Files
logarchiver/internal/metrics/metrics.go
T
benvin c05ccfcb5d
ci/woodpecker/pr/build Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
Initial implementation: NATS->S3 archiver + search/retrieve CLI
logarchiver replaces the plain Vector archiver leg of the centralized
logging stack (argocd-apps #296) with a Go service that archives raw logs
from NATS JetStream to S3 as zstd-compressed, OpenPGP-encrypted, indexed
objects, plus an operator CLI to search the index and retrieve/decrypt
archived logs. It adds the things that outgrew Vector: zstd compression,
encryption keyed from Ben's Vault GPG secrets engine, a searchable
ClickHouse index, and sink-conditional acks (a batch is acknowledged to
JetStream only after the object is durably in S3 AND indexed).

Service (`logarchiver run`):
- Durable JetStream pull consumer (stream LOGS, durable archiver, subject
  filter default logs.k8s.vault.>), explicit acks, independent offsets.
- Batch per subject by size/count/time -> NDJSON -> zstd -> encrypt -> S3
  PUT -> ClickHouse index row -> ack. On any failure the batch is Nak'd and
  redelivered, so nothing is lost on a sink outage.
- Encryption is a wrapped-DEK envelope (container LARC1): the bulk is
  AES-256-GCM framed under a random data key, and only that 32-byte key is
  OpenPGP-encrypted to the engine's public key. This is because the Vault
  GPG engine does whole-payload decrypt only; retrieval round-trips just the
  tiny wrapped key regardless of object size. Public key fetched from the
  engine or a mounted file (configurable); key fingerprint recorded per
  object; periodic pubkey refresh for rotation.
- Prometheus metrics, structured slog, graceful drain on shutdown.

CLI:
- `search` queries the index (subject/host/time) and lists matching objects.
- `fetch` downloads, decrypts via the Vault GPG engine, unzstds and emits
  NDJSON (optionally re-filtered by host/time).
- `init-schema` creates/prints the ClickHouse archive_index DDL.
- cobra `completion` subcommands.

Config via file+env (k8s-friendly, secrets from env), boundaries (NATS/S3/
ClickHouse/Vault) behind interfaces with unit tests (config, batching,
host/subject extraction, crypto roundtrip with a test key, ack-after-persist
with fakes, search query building). go build/vet/test -race clean;
golangci-lint v2 clean. Woodpecker CI: build/test/pre-commit on PR; on v*
tag a container image plus a Gitea binary release + rpm-internal RPM. Docs
per subcommand + architecture + retrieval runbook + deployment drop-in.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
2026-07-27 23:22:40 +10:00

98 lines
3.9 KiB
Go

// Package metrics exposes Prometheus metrics for the logarchiver service. The
// logging stack ships no metrics convention today, so this is the first
// /metrics endpoint there; it is opt-in via config.
package metrics
import (
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/promauto"
)
// Metrics holds the collectors.
type Metrics struct {
objectsStored *prometheus.CounterVec
eventsArchived *prometheus.CounterVec
rawBytes *prometheus.CounterVec
storedBytes *prometheus.CounterVec
storeFailures *prometheus.CounterVec
indexFailures *prometheus.CounterVec
messagesFetched prometheus.Counter
acksSent prometheus.Counter
batchesFlushed *prometheus.CounterVec
pendingEvents prometheus.Gauge
}
// New registers the collectors on reg (use prometheus.DefaultRegisterer for the
// default /metrics handler).
func New(reg prometheus.Registerer) *Metrics {
f := promauto.With(reg)
return &Metrics{
objectsStored: f.NewCounterVec(prometheus.CounterOpts{
Name: "logarchiver_objects_stored_total",
Help: "Objects successfully sealed, uploaded and indexed.",
}, []string{"subject"}),
eventsArchived: f.NewCounterVec(prometheus.CounterOpts{
Name: "logarchiver_events_archived_total",
Help: "Log events archived.",
}, []string{"subject"}),
rawBytes: f.NewCounterVec(prometheus.CounterOpts{
Name: "logarchiver_raw_bytes_total",
Help: "Raw NDJSON bytes archived (pre-compression).",
}, []string{"subject"}),
storedBytes: f.NewCounterVec(prometheus.CounterOpts{
Name: "logarchiver_stored_bytes_total",
Help: "Stored object bytes written to S3 (post-compression/encryption).",
}, []string{"subject"}),
storeFailures: f.NewCounterVec(prometheus.CounterOpts{
Name: "logarchiver_store_failures_total",
Help: "Failed store attempts (seal/upload); batch not acked.",
}, []string{"subject"}),
indexFailures: f.NewCounterVec(prometheus.CounterOpts{
Name: "logarchiver_index_failures_total",
Help: "Failed index writes after a successful S3 upload; batch not acked.",
}, []string{"subject"}),
messagesFetched: f.NewCounter(prometheus.CounterOpts{
Name: "logarchiver_messages_fetched_total",
Help: "JetStream messages fetched.",
}),
acksSent: f.NewCounter(prometheus.CounterOpts{
Name: "logarchiver_acks_total",
Help: "JetStream acknowledgements sent (after successful persist).",
}),
batchesFlushed: f.NewCounterVec(prometheus.CounterOpts{
Name: "logarchiver_batches_flushed_total",
Help: "Batches flushed, labelled by trigger (full|age|shutdown).",
}, []string{"trigger"}),
pendingEvents: f.NewGauge(prometheus.GaugeOpts{
Name: "logarchiver_pending_events",
Help: "Events currently buffered in open batches (unacked).",
}),
}
}
// ObjectStored records a successful persist.
func (m *Metrics) ObjectStored(subject string, events int, rawBytes, storedBytes int64) {
m.objectsStored.WithLabelValues(subject).Inc()
m.eventsArchived.WithLabelValues(subject).Add(float64(events))
m.rawBytes.WithLabelValues(subject).Add(float64(rawBytes))
m.storedBytes.WithLabelValues(subject).Add(float64(storedBytes))
}
// StoreFailed records a seal/upload failure.
func (m *Metrics) StoreFailed(subject string) { m.storeFailures.WithLabelValues(subject).Inc() }
// IndexFailed records an index-write failure.
func (m *Metrics) IndexFailed(subject string) { m.indexFailures.WithLabelValues(subject).Inc() }
// MessagesFetched records fetched messages.
func (m *Metrics) MessagesFetched(n int) { m.messagesFetched.Add(float64(n)) }
// Acked records sent acknowledgements.
func (m *Metrics) Acked(n int) { m.acksSent.Add(float64(n)) }
// BatchFlushed records a flush by trigger.
func (m *Metrics) BatchFlushed(trigger string) { m.batchesFlushed.WithLabelValues(trigger).Inc() }
// SetPending sets the pending-events gauge.
func (m *Metrics) SetPending(n int) { m.pendingEvents.Set(float64(n)) }