How To Design a Distributed Logging System in Kubernetes?

2/26/2022

I'm designing a distributed application, comprised of several Spring microservices that will be deployed with Kubernetes. It is a batch processing app, and a typical request could take several minutes of processing, with the processing getting distributed across the services, using Kafka as a message broker.

A requirement of the project is that each request will generate a log file, which will need to be stored on the application file store for retrieval. The current design is, all the processing services write log messages (with the associated unique request ID) to Kafka, and there is a dedicated logging microservice that reads these messages down, does some formatting and should persist them to the log file associated with the given request ID.

I'm very unfamiliar with how files should be stored in web applications. Should I be storing these log files to the local file system? If so, wouldn't that mean this "logging service" couldn't be scaled? For example, if I scaled the log service to 2 instances, then each instance would only have access to half of the log files in theory. And if a user makes a request to retrieve a log file, there is no guarantee that the requested log file will be at whatever log service instance the Kubernetes load balancer routed them too.

What is the currently accepted "best practice" for having a file system in a distributed application? Or should I just accept that the logging service can never be scaled up?

A possible solution I can think of would just store the text log files in our MySQL database as TEXT rows, making the logging service effectively stateless. If someone could point out any potential issues with this that would be much appreciated?

-- Jake
distributed-system
kubernetes
logging

1 Answer

2/27/2022

deployed with Kubernetes

each request will generate a log file, which will need to be stored on the application file store

Don't do this. Use a Fluentd / Filebeat / promtail / Splunk forwarder side car that gathers stdout from the container processes.

Or have your services write to a kafka logs topic rather than create files.

With either option, use a collector like Elasticsearch, Grafana Loki, or Splunk

https://kubernetes.io/docs/concepts/cluster-administration/logging/#sidecar-container-with-a-logging-agent

wouldn't that mean this "logging service" couldn't be scaled?

No, each of these services are designed to be scaled

possible solution I can think of would just store the text log files in our MySQL database as TEXT rows,

Sure, but Elasticsearch or Solr are purpose-built for gathering and searching plaintext, not MySQL.


Don't treat logs as something application specific. In other words, your solution shouldn't be unique to Spring

-- OneCricketeer
Source: StackOverflow