Freitag, 18. Mai 2018

Centralised Logging with EFK and hot/warm in Kubernetes

Everybody is talking about centralised logging these days, and most seem to agree that EFK (Elasticsearch, Fluentd, Kibana) is a good combination for accomplishing this. The Kubernetes repo on github contains something to start and play with, but it is far from production-ready:
  1. The Kibana version used there is rather old
  2. Elasticsearch is not production-ready (single node instance, no decoupling of resource-hungry indexing and long-term, read-only storage)
While (1) can be overcome rather easily, (2) poses a bit more of a challenge - how can we create a production-ready Elasticsearch service using Kubernetes? The Elasticsearch folks propose the so-called "hot/warm" architecture for addressing this:
  • "hot" nodes running on fast and expensive hardware (fast CPUs, lots of memory, SSDs) do all the indexing of anything coming in. 
  • All data older than a configurable period of time is moved to so-called "warm" nodes running on potentially slower and less expensive hardware with large disks (usually HDDs). No indexing takes place here, data is kept read-only for queries only.