OpenChain - The Ramifications of ISO/IEC 5230 and ISO/IEC 18974 for Legal Pro...
Kusto (Azure Data Explorer) Training for R&D - January 2019
1. Kusto
Azure Data Explorer
For Taboola LA R&D
Monitoring in Production
Maher Odeh (Taboola Production IT), Adi Eldar (Microsoft), Tal Bar Zvi (Taboola R&D) 1
https://youtu.be/iWay1PeoGhg
Click here to watch
the recorded session
8. Kusto is...
8
A new way to look at data / logs
What is it actually?What is it actually?
It’s a new, innovative thing
Developed by Microsoft
We are one of the first to use it
It helps us to get the picture of our service in a few
seconds
What is it actually?
It’s a new, innovative thing
Developed by Microsoft
We are one of the first to use it
It helps us to get the picture of our service in a few
seconds
Wow, sounds cool
10. Now Really Let’s begin
10
✓ Big Data
✓ Database
✓ Tables
✓ Functions
✓ Scripting
✓ Join
✓ Union
✓ Fast Search
✓ Graphs
✓ Dashboards
✓ Alerts
✓ HTTP Logs (for now)
✓ Notebooks
✓ Python
11. Why Kusto?
● Kibana-Fastly replacement
● It has a WOW effect
● It is easy to use and learn
11
It is new, for all,
we learn it together.
(This is Rare!)
12. 12
Different payment model.
Kusto is already paid - flat.
Queries do not* cost extra money.
*prod-it are gonna hate me after this slide
✓ Credits: Shaked Zychlinski
17. Architecture
17
Log files - from Fastly (CDN)
Kusto
Web interface
● Query
● Graphs
● Dashboards
API
● Alerts (Sensu)
● Scripting
● Jupyter
● Programming
18. What is a CDN (Fastly & Akamai for example)?
18
50 server farms
7 Data Centers
Caching our HTTP responses
HTTP Logs
CDN = Content Delivery Network
19. Kusto Database Sizes (as of Jan 2019)
19
Database Size RETENTION
COLD / HOT (CACHED)
fastly-
backstage
15 GB 60 days (31 days 🔥)
fastly-c3 10 TB 30 days (3 days 🔥)
fastly-trc 250 TB 30 days (3 days 🔥)
20. SLIDE | 20
Take Away
Messages No. 1
20
1. Kusto is BigData database
1. It holds our HTTP requests
1. Hot vs. Cold
26. Example No. 1 of 7
26
● trc_access | count
Hot vs. Cold...
27. Example No. 1 of 7 - corrected
27
● trc_access | where timestamp > ago(1d) | count
28. Example No. 2 of 7 - by publisher
28
trc_access |
where timestamp > ago(1d) |
where publisher_name == ‘msn-msn’ |
count
29. Example No. 3 of 7 - take (like “limit”)
29
trc_access |
where timestamp > ago(5m) |
where publisher_name == ‘msn-msn’ |
take 5Geo Referrer Time Action URL
30. Example No. 4 of 7 - summarize & top
30
trc_access | where timestamp > ago(1h) |
summarize count() by geo_country_code |
top 5 by count_ desc;
trc_access | where timestamp > ago(1h) |
summarize count() by action |
top 5 by count_ desc
; Semicolon
31. Example No. 5 of 7 - render
31
trc_access | where timestamp > ago(1h) |
summarize count() by geo_country_code |
top 5 by count_ desc; | render piechart
WOW
36. Exmple - HTTP errors, where? what?
36
● Step 1 - See HTTP error increased
● Step 2 - Summarize by data center
● Step 3 - Summarize by action
● Step 4 - Union with normal traffic
HTTP Error Spike
Step 1
NJ & CH are
suffering
Step 2Step 2`Step 3
Found the actionsUnion
Project
Alias
Low
errors
Normal
Traffic
Both Normal
and Errors rise
Errors
Gone
37. SLIDE | 37
Take Away
Messages No. 2
37
1. Kusto has fast query capacities
1. It can create graphs
1. Can aggregate and create fields on-the-fly
1. Helps in:
a. Find root cause
b. Traffic sampling
c. Insights & trends
d. Integration validations
54. Use make-series (it’s fast)
To see the HTTP error
spike
Remember the example from 15 min. ago?
54
Use autocluster to find
similar error characteristics
DC is CH
Newsroom
affected
This is
the host
Using diffpatterns to find
clues
DC is CH Newsroom
affected
This is
the host
57. Summary
57
1. You know where to find me (tal.b@taboola.com)
1. You know you have accessible Resources
(Brain, WWW, Pluralsight free course, Videos, #kusto, Microsoft)
1. You saw how easy it is to run Kusto queries
1. You saw that there are Dashboards & Alerts
1. You are aware of the existence of built-in Data Science power
60. FAQ
60
1. Does it cost money? It is prepaid
2. What about Kibana, Grafana, BQ? Here to stay for now
3. What about applicative logs / my data? Currently Fastly logs
4. Will my elastic-fastly alerts be converted to Kusto for me? No
5. When will the other fastly logs be available? Updates in slack #kusto
6. Can we have more Kusto trainings? Dashboard? Workshops? Yes
7. Does Kusto support distinct count? Yes
8. Does Kusto have materialized views? Yes
9. Can we add to the schema our common recommendation fields? Yes
10. What about API 2.0 HTTP POST payload? It is in discussions
11. Can I look in all fields like in Kibana? Yes
12. Do all have access? Many have, or else ticket to prod-it
13. Can I use the alerts? Work in progress
14. Can I automatically derive smaller tables? Yes
Myself: 2 year in Taboola, Crazy about Taboola.
User Data R&D
Been developing software since I was 13
Maher from production id is the go-to person who set all this magic
Recently added this in my Linkedin
Evident you really care
We are in it together
Will help anyone
that have something big to show
EXPECTATIONS
Who is the audience? DIVERSE AUDIENCE BIG
This is the PART OF IT WILL BE TOO FAST AND PART TOO SLOW
This is the VALUE
You know other tools
Simple Hebrew
Insights were never so accessible - you will find
stuff, you never had the ability to find. it is very simple.
This tool enables you to investigate
Taboola’s crazy traffic with ease.
Killer combination
Who is using Kusto?
Who plans to use it?
Questions in the end, this is a big crowd, use #Slack
This is המחשה - סבלנות
To make sure we are on the same page
Request URL very useful
This is production IT’s great work
This technical gap that we need to close
Thanks production IT!
Use error for fast insight
1,000,000$ Question
Are you happy about it?
Take your time
Fluent (like Java streams)
For the SQL lovers
Another language, a good one
Learning by Example
Ask people what is wrong here?
Use hot
New stuff in yellow
Now ago(5m)
SQL Group by == summarize
Aggregation functions - avg(num-field)
Powerful graphs
Best is HORIZONTAL - BELLA GUTIE
Most useful - timechart
Is this clear?
Black theme for cool guys
Adi Dan / Michael Dragetski
THEY KNEW NOW I KNOW TOO
SQL Having
Walkthrough
Stay tuned to see this root cause drill down was done
by Kusto Data Science Capabilities
Prod-IT can see who to wake up even easier
ALL is in BRAIN
ASK - was it too fast? Too complex? OK? Ask me...
Don’t sleep just yet!
BRAIN
Copy it to your own use
Meetings (like this one), Meetups, Guild, and… #Slack
Make its UX cool, use nice formatting
Kibana Based
Super rich, however Alerts come first
Only when there is an alert - you can open dashboard - to see the history
Tips & Best Practices
We use sensu for alerting
Over 50 errors in Yahoo Japan - Call Media PD On Call
Advanced topics
Jupyter
Of course it works. This is our beloved visualisation tool.
Grafana 5
The first point is the most important one
Even if you didn’t catch much, you can always ask
Let’s works hard, play hard, and drink up
Tips & Best Practices
This explains what is Kusto
Who believes that this is a true chat?