elasticsearch-mapper-attachments VS opentelemetry-specification

Elasticsearch - www.elastic.co/

The increasing complexity of modern systems led to the rise of AIOps (Artificial Intelligence for IT Operations) and observability practices. AIOps leveraged machine learning algorithms to automate problem detection, analysis, and resolution. Observability focused on gaining insights into system behaviour through metrics, logs, and traces. As a result, tools like Prometheus, Grafana, and ELK stack (Elasticsearch, Logstash, Kibana) gained popularity.

My only experience with NetFlow collection is on my home firewall/router running pfSense Community Edition, which is free to download and can be installed on a wide assortment of X86 hardware. I installed the Softflowd package, which exports NetFlow data to a dedicated Elasticsearch/Logstash/Kibana (ELK) server on my LAN. I believe Security Onion and ElastiFlow also can be NetFlow collectors.

Elasticsearch, Logstash, and Kibana (ELK) Stack: An open source suite of tools for log management and analysis, providing real-time insights into security events.

Recently I have taken an interest in big data. https://neo4j.com/ , https://cassandra.apache.org/ , https://clickhouse.com/, https://www.elastic.co/ - are all databases I have experience with. Neo4j and Cassandra only as a hobby, but Clickhouse I have used in production, and Elasticsearch I have used for some 7 years now.

Buy an enterprise-class, wired router like the Negate 2100 ($349 USD), which runs pfSense, and configure the Deco AXE5400 device(s) to operate in Access Point Mode. Then install the Softflowd package through the pfSense web UI. Softflowd will collect and export NetFlow data to a NefFlow collector, which is the separate computer/VM/container referred to above, running software like Security Onion, ElastiFlow, or Elasticsearch/Logstash/Kibana (ELK).

If you’re unaware, elastic search is some like enterprise level search shit. They just put it in a theme. https://www.elastic.co

systemctl status kibana ● kibana.service - Kibana Loaded: loaded (/etc/systemd/system/kibana.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2023-03-28 09:40:05 UTC; 33min ago Docs: https://www.elastic.co Main PID: 3168 (node) Tasks: 11 (limit: 9432) Memory: 303.3M CPU: 35.190s CGroup: /system.slice/kibana.service └─3168 /usr/share/kibana/bin/../node/bin/node /usr/share/kibana/bin/../src/cli/dist --logging.dest=/var/log/kibana/kibana.log --pid.file=/run/kibana/kibana.pid "--deprecation.skip_deprecated_settings[0]=logging.dest" Mar 28 09:40:05 wazuh systemd[1]: Started Kibana.

It means that the OpenTelemetry project provides not only a specification to define the contract between the applications, collectors, and telemetry databases, but also a set of APIs, SDKs, and tools like instrumentation libraries (for different languages), collectors, operators, etc. OpenTelemetry is open-source and vendor-agnostic, so the project is not tied to any specific vendor or cloud provider.

Sure, happy to provide more specifics!

Our main issue was the lack of a synchronous gauge. The officially supported asynchronous API of registering a callback function to report a gauge metric is very different from how we were doing things before, and would have required lots of refactoring of our code. Instead, we wrote a wrapper that exposes a synchronous-like API: https://gist.github.com/yolken-airplane/027867b753840f7d15d6....

It seems like this is a common feature request across many of the SDKs, and it's in the process of being fixed in some of them (https://github.com/open-telemetry/opentelemetry-specificatio...)? I'm not sure what the plans are for the golang SDK specifically.

Another, more minor issue, is the lack of support for "constant" attributes that are applied to all metrics. We use these to identify the app, among other use cases, so we added wrappers around the various "Add", "Record", "Observe", etc. calls that automatically add these. (It's totally possible that this is supported and I missed it, in which case please let me know!).

Overall, the SDK was generally well-written and well-documented, we just needed some extra work to make the interfaces more similar to the ones were were using before.

OpenTelemetry is an open-source collection of tools, APIs, and SDKs that aims to standardize the way we generate and collect telemetry data. It follows a specification-driven development. The OpenTelemetry specification  has design and implementation guidelines for how the instrumentation libraries should be implemented. In addition, it provides client libraries in all the major programming languages that follow the specification.

Two problems with OpenTelemetry:

1. It doesn't know what the hell it is. Is it a semantic standard? Is a protocol? It is a facade? What layer of abstraction does it provide? Answer: All of the above! All the things! All the layers!

2. No one from OpenTelemetry has actually tried instrumenting a library. And if they have, they haven't the first suggestion on how instrumenters should actually use metrics, traces, and logs. Do you write to all three? To one? I asked this question two years ago, not a single response. [1]

[1] https://github.com/open-telemetry/opentelemetry-specificatio...

OpenTelemetry Specification GitHub

One update to this: we proposed replacing the count suffix in OpenTelemetry with total to match Prometheus/OpenMetrics. That discussion resulted in the count suffix being removed from the OpenTelemetry semantic conventions. We'll soon update our metric from being called function.calls.count to just function.calls and the generated Prometheus queries will refer to function_calls_total. That resolves one of the main conflicts between the two specs.

This is your best bet if you want to track status updates: https://github.com/open-telemetry/opentelemetry-specification/issues/2911

OpenTelemetry is a standard for implementing telemetry in your applications. It provides a specification, containing the requirements that all implementations should follow as well as some implementations for major languages, including an API and a SDK to interact with it.

At this point, we are about to do the real work where we have to configure OpenTelemetry and export telemetry data to New Relic. Exporting this kind of data relies on a specific protocol; the OpenTelemetry Protocol or OTLP.

OpenTelemetry provides instrumentation libraries for your application. The development of these libraries is guided by the OpenTelemetry specification. The OpenTelemetry specification describes the cross-language requirements and design expectations for all OpenTelemetry implementations in various programming languages.