{"id":89038,"date":"2020-07-17T19:42:30","date_gmt":"2020-07-17T17:42:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/logirovanie-v-kubernetes-efk-protiv-plg"},"modified":"2020-07-17T19:42:30","modified_gmt":"2020-07-17T17:42:30","slug":"logirovanie-v-kubernetes-efk-protiv-plg","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/logirovanie-v-kubernetes-efk-protiv-plg","title":{"rendered":"Logging in Kubernetes: EFK versus PLG","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Logging<\/p>\n

<\/p>\n

Monitoring is becoming an increasingly important component of growing cloud solutions as distributed systems become more complex. It is essential for understanding their behavior. Scalable tools are needed to collect data from all services and provide specialists with a unified interface for performance analysis, error demonstration, availability, and logs. <\/p>\n

<\/p>\n

These tools must also be effective and efficient. In this article, we will explore two popular technology stacks: EFK (Elasticsearch) and PLG (Loki), and examine their architectures and differences.<\/p>\n

<\/a><\/noindex><\/p>\n

EFK stack<\/h2>\n

<\/p>\n

You may have already heard of the well-known ELK or EFK. The stack consists of several distinct parts: Elasticsearch (object storage), Logstash or FluentD (log collection and aggregation), and Kibana for visualization.<\/p>\n

<\/p>\n

A typical workflow looks like this:<\/p>\n

<\/p>\n

\"Logging<\/p>\n

<\/p>\n

Elasticsearch<\/strong> \u2014 a distributed object storage with real-time search and analytics. An excellent solution for semi-structured data, such as logs. Information is stored as JSON documents, indexed in real-time, and distributed across the nodes of the cluster. An inverted index is used, containing all unique words and their associated documents for full-text search, which is based on the Apache Lucene search engine.<\/p>\n

<\/p>\n

FluentD<\/strong> \u2014 is a data collector that performs data unification upon collection and consumption. It aims to structure data in JSON format as much as possible. Its architecture is extensible, and there are more than a hundred different extensions<\/a><\/noindex>, supported by the community, for all kinds of scenarios.<\/p>\n

<\/p>\n

Kibana<\/strong> \u2014 a data visualization tool for Elasticsearch with various additional features, such as time series analysis, graphing, machine learning, and more.<\/p>\n

<\/p>\n

Elasticsearch Architecture<\/h3>\n

<\/p>\n

Data in the Elasticsearch cluster is stored spread across all its nodes. The cluster consists of multiple nodes to improve availability and resilience. Any node can perform all cluster roles, but in large scalable deployments, nodes are typically assigned specific tasks.<\/p>\n

<\/p>\n

Cluster node types:<\/p>\n

<\/p>\n