMD Supported Vectorized Native Engine for Spark SQL
Building a SIMD Supported Vectorized Native Engine for Spark SQL
 
ELK Stack
ELK StackELK Stack
ELK Stack
 
Introduction to ML with Apache Spark MLlib
Introduction to ML with Apache Spark MLlibIntroduction to ML with Apache Spark MLlib
Introduction to ML with Apache Spark MLlib
 
A Thorough Comparison of Delta Lake, Iceberg and Hudi
A Thorough Comparison of Delta Lake, Iceberg and HudiA Thorough Comparison of Delta Lake, Iceberg and Hudi
A Thorough Comparison of Delta Lake, Iceberg and Hudi
 
MinIO January 2020 Briefing
MinIO January 2020 BriefingMinIO January 2020 Briefing
MinIO January 2020 Briefing
 
Where is my bottleneck? Performance troubleshooting in Flink
Where is my bottleneck? Performance troubleshooting in FlinkWhere is my bottleneck? Performance troubleshooting in Flink
Where is my bottleneck? Performance troubleshooting in Flink
 
Geospatial Indexing at Scale: The 15 Million QPS Redis Architecture Powering ...
Geospatial Indexing at Scale: The 15 Million QPS Redis Architecture Powering ...Geospatial Indexing at Scale: The 15 Million QPS Redis Architecture Powering ...
Geospatial Indexing at Scale: The 15 Million QPS Redis Architecture Powering ...
 
What is in a Lucene index?
What is in a Lucene index?What is in a Lucene index?
What is in a Lucene index?
 
Introduction to Spark with Python
Introduction to Spark with PythonIntroduction to Spark with Python
Introduction to Spark with Python
 
Flexible and Real-Time Stream Processing with Apache Flink
Flexible and Real-Time Stream Processing with Apache FlinkFlexible and Real-Time Stream Processing with Apache Flink
Flexible and Real-Time Stream Processing with Apache Flink
 
Apache Spark Core – Practical Optimization
Apache Spark Core – Practical OptimizationApache Spark Core – Practical Optimization
Apache Spark Core – Practical Optimization
 
Autoscaling Flink with Reactive Mode
Autoscaling Flink with Reactive ModeAutoscaling Flink with Reactive Mode
Autoscaling Flink with Reactive Mode
 
redis basics
redis basicsredis basics
redis basics
 
Apache Spark Streaming in K8s with ArgoCD & Spark Operator
Apache Spark Streaming in K8s with ArgoCD & Spark OperatorApache Spark Streaming in K8s with ArgoCD & Spark Operator
Apache Spark Streaming in K8s with ArgoCD & Spark Operator
 

Similar to Side by Side with Elasticsearch & Solr, Part 2

Optimization In Mobile Systems
Optimization In Mobile SystemsOptimization In Mobile Systems
Optimization In Mobile Systems
momobangalore
 
WE18_Performance_Up.ppt
WE18_Performance_Up.pptWE18_Performance_Up.ppt
WE18_Performance_Up.ppt
webhostingguy
 
Automate That! Scripting Atlassian applications in Python
Automate That! Scripting Atlassian applications in PythonAutomate That! Scripting Atlassian applications in Python
Automate That! Scripting Atlassian applications in Python
Atlassian
 
Automate that
Automate thatAutomate that
Automate that
Atlassian
 

Similar to Side by Side with Elasticsearch & Solr, Part 2 (20)

YOW2018 Cloud Performance Root Cause Analysis at Netflix
YOW2018 Cloud Performance Root Cause Analysis at NetflixYOW2018 Cloud Performance Root Cause Analysis at Netflix
YOW2018 Cloud Performance Root Cause Analysis at Netflix
 
(WEB301) Operational Web Log Analysis | AWS re:Invent 2014
(WEB301) Operational Web Log Analysis | AWS re:Invent 2014(WEB301) Operational Web Log Analysis | AWS re:Invent 2014
(WEB301) Operational Web Log Analysis | AWS re:Invent 2014
 
SharePoint 2010 Boost your farm performance!
SharePoint 2010 Boost your farm performance!SharePoint 2010 Boost your farm performance!
SharePoint 2010 Boost your farm performance!
 
Optimization In Mobile Systems
Optimization In Mobile SystemsOptimization In Mobile Systems
Optimization In Mobile Systems
 
How Rackspace Cloud Monitoring uses Cassandra
How Rackspace Cloud Monitoring uses CassandraHow Rackspace Cloud Monitoring uses Cassandra
How Rackspace Cloud Monitoring uses Cassandra
 
WE18_Performance_Up.ppt
WE18_Performance_Up.pptWE18_Performance_Up.ppt
WE18_Performance_Up.ppt
 
Using Sumo Logic - Apr 2018
Using Sumo Logic - Apr 2018Using Sumo Logic - Apr 2018
Using Sumo Logic - Apr 2018
 
Elasticsearch for Logs & Metrics - a deep dive
Elasticsearch for Logs & Metrics - a deep diveElasticsearch for Logs & Metrics - a deep dive
Elasticsearch for Logs & Metrics - a deep dive
 
Rit 2011 ats
Rit 2011 atsRit 2011 ats
Rit 2011 ats
 
Voldemort & Hadoop @ Linkedin, Hadoop User Group Jan 2010
Voldemort & Hadoop @ Linkedin, Hadoop User Group Jan 2010Voldemort & Hadoop @ Linkedin, Hadoop User Group Jan 2010
Voldemort & Hadoop @ Linkedin, Hadoop User Group Jan 2010
 
Hadoop and Voldemort @ LinkedIn
Hadoop and Voldemort @ LinkedInHadoop and Voldemort @ LinkedIn
Hadoop and Voldemort @ LinkedIn
 
Tuning Elasticsearch Indexing Pipeline for Logs
Tuning Elasticsearch Indexing Pipeline for LogsTuning Elasticsearch Indexing Pipeline for Logs
Tuning Elasticsearch Indexing Pipeline for Logs
 
Automate That! Scripting Atlassian applications in Python
Automate That! Scripting Atlassian applications in PythonAutomate That! Scripting Atlassian applications in Python
Automate That! Scripting Atlassian applications in Python
 
Automate that
Automate thatAutomate that
Automate that
 
Amazon Kinesis
Amazon KinesisAmazon Kinesis
Amazon Kinesis
 
Ceph Day Taipei - Accelerate Ceph via SPDK
Ceph Day Taipei - Accelerate Ceph via SPDK Ceph Day Taipei - Accelerate Ceph via SPDK
Ceph Day Taipei - Accelerate Ceph via SPDK
 
Load and Performance Testing for J2EE - Testing, monitoring and reporting usi...
Load and Performance Testing for J2EE - Testing, monitoring and reporting usi...Load and Performance Testing for J2EE - Testing, monitoring and reporting usi...
Load and Performance Testing for J2EE - Testing, monitoring and reporting usi...
 
Best Practices for Building Robust Data Platform with Apache Spark and Delta
Best Practices for Building Robust Data Platform with Apache Spark and DeltaBest Practices for Building Robust Data Platform with Apache Spark and Delta
Best Practices for Building Robust Data Platform with Apache Spark and Delta
 
Real time analytics at uber @ strata data 2019
Real time analytics at uber @ strata data 2019Real time analytics at uber @ strata data 2019
Real time analytics at uber @ strata data 2019
 
Leveraging Open Source to Manage SAN Performance
Leveraging Open Source to Manage SAN PerformanceLeveraging Open Source to Manage SAN Performance
Leveraging Open Source to Manage SAN Performance
 

More from Sematext Group, Inc.

Metrics, Logs, Transaction Traces, Anomaly Detection at Scale
Metrics, Logs, Transaction Traces, Anomaly Detection at ScaleMetrics, Logs, Transaction Traces, Anomaly Detection at Scale
Metrics, Logs, Transaction Traces, Anomaly Detection at Scale
Sematext Group, Inc.
 

More from Sematext Group, Inc. (20)

Tweaking the Base Score: Lucene/Solr Similarities Explained
Tweaking the Base Score: Lucene/Solr Similarities ExplainedTweaking the Base Score: Lucene/Solr Similarities Explained
Tweaking the Base Score: Lucene/Solr Similarities Explained
 
OOPs, OOMs, oh my! Containerizing JVM apps
OOPs, OOMs, oh my! Containerizing JVM appsOOPs, OOMs, oh my! Containerizing JVM apps
OOPs, OOMs, oh my! Containerizing JVM apps
 
Is observability good for your brain?
Is observability good for your brain?Is observability good for your brain?
Is observability good for your brain?
 
Introducing log analysis to your organization
Introducing log analysis to your organization Introducing log analysis to your organization
Introducing log analysis to your organization
 
Solr Search Engine: Optimize Is (Not) Bad for You
Solr Search Engine: Optimize Is (Not) Bad for YouSolr Search Engine: Optimize Is (Not) Bad for You
Solr Search Engine: Optimize Is (Not) Bad for You
 
Solr on Docker - the Good, the Bad and the Ugly
Solr on Docker - the Good, the Bad and the UglySolr on Docker - the Good, the Bad and the Ugly
Solr on Docker - the Good, the Bad and the Ugly
 
Monitoring and Log Management for
Monitoring and Log Management forMonitoring and Log Management for
Monitoring and Log Management for
 
Introduction to solr
Introduction to solrIntroduction to solr
Introduction to solr
 
Building Resilient Log Aggregation Pipeline with Elasticsearch & Kafka
Building Resilient Log Aggregation Pipeline with Elasticsearch & KafkaBuilding Resilient Log Aggregation Pipeline with Elasticsearch & Kafka
Building Resilient Log Aggregation Pipeline with Elasticsearch & Kafka
 
How to Run Solr on Docker and Why
How to Run Solr on Docker and WhyHow to Run Solr on Docker and Why
How to Run Solr on Docker and Why
 
Tuning Solr & Pipeline for Logs
Tuning Solr & Pipeline for LogsTuning Solr & Pipeline for Logs
Tuning Solr & Pipeline for Logs
 
Running High Performance & Fault-tolerant Elasticsearch Clusters on Docker
Running High Performance & Fault-tolerant Elasticsearch Clusters on DockerRunning High Performance & Fault-tolerant Elasticsearch Clusters on Docker
Running High Performance & Fault-tolerant Elasticsearch Clusters on Docker
 
Top Node.js Metrics to Watch
Top Node.js Metrics to WatchTop Node.js Metrics to Watch
Top Node.js Metrics to Watch
 
Running High Performance and Fault Tolerant Elasticsearch Clusters on Docker
Running High Performance and Fault Tolerant Elasticsearch Clusters on DockerRunning High Performance and Fault Tolerant Elasticsearch Clusters on Docker
Running High Performance and Fault Tolerant Elasticsearch Clusters on Docker
 
Large Scale Log Analytics with Solr (from Lucene Revolution 2015)
Large Scale Log Analytics with Solr (from Lucene Revolution 2015)Large Scale Log Analytics with Solr (from Lucene Revolution 2015)
Large Scale Log Analytics with Solr (from Lucene Revolution 2015)
 
From Zero to Production Hero: Log Analysis with Elasticsearch (from Velocity ...
From Zero to Production Hero: Log Analysis with Elasticsearch (from Velocity ...From Zero to Production Hero: Log Analysis with Elasticsearch (from Velocity ...
From Zero to Production Hero: Log Analysis with Elasticsearch (from Velocity ...
 
Docker Logging Webinar
Docker Logging  WebinarDocker Logging  Webinar
Docker Logging Webinar
 
Docker Monitoring Webinar
Docker Monitoring  WebinarDocker Monitoring  Webinar
Docker Monitoring Webinar
 
Metrics, Logs, Transaction Traces, Anomaly Detection at Scale
Metrics, Logs, Transaction Traces, Anomaly Detection at ScaleMetrics, Logs, Transaction Traces, Anomaly Detection at Scale
Metrics, Logs, Transaction Traces, Anomaly Detection at Scale
 
Solr Anti Patterns
Solr Anti PatternsSolr Anti Patterns
Solr Anti Patterns
 

Side by Side with Elasticsearch & Solr, Part 2

  • 1. Side  by  Side  with Elasticsearch &  Solr Part  2  -­ Performance  &  Scalability Radu  Gheorghe Rafał  Kuć
  • 2. Who  are  we? Radu Rafał Logsene cftweia
  • 5. One  year  progress Facet  by  function https://issues.apache.org/jira/browse/SOLR-­1581 Analytics  component https://issues.apache.org/jira/browse/SOLR-­5302 Solr  as  standalone  application https://issues.apache.org/jira/browse/SOLR-­4792 top_hits  aggregation https://github.com/elastic/elasticsearch/pull/6124 minimum_should_match on  has_child https://github.com/elastic/elasticsearch/pull/6019 filters  aggregation https://github.com/elastic/elasticsearch/pull/6118
  • 6. That's  not  all JSON  facets https://issues.apache.org/jira/browse/SOLR-­7214 Backup  +  restore https://issues.apache.org/jira/browse/SOLR-­5750 Streaming  aggregations https://issues.apache.org/jira/browse/SOLR-­7082 Moving  averages  aggregation https://github.com/elastic/elasticsearch/pull/10002 Computation  on  aggregations https://github.com/elastic/elasticsearch/pull/9876 Cluster  state  diff  support https://github.com/elastic/elasticsearch/pull/6295 Cross  data  center  replication https://issues.apache.org/jira/browse/SOLR-­6273 Shadow  replicas https://github.com/elastic/elasticsearch/pull/8976
  • 7. This year’s agenda Horizontal scaling Products use-­case Logs use-­case
  • 8. Horizontal scaling in  theory Node shard
  • 9. Horizontal scaling  in  theory Node shard Node shard
  • 10. Horizontal scaling  in  theory Node shard Node shard Node shard
  • 11. Horizontal scaling  in  theory Node shard shard shard shard Node shard shard shard shard Node shard shard shard shard
  • 12. Horizontal scaling  in  theory Node shard shard shard shard replica replica replica replica Node shard shard shard shard replica replica replica replica Node shard shard shard shard replica replica replica replica
  • 13. Horizontal scaling  -­ the  API Create /  remove replicas  on  the  fly  -­ Collections  API Moving  shards  around the  cluster  using   add  /  delete  replica Create /  remove replicas  on  the  fly  -­ Update  Indices  Settings Moving  shards  around the  cluster  using   Cluster  Reroute  API Shard  splitting using   Collections  API Automatic  shard  balancing by  default Migrating  data with  a  given  routing  key to  another  collection  using  API Shard  allocation  awareness &  rule   based  shard  placement
  • 14. The  products  -­ assumptions Steady  data  growth Common,  known   data  structure Large  QPS Spikes  in  traffic
  • 15. Hardware  and  data 2  x  EC2  c3.large  instances (2vCPU,  3.5GB  RAM, 2x16GB  SSD  in  RAID0) vs Wikipedia
  • 16. Test  requests One,  common query https://github.com/sematext/berlin-­buzzwords-­samples/tree/master/2015 Dictionary  of  common and   uncommon terms JMeter hammering
  • 17. Product  search  @  5 threads
  • 18. The  products  -­ summary prepare for  high QPS plan  for   data   growth Both are fast,  but  with  wikipedia <
  • 19. The  products  -­ summary prepare for  high QPS plan  for   data   growth Both are fast,  but  with  wikipedia <
  • 20. Hardware  and  data (2nd  try) 2  x  EC2  c3.large  instances (2vCPU,  3.5GB  RAM, 2x16GB  SSD  in  RAID0) vs Video search video video video video video video video video
  • 21. Real product search  @  20 threads
  • 22. Real product search  @  20 threads
  • 23. The  products  – real summary prepare for  high QPS plan  for   data   growth With  video  both are fast and   configuration matters
  • 24. The  logs  -­ assumptions Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Lots  of  data No  updates Low  query  count Time  oriented   data
  • 25. Hardware  and  data 2  x  EC2  c3.large  instances (2vCPU,  3.5GB  RAM, 2x16GB  SSD  in  RAID0) vs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Logs Apache  logs
  • 26. Tuning refresh_interval:  5s doc_values:  truedocValues:  true soft  autocommit: 5s catch  all  field:  on _all:  enabled hard autocommit:  200mb flush_threshold_size:  200mb
  • 27. Test  requests Filters Aggregations/Facets filter  by  client    IP date  histogram filter  by  word  in  user   agent top  10  response  codes wildcard  filter  on  domain #  of  unique  IPs top  IPs  per  response  per  time https://github.com/sematext/berlin-­buzzwords-­samples/tree/master/2015
  • 28. Test  runs 1. Write  throughput 2. Capacity of  a  single  index 3. Capacity with  time-­based indices on   hot/cold setup
  • 29. Single  index  write  throughput
  • 30. Single  index  @  max EPS
  • 31. Single  index  @  400 EPS
  • 32. Time-­based indices smaller  indices lighter  indexing easier  to  isolate  hot  data  from  cold  data easier  to  relocate bigger  indices less  RAM less  management  overhead smaller  cluster  state
  • 33. Hot  /  Cold in  practice cron job does everything creates indices in  advance,  on  the  hot   nodes (createNodeSet property) Uses node properties (e.g.  node.tag) index templates +  shard allocation awareness =  new indices go  to  hot   nodes automagically Optimizes old indices,  creates N  new replicas of  each shard on  the  cold nodes Removes all the  replicas from  the  hot   nodes Cron job optimizes old indices and   changes shard allocation attributes =>   shards get moved and  Do on  the  cold nodes
  • 34. Time-­based:  2  hot and  2  cold Before AfterAfter Before
  • 35. Time-­based:  2  hot and  2  cold
  • 36. The  logs  -­ summary Faceting use  time   based  indices use  hot  /  cold   nodes  policy Filtering
  • 37. One  summary to  rule them all Differences in  configuration often matter more than differences in  products Before the  tests we  expected results to  be   totally opposite in  both use cases Do  your own tests with  your data and   queries before jumping  into conclusions
  • 38. We  are  hiring Dig  Search? Dig  Analytics? Dig  Big  Data? Dig  Performance? Dig  Logging? Dig  working  with  and  in  open  – source? We’re  hiring  world  – wide! http://sematext.com/about/jobs.html
  • 39. Call  me,  maybe? Radu Gheorghe @radu0gheorghe radu.gheorghe@sematext.com Rafał Kuć @kucrafal rafal.kuc@sematext.com Sematext @sematext http://sematext.com