Cluster Alert Management via External Suppression Store
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Analyzing and searching massive quantities of diverse machine data generated from various sources, such as system logs, network packets, and sensors, is challenging due to the vast amount of data and its varied formats, leading to inefficiencies in data retrieval and analysis.
Innovation Solution
An event-based data intake and query system that uses a late-binding schema to process and store machine data, allowing flexible extraction of information at search time, enabling field-searchability and efficient retrieval of specific data items across disparate data sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If pre-processing extracts specified data items and stores them in a data system, then retrieval and analysis efficiency is improved, but the flexibility to analyze all generated data is reduced
Solution Approach 1:
The system performs preliminary indexing of all raw data fields without discarding any generated data. During pre-processing, all data items are retained and indexed with metadata, enabling both efficient retrieval through indexing and flexible analysis of the complete data set later.
Solution Approach 2:
The data system is designed to handle multiple functions: it stores raw data, extracts specified data items for efficient retrieval, and simultaneously preserves the complete data set for flexible analysis. The system can adapt to different analysis needs without requiring reprocessing of the original data.
2Adaptability or versatility
If massive quantities of raw data are stored for later retrieval, then data analysis flexibility is improved, but data retrieval and analysis performance deteriorates
Solution Approach 1:
The system segments data retrieval operations by creating indexes that divide the massive data set into organized, searchable segments. These indexes allow the system to quickly locate and retrieve specific data items without scanning the entire raw data set, maintaining high performance even with large volumes of stored data.
Solution Approach 2:
The system introduces an intermediary indexing layer between the raw data storage and retrieval operations. This index structure acts as a mediator that translates retrieval requests into efficient data access patterns, enabling fast retrieval performance while preserving the complete raw data set for flexible analysis.
3Productivity
If specified data items are extracted and stored during pre-processing, then retrieval efficiency is improved, but data utilization is reduced to pre-specified subsets
Solution Approach 1:
The system performs preliminary indexing of all available data fields during data ingestion, without selectively extracting or discarding any data items. This preliminary action preserves the complete data set while establishing efficient access paths for future retrieval operations.
Solution Approach 2:
The system changes the parameter of data extraction from selective extraction of specified items to comprehensive indexing of all items. By indexing all data fields with appropriate metadata, the system enables efficient retrieval of any data item while maintaining complete data utilization capability.
Data Source
AI summary
A first processing node of a cluster of processing nodes issues a first alert when first event data satisfies a trigger condition, and sends, to an alert data store external to the cluster, a first alert record of the first alert and suppression information based at least in part on the first alert. A second processing node of the cluster determines that second event data satisfies the trigger condition, obtains, from the alert data store, the suppression information indicating that an expiration time for suppressing the first alert is unexpired, and sends, to the alert data store, a second alert record of a second alert without issuing the second alert.