Page MenuHomePhabricator

Improve field mapping for nginx logstash
Closed, ResolvedPublic

Description

Right now all fields from nginx channel to logstash are mapped as text. Which is bad for fields which are actually numeric, as it prevents aggregation.

I think it makes sense to set up config for the following:

  • request_time: float
  • response_size: long
  • upstream_time: float

We can define additional mappings in logstash template.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 18 2017, 8:00 PM
Restricted Application added projects: Wikidata, Discovery. · View Herald TranscriptOct 18 2017, 8:00 PM

My checks show that request_time and upstream_time only used by nginx, but response_size is also used by webrequest. While it is used in the same meaning, I wonder if changing the type won't disrupt anything. response_size is less important for me than the rest, so if it proves a problem, we could omit it.

EBernhardson added a comment.EditedOct 18 2017, 8:13 PM

There might be other opinions, but i think hard coding specific fields to specific types in the logstash config is reasonable as long as it's documented. The primary problem we run into is that without coordination different types can be sent to fields by different applications. While documenting and expecting applications to conform to types for all fields is not going to happen, doing it for some limited set of useful fields seems acceptable to me.

Smalyshev moved this task from Backlog to Next on the User-Smalyshev board.

Change 386317 had a related patch set uploaded (by Smalyshev; owner: Smalyshev):
[operations/puppet@production] Add types to some fields used by nginx

https://gerrit.wikimedia.org/r/386317

Change 386317 merged by Gehel:
[operations/puppet@production] Add types to some fields used by nginx

https://gerrit.wikimedia.org/r/386317

Gehel added a comment.Oct 25 2017, 9:01 AM

Change merged and deployed on all logstash servers. If I understand correctly, we need to wait for new index creation to check if this worked correctly.

Mentioned in SAL (#wikimedia-operations) [2017-10-25T14:51:30Z] <ebernhardson> update logstash template on logstash elsaticsearch cluster for T178530

Mentioned in SAL (#wikimedia-operations) [2017-10-25T14:52:33Z] <gehel> applying new template to elasticsearch / logstash - T178530

debt closed this task as Resolved.Oct 26 2017, 3:55 PM
debt claimed this task.