TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Working with the ELK stack

87 pointsby greenonionover 10 years ago

13 comments

lkrubnerover 10 years ago
I am working at a company that has 75,000 customers, and we keep track of a fairly large set of personal data about these 75,000 customers. The data is typically kept in PostGres, but for reports, we assumed we could dump it out in a denormalized form to ElasticSearch. We would not dump all the data, of course, we only take 18 items that are considered very important. We had never done much analysis of who our customers were, and what their level of engagement was. We had a new person come in, focused on business intelligence, and they were desperate to get some data about our customers. So I wrote a short Python script that pulled the data we wanted out of PostGres and stored in ElasticSearch. I then made it available to the team via Kibana. I assumed everyone would be fascinated to look at the data and perhaps see various trends.<p>But that didn&#x27;t work. Kibana was unusable. With 75,000 records it never loaded. Not in anyone&#x27;s browser. So I cut that in half, to 36,000 records. And still, it never loaded. So I kept cutting the amount. And eventually I got down to 10,000 records. Then it loaded, but was so slow no one could use it. So finally I cut it down to 7,000 records. Now it loaded, and it was fast enough that we could use it.<p>To do the real analysis, I ended writing another script that dumped out the 75,000 records as a CSV file, then I uploaded it to a spreadsheet on Google Docs. This worked fine.<p>I am curious why Google spreadsheets can render 75,000 records, but Kibana can not? I am also curious what the real use case is for Kibana? If it can&#x27;t handle large datasets, then its ability to make pretty charts seems useless -- we could never get the data in there to make the chart. I assume that other people will do what I did, and use a spreadsheet instead.
评论 #9009605 未加载
评论 #9009340 未加载
评论 #9009655 未加载
评论 #9010005 未加载
Karunamonover 10 years ago
I would be seriously beginning to worry, were I working over at Splunk. I know the ES guys have said, over and over, that they&#x27;re not gunning for Splunk customers but, as the ELK stack becomes a more mature tool, the reasons to use Splunk and pay their <i>downright extortionate</i> prices decrease more and more.<p>I&#x27;m assisting with a ~500GB&#x2F;day cluster right now (with that number expected to quadruple in the next year or so), and ELK has proven to be an amazingly resilient and flexible tool.
评论 #9010459 未加载
nissimkover 10 years ago
Is there a lightweight solution for centralized logging with full text search and a nice UI? ELK seems like it requires some serious RAM and cores even if you are just talking about elasticsearch. Is there a similar solution that works well in just a couple of gigs of RAM for a slower message flow rate?<p>Is anybody here successfully using ELK in a low ram environment with low message flow?
评论 #9009567 未加载
评论 #9009321 未加载
评论 #9009300 未加载
评论 #9010363 未加载
评论 #9009254 未加载
评论 #9010401 未加载
makmanalpover 10 years ago
Slightly off topic, but wow - thank you for the Turkish stemmer! There have been a few attempts at this, but I&#x27;m not sure if any worked super well. For those who don&#x27;t know, Turkish is agglutinative (<a href="http://en.wikipedia.org/wiki/Agglutination" rel="nofollow">http:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Agglutination</a>) meaning most of the meaning in words are added as suffixes to the words, so stemming is even more crucial and difficult - removing a suffix can completely change the meaning. Example: &quot;Kitap&quot; is &quot;Book&quot; but &quot;Kitaplik&quot; is &quot;Bookshelf&quot; (or more literally &quot;Book-container&quot;).<p>Here it is: <a href="https://github.com/skroutz/elasticsearch-analysis-turkishstemmer" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;skroutz&#x2F;elasticsearch-analysis-turkishste...</a>
评论 #9010752 未加载
octotoadover 10 years ago
I&#x27;m currently working on deploying an ELK box for visualising a mix of financial transaction data and corresponding network application backend syslog records. So far so good, but frontend Kibana 3 performance can be really painful at times given the large amount of &quot;documents&quot; that can be involved (anywhere up to 5000 events per minute).<p>It seems like displaying multiple histogram panels may be quicker in real time, given the shorter timeframe, but it would be nice to be able work with something like a month&#x27;s worth of data without major performance hits.<p>Not sure if this is something specific to Kibana design, Elasticsearch indexing&#x2F;search configuration or certain JavaScript engine behaviour.
评论 #9009440 未加载
greenonionover 10 years ago
Hi, OP here, we &#x27;re really excited that this made the HN front page! Feel free to ask us anything.
评论 #9010412 未加载
Thaxllover 10 years ago
The problem I have with ELK is Kibana, it&#x27;s not a tool designed to watch logs but to do reporting.
评论 #9011563 未加载
helfireover 10 years ago
Just started playing with ELK last weekend, this guide got me up and running pretty quickly <a href="http://evanhazlett.com/2014/11/Logging-with-ELK-and-Docker/" rel="nofollow">http:&#x2F;&#x2F;evanhazlett.com&#x2F;2014&#x2F;11&#x2F;Logging-with-ELK-and-Docker&#x2F;</a>
Dowwieover 10 years ago
Hey thank you for sharing your experiences. I am a little confused about this architecture decision if the goal is to offer business insight, though.<p>I don&#x27;t understand why usage metrics that are used to calculate business analytics would be logged in a data store that is separate from business transactions and reporting related data. How would you run cohort studies or track funnels?
ed_blackburnover 10 years ago
I&#x27;m in an environment that has dismissed the idea of ELK for SCOM. I&#x27;ll be interested to see how this SCOM world progresses. I&#x27;m currently underwhelmed by the SCOM narrative for both pushing data to it and more alarmingly how to get web based dashboards published without great expense. Anybody got or know of any success stories?<p>(Sulks off pining for ELK.)
ehurrellover 10 years ago
The ELK stack is great, powerful, relatively easy to use and set up and very configurable. I&#x27;d definitely consider it for any dashboard prototyping, given that I&#x27;ve worked places where the &#x27;MVP&#x27; dashboard could&#x27;ve been mocked up in days with ELK rather than the months it took otherwise.
评论 #9008985 未加载
elementaiover 10 years ago
We&#x27;ve just finished migrating our ELK stack from cloud VPS&#x27;es to bare metal to cut costs. I was and still impressed how smooth that went including upgrading from 0.9x to 1.4
Epicismover 10 years ago
Has anyone been able to do any sort of correlation or alerting with ELK?