elasticsearch-mapper-attachments VS nodejs-bigquery

Elasticsearch - www.elastic.co/

The increasing complexity of modern systems led to the rise of AIOps (Artificial Intelligence for IT Operations) and observability practices. AIOps leveraged machine learning algorithms to automate problem detection, analysis, and resolution. Observability focused on gaining insights into system behaviour through metrics, logs, and traces. As a result, tools like Prometheus, Grafana, and ELK stack (Elasticsearch, Logstash, Kibana) gained popularity.

My only experience with NetFlow collection is on my home firewall/router running pfSense Community Edition, which is free to download and can be installed on a wide assortment of X86 hardware. I installed the Softflowd package, which exports NetFlow data to a dedicated Elasticsearch/Logstash/Kibana (ELK) server on my LAN. I believe Security Onion and ElastiFlow also can be NetFlow collectors.

Elasticsearch, Logstash, and Kibana (ELK) Stack: An open source suite of tools for log management and analysis, providing real-time insights into security events.

Recently I have taken an interest in big data. https://neo4j.com/ , https://cassandra.apache.org/ , https://clickhouse.com/, https://www.elastic.co/ - are all databases I have experience with. Neo4j and Cassandra only as a hobby, but Clickhouse I have used in production, and Elasticsearch I have used for some 7 years now.

Buy an enterprise-class, wired router like the Negate 2100 ($349 USD), which runs pfSense, and configure the Deco AXE5400 device(s) to operate in Access Point Mode. Then install the Softflowd package through the pfSense web UI. Softflowd will collect and export NetFlow data to a NefFlow collector, which is the separate computer/VM/container referred to above, running software like Security Onion, ElastiFlow, or Elasticsearch/Logstash/Kibana (ELK).

If you’re unaware, elastic search is some like enterprise level search shit. They just put it in a theme. https://www.elastic.co

systemctl status kibana ● kibana.service - Kibana Loaded: loaded (/etc/systemd/system/kibana.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2023-03-28 09:40:05 UTC; 33min ago Docs: https://www.elastic.co Main PID: 3168 (node) Tasks: 11 (limit: 9432) Memory: 303.3M CPU: 35.190s CGroup: /system.slice/kibana.service └─3168 /usr/share/kibana/bin/../node/bin/node /usr/share/kibana/bin/../src/cli/dist --logging.dest=/var/log/kibana/kibana.log --pid.file=/run/kibana/kibana.pid "--deprecation.skip_deprecated_settings[0]=logging.dest" Mar 28 09:40:05 wazuh systemd[1]: Started Kibana.

If you've ever wondered what it's like to manage a BigQuery instance at Reddit scale, know that it's exactly like smaller systems just with much, much bigger numbers in the logs. Database management fundamentals are eerily similar regardless of scale or platform; BigQuery handles just about anything we throw at it, and we do indeed throw it the whole book. Our BigQuery platform is more than 100 petabytes of data that supports data science, machine learning, and analytics workloads that drive experiments, analytics, advertising, revenue, safety, and more. As Reddit grew, so did the workload velocity and complexity within BigQuery and thus the need for more elegant and fine-tuned workload management.

Now I know I've got some data I could use, I now need to find a platform that I can use to analyse the data coming from the Forem API. I did consider some other pieces of software, such as Google BigQuery (with looker studio) and ElasticSearch (with Kibana), I ultimately went with OpenSearch which is essentially a forked version of ElasticSearch maintained by AWS. The main reasons are that I could host it locally for free (unlike BigQuery). I do have some prior experience with both elastic (back when it was called ELK) and OpenSearch, but my work with OpenSearch was far more recent, so I decided to go with that.

First, in one of our recent projects, we helped our client to run the cloud-based infrastructure of their entirely automated, real-time SEO platform. The solution rested in the safe familiarity of Google’s popular cloud-based data centres (i.e. Google Cloud Platform), whilst also making use of BigQuery — a serverless, multi-cloud data warehouse.

Bigquery as our data warehouse

This post in github thinks it may be an error in bigquery's backend.

A data warehouse is a specialized database that's purpose built for gathering and analyzing data. Unlike general-purpose databases like MySQL or PostgreSQL, which are designed to meet the real-time performance and transactional needs of applications, a data warehouse is designed to collect and process the data produced by those applications, collectively and over time, to help you gain insight from it. Examples of data-warehouse products include Snowflake, Google BigQuery, Azure Synapse Analytics, and Amazon Redshift — all of which, incidentally, are easily managed with Pulumi.

Google BigQuery