quickwit VS vector

Hi folks, Quickwit cofounder here.

We started Quickwit 3 years ago with a POC, "Searching the web for under $1000/month" (see HN discussions [0]), with the goal of making a robust OSS alternative to Elasticsearch / Splunk / Datadog.

We have reached a significant milestone with our latest release (0.7) [1], as we have witnessed users of the nightly version of Quickwit deploy clusters with hundreds of nodes, ingest hundreds of terabytes of data daily, and enjoy considerable cost savings.

To give you a concrete example, one company is ingesting hundreds of terabytes of logs daily and migrating from Elasticsearch to Quickwit. They divided their compute costs by 5x and storage costs by 2x while increasing retention from 3 to 30 days. They also increased their durability, accuracy with exactly-once semantics thanks to the native Kafka support, and elasticity.

The 0.7 release also brings better integrations with the Observability ecosystem: improvements of the Elasticsearch-compatible API and better support of OpenTelemetry standards, Grafana, and Jaeger.

Of course, we still have a lot of work to be a fully-fledged observability engine, and we would love to get some feedback or suggestions.

To give you a glance at our 2024 roadmap, we planned to focus on Kibana/OpenDashboard integration, metrics support, and pipe-based query language.

[0] Searching the web for under $1000/month: https://news.ycombinator.com/item?id=27074481

[1] Release blog post: https://quickwit.io/blog/quickwit-0.7

[2] Open Source Repo: https://github.com/quickwit-oss/quickwit

[3] Home Page: https://quickwit.io

We tested S3 Express for our search engine quickwit[0] a couple of weeks ago.

While this was really satisfying on the performance side, we were a bit disappointed by the price, and I mostly agree with the article on this matter.

I can see some very specific use cases where the pricing should be OK but currently, I would say most of our users should just stay on the classic S3 and add some local SSD caching if they have a lot of requests.

[0] https://github.com/quickwit-oss/quickwit/

Hi HN, I’m one of the builders of Quickwit, a cloud-native OSS search engine for observability. As of 2023, we support logs and traces, metrics will come in 2024.

You know the pitch: while software like Datadog or Splunk are great, they often comes with hefty price tags. Our mission is to offer an affordable alternative. So we’ve built Quickwit, we’ve made it compatible with the observabilty ecosystem (OpenTelemetry, Jaeger, Grafana) and above all, we’ve made it cost-efficient / “easy” to scale (well it’s never easy to scale to petabytes..).

To give you a glance at the engine performance I made a benchmark on the GitHub Archive dataset, 23 TB of events, here are the main observations:

Indexing: costs $2 per ingested TB. With 4CPU, throughput is at 20MBs However, you'll observe > 30MB throughput on simpler datasets, like logs and traces.

Search: a typical query costs $0.0002 per TB (considering both CPU time and GET request costs). Using 8CPU, a simple query on 23TB is achieved in under a second.

Storage: on S3, it costs $8 per ingested TB per month on the GitHub Archive dataset. With logs and traces, you might see costs around $5/ingested TB due to a 2x better compression ratio.

I'm eager to get your thoughts on this!

Benchmark: https://quickwit.io/blog/benchmarking-quickwit-engine-on-an-...

Github repo: https://github.com/quickwit-oss/quickwit/

Website: https://quickwit.io/

- On S3, it costs $8 per ingested TB per month on the GitHub Archive dataset. With logs and traces, you might see costs around $4/ingested TB due to a 2x better compression ratio.

I'm eager to get your thoughts on this!

[0] Benchmark: https://quickwit.io/blog/benchmarking-quickwit-engine-on-an-...

Quickwit (https://quickwit.io/) | Paris, France | Onsite and remote (based in Europe) | Full-time

The company is fully remote but we also have a small office in Paris. We prefer candidates based in Europe but can make exceptions for the right profiles.

- Senior Software Engineer 80-110k€ + 0.25-1% equity based on experience.

    We’re looking for a senior software engineer to contribute to [Quickwit](https://github.com/quickwit-oss/quickwit), our open-source search and analytics engine. We have an ambitious roadmap for the next 18 months (performance optimization, distributed storage, support for SQL, query optimizer, revamp of our execution engine, etc.), and this is a great opportunity to shape the future of Quickwit while tackling fun and challenging problems in the field of distributed databases.

In our latest blog post, we walk you through the steps of instrumenting your Rust application and monitoring the performance on Grafana using Quickwit + Jaeger.

Link: https://github.com/quickwit-oss/quickwit

job "vector" { datacenters = ["dc1"] # system job, runs on all nodes type = "system" group "vector" { count = 1 network { port "api" { to = 8686 } } ephemeral_disk { size = 500 sticky = true } task "vector" { driver = "docker" config { image = "timberio/vector:0.30.0-debian" ports = ["api"] volumes = ["/var/run/docker.sock:/var/run/docker.sock"] } env { VECTOR_CONFIG = "local/vector.toml" VECTOR_REQUIRE_HEALTHY = "false" } resources { cpu = 100 # 100 MHz memory = 100 # 100MB } # template with Vector's configuration template { destination = "local/vector.toml" change_mode = "signal" change_signal = "SIGHUP" # overriding the delimiters to [[ ]] to avoid conflicts with Vector's native templating, which also uses {{ }} left_delimiter = "[[" right_delimiter = "]]" data=<

we are doing something similar with OTEL but we are looking at using https://vector.dev/

We don't pull logs, we forward logs to a centralized logging service.

opensearch - amazon fork of Elasticsearch https://opensearch.org/docs/latestif you do this an have distributed log sources you'd use logstash for, bin off logstash and use vector (https://vector.dev/) its better out of the box for SaaS stuff.

I have done something similar in the past: you can send the logs through a centralized syslog servers (I suggest syslog-ng) and from there ingest into ELK. For parsing I am advice to use something like Vector, is a lot more faster than logstash. When you have your logs ingested correctly, you can create your own dashboard in Kibana. If this fit your requirements, no need to install nginx (unless you want to use as reverse proxy for Kibana), php and mysql.

I think there's nothing currently that combines both logging and metrics into one easy package and visualizes it, but it's also something I would love to have.

Vector[1] would work as the agent, being able to collect both logs and metrics. But the issue would then be storing it. I'm assuming the Elastic Stack might now be able to do both, but it's just to heavy to deal with in a small setup.

A couple of months ago I took a brief look at that when setting up logging for my own homelab (https://pv.wtf/posts/logging-and-the-homelab). Mostly looking at the memory usage to fit it on my synology. Quickwit[2] and Log-Store[3] both come with built in web interfaces that reduce the need for grafana, but neither of them do metrics.

- [1] https://vector.dev

Log to stdout/stderr and collect your logs with a tool like vector (vector.dev) and send it to something like Grafana Loki.

I would recommend that you run vector as a systems service so you don't have to worry about managing it. Here is a basic config to do that - https://github.com/vectordotdev/vector/blob/master/distribution/systemd/vector.service .