kafka-connect-elasticsearch VS Elasticsearch

Kafka Connect is a scalable and reliable tool for streaming data between Apache Kafka and other systems. It allows to quickly define connectors that move data into and out of Kafka. Luckily for us, there is an open-source connector that sends data from Kafka topics to Elasticsearch indices.

Benchmarks are always "It depends".

And what it depends on are your data volume, how you want to query, whether you value ingestion greater than query speed and timeliness and so forth.

Elastic sweet spot is that it indexes everything, and you can query fast as a result. But it does this at the cost of ingest as it's doing the work to build indexes during ingestion and so ingest is more CPU intensive and can hit limits here.

Loki sweet spot is that it has very few indexes, so ingestion is cheap and extremely capable for huge data volumes. It does this at the cost of query performance over very large data sets - without indexes it brute forces via mapreduce, which means you really want to specific where to look (which log streams) and when to look (a time window) and in that it excels.

ClickHouse sweet spot is the indexes are very explicitly configured by engineers who know what the data looks like and how they want to query it. Now the ingest cost is balanced, and the query performance is great - but it did this at the cost of you knowing your data and how you're going to query it most of the time - it's not so good for esoteric questions that you'd never anticipated (though you can get very far through some of their column data types allowing you to be reasonably flexible on this).

They all have sweet spots, and a benchmark is not going to answer the real questions - what data volume do you have, what do you value (ingest and preserve everything vs fastest query speed for ad-hoc queries vs a balanced approach), do you know how you want to query the data, etc?

Other thoughts:

Loki has recently moved to TSDB for the backend storage, these benchmarks don't go there.

Elastic can use less disk if you configure for synthetic source (https://github.com/elastic/elasticsearch/issues/86603) which discards the raw byte copy of the ingested data and only retains knowledge in the indexes, and uses the indexes to reconstruct the source should you request it.

Nothing to add about ClickHouse, I've used all three databases and worked against all three for huge volumes of data - if I want a more OLAP style querying than OLTP then ClickHouse absolutely shines here, Elastic and Loki shine far more for OLTP workloads (though Elastic does a good job at doing pretty well for more OLAP cases than Loki does today).

🚧 Currently WIP, waiting this ES issue will be resolved

Elasticsearch is a distributed search and analytics engine. It uses an HTTP REST API, making it easy to work with from any programming language.

What? I'm saying that companies already have to protect against their developers violating licenses. Any junior developer can already copy patent-encumbered code off Github, strip the headers, and add it to your company's codebase. They don't need Copilot to make this easier, it's already trivial to do. And yet, companies aren't getting sued. Ergo, it's a minor problem.

Open source, self-hosted: Prometheus + Grafana and ElasticSearch + Kibana.

OpenSearch/Elasticsearch: It is a real-time distributed and analytic engine that helps in performing various kinds of search operations.

- log search: elasticsearch/opensearch, loki[5], quickwit[6], zincsearch[7]

Vespa.ai[8] is great but I don't really know in which category to put them, user facing and enterprise search seems to work well with them.

It's interesting to note that Elasticsearch and Opensearch are general purpose search engine, Solr as well. They are all powered by Lucene, the popular and performant search engine library.

I would love to see some benchmarks by category :)

Note: I don't know well ZincSearch and put it in the log search as said on their front page.

[1]: https://github.com/elastic/elasticsearch

For example: Kubernetes example, Elasticsearch client license, CockroachDB.

Also if you are SO annoyed, you can EDIT their documentation and submit a pull request. Here is the document.

Elasticsearch (licensed under SSPL, not OSI-approved)