2. ABOUT ME
Jim Plush, Director of Cloud Engineering @ CrowdStrike.com
Architect of distributed cloud services for catching bad guys
Previously Director of Engineering at gravity.com
personalization service, ingesting clickstream fromYahoo!, New
York Times,WSJ, etc…
wrote most of the ETL workflow
3. ABOUT CROWDSTRIKE
“Big Data” Security Company
Near term focus on targeted, state sponsored attacks and
attribution
Single customer can generate 2.2TB of machine data per day we
process in our cloud
Horizontally scalable, distributed infrastructure
Uses goodies like Kafka, Cassandra, Elastic Search, Hadoop, Scala, Go
4. –Said everyone, always
“Some people, when confronted with a problem, think
“I know, I'll use a message queue.”
Now they have two problems.”
5. APACHE KAFKA
It’s not a so much a queue, but an activity stream system
Trades stability and speed for consumer complexity
It’s scalable by nature
Supports data replication
You can rewind time
It’s fast!
Persistent messaging with O(1) disk structures that provide constant time
performance even with many TB of stored messages.
6. APACHE KAFKA - CONS
Consumer Complexity
Not “Rack Aware” replication
Lack of tooling/monitoring
Still pre 1.0 release
Operationally, it’s more manual than desired
Requires ZooKeeper
7. BASIC CONCEPTS
Topics - logical namespace for data (clickstream, app logs)
Partition - physical separation of data to allow for horizontal
scalability
Consumer Groups/Offsets - Where your consumer group last
check pointed in the stream
Replica - allows for partitions to be replicated across nodes for
availability, only one is the active leader
8.
9.
10.
11. USE CASES
First point for data ingestion, provide back pressure to
downstream
Provide a data firehose for clients (with seeks)
Friendly to Blue/Green deployment architectures
Mirroring test data easily
Data Center log aggregation
20. SCALING OUT
1 partition = 1 consumer
1 partition needs to fit on a single machine
Partitions = the scalability of your system from the producer and
consumer side
For high scale apps you will probably start out with 100
partitions