Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[O11y][Nginx] Rally benchmark nginx.access #9032

Merged
merged 3 commits into from
Feb 21, 2024

Conversation

ali786XI
Copy link
Contributor

@ali786XI ali786XI commented Feb 1, 2024

Proposed commit message

  • This PR adds benchmarking templates to the access data stream of Nginx

Sample Response

sample_event.json
{
"_index": ".ds-logs-nginx.access-ep-2024.02.15-000001",
"_id": "iOjQxY0B302vswJ8QL2w",
"_version": 1,
"_score": 0,
"_source": {
  "agent": {
    "name": "blazehound",
    "id": "ef5e274d-4b53-45e6-943a-a5bcf1a6f523",
    "ephemeral_id": "ambershriek",
    "type": "filebeat",
    "version": "8.5.1"
  },
  "nginx": {
    "access": {
      "remote_ip_list": [
        "68.22.118.246"
      ]
    }
  },
  "benchmark_metadata": {
    "info": {
      "run_id": "09a202de-9f41-44ec-ad87-5771937b2414",
      "benchmark": "access-benchmark"
    }
  },
  "log": {
    "file": {
      "path": "/tmp/service_logs/access.log"
    },
    "offset": 0
  },
  "elastic_agent": {
    "id": "ef5e274d-4b53-45e6-943a-a5bcf1a6f523",
    "version": "8.5.0",
    "snapshot": false
  },
  "destination": {
    "port": 80,
    "domain": "bootchillmarbleshield"
  },
  "source": {
    "address": "68.22.118.246",
    "ip": "68.22.118.246"
  },
  "url": {
    "path": "/downloads/product_2",
    "original": "/downloads/product_2",
    "domain": "bootchillmarbleshield"
  },
  "tags": [
    "nginx-access"
  ],
  "input": {
    "type": "log"
  },
  "@timestamp": "2024-02-20T09:19:34.000Z",
  "ecs": {
    "version": "8.5.1"
  },
  "_tmp": {},
  "related": {
    "ip": [
      "68.22.118.246"
    ],
    "user": [
      "citrinemouse"
    ]
  },
  "data_stream": {
    "namespace": "ep",
    "type": "logs",
    "dataset": "nginx.access"
  },
  "host": {
    "hostname": "docker-fleet-agent",
    "os": {
      "kernel": "5.15.49-linuxkit",
      "codename": "focal",
      "name": "Ubuntu",
      "family": "debian",
      "type": "linux",
      "version": "20.04.5 LTS (Focal Fossa)",
      "platform": "ubuntu"
    },
    "containerized": false,
    "ip": [
      "172.18.0.7"
    ],
    "name": "docker-fleet-agent",
    "id": "66392b0697b84641af8006d87aeb89f1",
    "mac": [
      "02-42-AC-12-00-07"
    ],
    "architecture": "x86_64"
  },
  "http": {
    "request": {
      "referrer": "http://localhost:8080/",
      "method": "POST"
    },
    "response": {
      "status_code": 200,
      "body": {
        "bytes": 19432
      }
    },
    "version": "1.1"
  },
  "event": {
    "agent_id_status": "auth_metadata_missing",
    "ingested": "2024-02-20T09:19:36Z",
    "timezone": "+05:30",
    "created": "2024-02-20T14:49:34.740+05:30",
    "kind": "event",
    "category": [
      "web"
    ],
    "type": [
      "access"
    ],
    "dataset": "nginx.access",
    "outcome": "success"
  },
  "user": {
    "name": "citrinemouse"
  },
  "user_agent": {
    "original": "Chef Client/12.0.3 (ruby-2.1.4-p265; ohai-8.0.1; x86_64-linux; +http://opscode.com)",
    "os": {
      "name": "Linux"
    },
    "name": "Other",
    "device": {
      "name": "Other"
    }
  }
}
}

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.

How to test this PR locally

Run this command from package root

  • elastic-package benchmark rally --benchmark access-benchmark -v
  • elastic-package benchmark stream --benchmark access-benchmark -v

Related issues

Screenshots

--- Benchmark results for package: nginx - START ---
╭────────────────────────────────────────────────────────────────────────────────────╮
│ info                                                                               │
├────────────────────────┬───────────────────────────────────────────────────────────┤
│ benchmark              │                                          access-benchmark │
│ description            │              Benchmark 20000 nginx.access events ingested │
│ run ID                 │                      f9bc0cdb-c171-4eee-a098-8c0d34814f4d │
│ package                │                                                     nginx │
│ start ts (s)           │                                                1706769636 │
│ end ts (s)             │                                                1706769674 │
│ duration               │                                                       38s │
│ generated corpora file │ /root/.elastic-package/tmp/rally_corpus/corpus-3059332341 │
╰────────────────────────┴───────────────────────────────────────────────────────────╯
╭──────────────────────────────────────────────────────────────────────╮
│ parameters                                                           │
├─────────────────────────────────┬────────────────────────────────────┤
│ package version                 │                             1.17.0 │
│ data_stream.name                │                             access │
│ corpora.generator.total_events  │                              20000 │
│ corpora.generator.template.path │ ./access-benchmark/template.ndjson │
│ corpora.generator.template.raw  │                                    │
│ corpora.generator.template.type │                             gotext │
│ corpora.generator.config.path   │      ./access-benchmark/config.yml │
│ corpora.generator.config.raw    │                              map[] │
│ corpora.generator.fields.path   │      ./access-benchmark/fields.yml │
│ corpora.generator.fields.raw    │                              map[] │
╰─────────────────────────────────┴────────────────────────────────────╯
╭───────────────────────╮
│ cluster info          │
├───────┬───────────────┤
│ name  │ elasticsearch │
│ nodes │             1 │
╰───────┴───────────────╯
╭───────────────────────────────────────────────────╮
│ data stream stats                                 │
├────────────────────────────┬──────────────────────┤
│ data stream                │ logs-nginx.access-ep │
│ approx total docs ingested │                20000 │
│ backing indices            │                    1 │
│ store size bytes           │             19371563 │
│ maximum ts (ms)            │        1706769632000 │
╰────────────────────────────┴──────────────────────╯
╭───────────────────────────────────────╮
│ disk usage for index .ds-logs-nginx.a │
│ ccess-ep-2024.02.01-000001 (for all f │
│ ields)                                │
├──────────────────────────────┬────────┤
│ total                        │ 9.3 MB │
│ inverted_index.total         │ 3.1 MB │
│ inverted_index.stored_fields │ 2.5 MB │
│ inverted_index.doc_values    │ 3.2 MB │
│ inverted_index.points        │ 455 kB │
│ inverted_index.norms         │    0 B │
│ inverted_index.term_vectors  │    0 B │
│ inverted_index.knn_vectors   │    0 B │
╰──────────────────────────────┴────────╯
╭───────────────────────────────────────────────────────────────────────────────────────────╮
│ pipeline logs-nginx.access-1.17.0 stats in node qscWi0NnTsW2-3EcSTDSsw                    │
├─────────────────────────────────────────────────┬─────────────────────────────────────────┤
│ Totals                                          │ Count: 20000 | Failed: 0 | Time: 2.214s │
│ pipeline (logs-nginx.access-1.17.0-third-party) │         Count: 0 | Failed: 0 | Time: 0s │
│ set ()                                          │   Count: 20000 | Failed: 0 | Time: 91ms │
│ set ()                                          │    Count: 20000 | Failed: 0 | Time: 9ms │
│ rename ()                                       │   Count: 20000 | Failed: 0 | Time: 26ms │
│ grok ()                                         │  Count: 20000 | Failed: 0 | Time: 552ms │
│ grok ()                                         │  Count: 20000 | Failed: 0 | Time: 106ms │
│ uri_parts ()                                    │   Count: 20000 | Failed: 0 | Time: 31ms │
│ set ()                                          │   Count: 20000 | Failed: 0 | Time: 70ms │
│ remove ()                                       │   Count: 20000 | Failed: 0 | Time: 33ms │
│ split ()                                        │   Count: 20000 | Failed: 0 | Time: 62ms │
│ split ()                                        │   Count: 20000 | Failed: 0 | Time: 17ms │
│ set ()                                          │    Count: 20000 | Failed: 0 | Time: 9ms │
│ script ()                                       │   Count: 20000 | Failed: 0 | Time: 28ms │
│ remove ()                                       │         Count: 0 | Failed: 0 | Time: 0s │
│ grok ()                                         │   Count: 20000 | Failed: 0 | Time: 86ms │
│ remove ()                                       │    Count: 20000 | Failed: 0 | Time: 7ms │
│ rename ()                                       │   Count: 20000 | Failed: 0 | Time: 22ms │
│ convert ()                                      │   Count: 20000 | Failed: 0 | Time: 19ms │
│ date ()                                         │  Count: 20000 | Failed: 0 | Time: 143ms │
│ remove ()                                       │   Count: 20000 | Failed: 0 | Time: 11ms │
│ user_agent ()                                   │   Count: 20000 | Failed: 0 | Time: 35ms │
│ geoip ()                                        │   Count: 20000 | Failed: 0 | Time: 46ms │
│ geoip ()                                        │   Count: 20000 | Failed: 0 | Time: 64ms │
│ rename ()                                       │   Count: 20000 | Failed: 0 | Time: 14ms │
│ rename ()                                       │   Count: 20000 | Failed: 0 | Time: 12ms │
│ set ()                                          │    Count: 20000 | Failed: 0 | Time: 9ms │
│ append ()                                       │   Count: 20000 | Failed: 0 | Time: 10ms │
│ append ()                                       │    Count: 20000 | Failed: 0 | Time: 8ms │
│ set ()                                          │    Count: 12307 | Failed: 0 | Time: 4ms │
│ set ()                                          │     Count: 7693 | Failed: 0 | Time: 3ms │
│ append ()                                       │   Count: 20000 | Failed: 0 | Time: 55ms │
│ append ()                                       │         Count: 0 | Failed: 0 | Time: 0s │
│ append ()                                       │   Count: 20000 | Failed: 0 | Time: 47ms │
│ script ()                                       │  Count: 20000 | Failed: 0 | Time: 342ms │
│ remove ()                                       │   Count: 20000 | Failed: 0 | Time: 14ms │
│ pipeline (logs-nginx.access@custom)             │    Count: 20000 | Failed: 0 | Time: 3ms │
╰─────────────────────────────────────────────────┴─────────────────────────────────────────╯
╭────────────────────────────────────────────────────────────────────────────────────────────╮
│ rally stats                                                                                │
├────────────────────────────────────────────────────────────────┬───────────────────────────┤
│ Cumulative indexing time of primary shards                     │    1.4089833333333333 min │
│ Min cumulative indexing time across primary shards             │                     0 min │
│ Median cumulative indexing time across primary shards          │              0.000775 min │
│ Max cumulative indexing time across primary shards             │    0.9566166666666667 min │
│ Cumulative indexing throttle time of primary shards            │                     0 min │
│ Min cumulative indexing throttle time across primary shards    │                     0 min │
│ Median cumulative indexing throttle time across primary shards │                   0.0 min │
│ Max cumulative indexing throttle time across primary shards    │                     0 min │
│ Cumulative merge time of primary shards                        │                0.0168 min │
│ Cumulative merge count of primary shards                       │                        13 │
│ Min cumulative merge time across primary shards                │                     0 min │
│ Median cumulative merge time across primary shards             │                   0.0 min │
│ Max cumulative merge time across primary shards                │                 0.003 min │
│ Cumulative merge throttle time of primary shards               │                     0 min │
│ Min cumulative merge throttle time across primary shards       │                     0 min │
│ Median cumulative merge throttle time across primary shards    │                   0.0 min │
│ Max cumulative merge throttle time across primary shards       │                     0 min │
│ Cumulative refresh time of primary shards                      │   0.29028333333333334 min │
│ Cumulative refresh count of primary shards                     │                       917 │
│ Min cumulative refresh time across primary shards              │                     0 min │
│ Median cumulative refresh time across primary shards           │ 0.0008416666666666667 min │
│ Max cumulative refresh time across primary shards              │               0.19355 min │
│ Cumulative flush time of primary shards                        │    0.3849666666666666 min │
│ Cumulative flush count of primary shards                       │                       688 │
│ Min cumulative flush time across primary shards                │                     0 min │
│ Median cumulative flush time across primary shards             │               0.01005 min │
│ Max cumulative flush time across primary shards                │   0.06683333333333333 min │
│ Total Young Gen GC time                                        │                   0.066 s │
│ Total Young Gen GC count                                       │                         4 │
│ Total Old Gen GC time                                          │                       0 s │
│ Total Old Gen GC count                                         │                         0 │
│ Store size                                                     │   0.030161854811012745 GB │
│ Translog size                                                  │    0.03591819293797016 GB │
│ Heap used for segments                                         │                      0 MB │
│ Heap used for doc values                                       │                      0 MB │
│ Heap used for terms                                            │                      0 MB │
│ Heap used for norms                                            │                      0 MB │
│ Heap used for points                                           │                      0 MB │
│ Heap used for stored fields                                    │                      0 MB │
│ Segment count                                                  │                       359 │
│ Total Ingest Pipeline count                                    │                     20034 │
│ Total Ingest Pipeline time                                     │                   3.449 s │
│ Total Ingest Pipeline failed                                   │                         0 │
│ Min Throughput                                                 │            2590.23 docs/s │
│ Mean Throughput                                                │            2708.30 docs/s │
│ Median Throughput                                              │            2713.31 docs/s │
│ Max Throughput                                                 │            2790.18 docs/s │
│ 50th percentile latency                                        │     166.75518403644674 ms │
│ 90th percentile latency                                        │     189.27913295920007 ms │
│ 100th percentile latency                                       │       230.395638034679 ms │
│ 50th percentile service time                                   │     166.75518403644674 ms │
│ 90th percentile service time                                   │     189.27913295920007 ms │
│ 100th percentile service time                                  │       230.395638034679 ms │
│ error rate                                                     │                    0.00 % │
╰────────────────────────────────────────────────────────────────┴───────────────────────────╯

--- Benchmark results for package: nginx - END   ---
Done

@ali786XI ali786XI added enhancement New feature or request Integration:nginx Nginx labels Feb 1, 2024
@ali786XI ali786XI self-assigned this Feb 1, 2024
@ali786XI ali786XI marked this pull request as ready for review February 1, 2024 06:45
@ali786XI ali786XI requested a review from a team as a code owner February 1, 2024 06:45
type: keyword
- name: destination_domain
type: keyword
example: lessons.example.com
Copy link
Contributor Author

@ali786XI ali786XI Feb 1, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently this wouldn't work due to a known issue mentioned here. Once it's fix it would generate domains in the example format.
cc:- @aspacca

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aliabbas-elastic,

Can we use the suggested alternate format #8909 (comment) instead of dot? if that works, we can proceed.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lalit-satapathy This is the original log which I was making it relatable so that the generated log appears close to the original one

lessons.example.com 192.168.0.1 - - [09/Jun/2020:12:10:39 -0700] "GET /A%20Beka%20G1%20Howe/029_AND_30/15%20reading%20elephants.mp4 HTTP/1.1" 206 7648063 "http://lessons.example.com/A%20Beka%20G1%20Howe/029_AND_30/15%20reading%20elephants.mp4" "Mozilla/5.0 (Linux; Android 5.1.1; KFFOWI) AppleWebKit/537.36 (KHTML, like Gecko) Silk/81.2.16 like Chrome/81.0.4044.138 Safari/537.36"

I think there is a strong dependency of this to be there.

@elasticmachine
Copy link

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@ali786XI
Copy link
Contributor Author

@tommyers-elastic Here is an example of event ingested in Elastic. There will be one change in the format of destination_domain field as per this fix. I expect the destination_domain field to be like lessons.example.com where the first two keywords would be random and we can append .com, .in at last. This fix is released here. But need to incorporate it in elastic-package which will be done soon. Till then should we go ahead with merging this PR or wait for the release to happen?

{
  "_index": ".ds-logs-nginx.access-ep-2024.02.15-000001",
  "_id": "iOjQxY0B302vswJ8QL2w",
  "_version": 1,
  "_score": 0,
  "_source": {
    "agent": {
      "name": "blazehound",
      "id": "ef5e274d-4b53-45e6-943a-a5bcf1a6f523",
      "ephemeral_id": "ambershriek",
      "type": "filebeat",
      "version": "8.5.1"
    },
    "nginx": {
      "access": {
        "remote_ip_list": [
          "68.22.118.246"
        ]
      }
    },
    "benchmark_metadata": {
      "info": {
        "run_id": "09a202de-9f41-44ec-ad87-5771937b2414",
        "benchmark": "access-benchmark"
      }
    },
    "log": {
      "file": {
        "path": "/tmp/service_logs/access.log"
      },
      "offset": 0
    },
    "elastic_agent": {
      "id": "ef5e274d-4b53-45e6-943a-a5bcf1a6f523",
      "version": "8.5.0",
      "snapshot": false
    },
    "destination": {
      "port": 80,
      "domain": "bootchillmarbleshield"
    },
    "source": {
      "address": "68.22.118.246",
      "ip": "68.22.118.246"
    },
    "url": {
      "path": "/downloads/product_2",
      "original": "/downloads/product_2",
      "domain": "bootchillmarbleshield"
    },
    "tags": [
      "nginx-access"
    ],
    "input": {
      "type": "log"
    },
    "@timestamp": "2024-02-20T09:19:34.000Z",
    "ecs": {
      "version": "8.5.1"
    },
    "_tmp": {},
    "related": {
      "ip": [
        "68.22.118.246"
      ],
      "user": [
        "citrinemouse"
      ]
    },
    "data_stream": {
      "namespace": "ep",
      "type": "logs",
      "dataset": "nginx.access"
    },
    "host": {
      "hostname": "docker-fleet-agent",
      "os": {
        "kernel": "5.15.49-linuxkit",
        "codename": "focal",
        "name": "Ubuntu",
        "family": "debian",
        "type": "linux",
        "version": "20.04.5 LTS (Focal Fossa)",
        "platform": "ubuntu"
      },
      "containerized": false,
      "ip": [
        "172.18.0.7"
      ],
      "name": "docker-fleet-agent",
      "id": "66392b0697b84641af8006d87aeb89f1",
      "mac": [
        "02-42-AC-12-00-07"
      ],
      "architecture": "x86_64"
    },
    "http": {
      "request": {
        "referrer": "http://localhost:8080/",
        "method": "POST"
      },
      "response": {
        "status_code": 200,
        "body": {
          "bytes": 19432
        }
      },
      "version": "1.1"
    },
    "event": {
      "agent_id_status": "auth_metadata_missing",
      "ingested": "2024-02-20T09:19:36Z",
      "timezone": "+05:30",
      "created": "2024-02-20T14:49:34.740+05:30",
      "kind": "event",
      "category": [
        "web"
      ],
      "type": [
        "access"
      ],
      "dataset": "nginx.access",
      "outcome": "success"
    },
    "user": {
      "name": "citrinemouse"
    },
    "user_agent": {
      "original": "Chef Client/12.0.3 (ruby-2.1.4-p265; ohai-8.0.1; x86_64-linux; +http://opscode.com)",
      "os": {
        "name": "Linux"
      },
      "name": "Other",
      "device": {
        "name": "Other"
      }
    }
  }
}

@tommyers-elastic
Copy link
Contributor

we can go ahead and merge now i think 👍

@elasticmachine
Copy link

💚 Build Succeeded

History

cc @aliabbas-elastic

Copy link

Quality Gate passed Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No Coverage information No data about Coverage
No Duplication information No data about Duplication

See analysis details on SonarQube

@ali786XI ali786XI merged commit 8e2988a into elastic:main Feb 21, 2024
5 checks passed
gizas pushed a commit that referenced this pull request Mar 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request Integration:nginx Nginx
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants