The Loki is built on the same design principles of Prometheus, therefore it is a good fit for storing and analyzing the logs of Kubernetes. Grafana is the visualization tool which consumes data from Loki data sources. Promtail is an agent that ships the logs from the local system to the Loki cluster. This design decision makes it very cost-effective and easy to operate. It indexes only metadata and doesn’t index the content of the log. Grafana labs designed Loki which is a horizontally scalable, highly available, multi-tenant log aggregation system inspired by Prometheus. You might know about Grafana which is a popular visualization tool. Anyway, this stack is getting good popularity due to its opinionated design decisions. Quickstart: $ helm install efk-stack stable/elastic-stack -set logstash.enabled=false -set fluentd.enabled=true -set fluentd-elasticsearch.enabled=true PLG Stack (Promtail, Loki and Grafana)ĭon’t be surprised if you don’t find this acronym, it is mostly known as Grafana Loki. Here, I am installing using helm chart in my demo. Source – EFK Stack – Quick Installationįor the detailed steps, I found a good article on DigitalOcean. Below figure shows how the data would be stored in an inverted index. The data in each shard is stored in an inverted index. Machine Learning Nodes – to run machine learning jobsīelow diagram shows how the data is stored in primary and replica shards to spread the load across nodes and to improve data availability.Coordinating Nodes – to route requests, handle search reduce phase, coordinates bulk indexing.Ingest Nodes – used for ingest pipelines to transform and enrich the data before indexing.Data Nodes – to hold index data and perform data-related tasks.Master Nodes – controls the cluster, requires a minimum of 3, one is active at all times.There are following type of nodes in the cluster:

Any node is capable to perform all the roles but in a large scale deployment, nodes can be assigned specific duties. The cluster consists of many nodes to improve availability and resiliency. Typically in an elastic search cluster, the data stored in shards across the nodes. Kibana is the visualization engine for elasticsearch data, with features like time-series analysis, machine learning, graph and location analysis. It has plugin-architecture and supported by 100s of community provided plugins for many use-cases. It tries to structure data as JSON as much as possible. Elasticsearch uses an inverted index which lists all unique words and their related documents for full-text search, which is based on Apache Lucene search engine library.įluentD is a data collector which unifies the data collection and consumption for better use. The information is serialized as JSON documents and indexed in real-time and distributed across nodes in the cluster. It excels in indexing semi-structured data such as logs. It is a set of monitoring tools – Elastic search (object store), Logstash or FluentD (log routing and aggregation), and Kibana for visualization.Ī typical workflow would be like the following:Įlasticsearch is a real-time, distributed object storage, search and analytics engine. You might have heard of ELK or EFK stack which has been very popular. In this article, we will go through two popular stacks – EFK (Elasticsearch) and PLG (Loki) and understand their architecture and differences. These tools also need to be cost-effective and performant.

There is a need for scalable tools that can collect data from all the services and provide the engineers with a unified view of performance, errors, logs, and availability of components. With ever-increasing complexity in distributed systems and growing cloud-native solutions, monitoring and observability become a very important aspect in understanding how the systems are behaving. Guest post originally published on the InfraCloud blog by Anjul Sahu, Solution Architect at InfraCloud

Elk stack vs prometheus