c05ccfcb5d
logarchiver replaces the plain Vector archiver leg of the centralized logging stack (argocd-apps #296) with a Go service that archives raw logs from NATS JetStream to S3 as zstd-compressed, OpenPGP-encrypted, indexed objects, plus an operator CLI to search the index and retrieve/decrypt archived logs. It adds the things that outgrew Vector: zstd compression, encryption keyed from Ben's Vault GPG secrets engine, a searchable ClickHouse index, and sink-conditional acks (a batch is acknowledged to JetStream only after the object is durably in S3 AND indexed). Service (`logarchiver run`): - Durable JetStream pull consumer (stream LOGS, durable archiver, subject filter default logs.k8s.vault.>), explicit acks, independent offsets. - Batch per subject by size/count/time -> NDJSON -> zstd -> encrypt -> S3 PUT -> ClickHouse index row -> ack. On any failure the batch is Nak'd and redelivered, so nothing is lost on a sink outage. - Encryption is a wrapped-DEK envelope (container LARC1): the bulk is AES-256-GCM framed under a random data key, and only that 32-byte key is OpenPGP-encrypted to the engine's public key. This is because the Vault GPG engine does whole-payload decrypt only; retrieval round-trips just the tiny wrapped key regardless of object size. Public key fetched from the engine or a mounted file (configurable); key fingerprint recorded per object; periodic pubkey refresh for rotation. - Prometheus metrics, structured slog, graceful drain on shutdown. CLI: - `search` queries the index (subject/host/time) and lists matching objects. - `fetch` downloads, decrypts via the Vault GPG engine, unzstds and emits NDJSON (optionally re-filtered by host/time). - `init-schema` creates/prints the ClickHouse archive_index DDL. - cobra `completion` subcommands. Config via file+env (k8s-friendly, secrets from env), boundaries (NATS/S3/ ClickHouse/Vault) behind interfaces with unit tests (config, batching, host/subject extraction, crypto roundtrip with a test key, ack-after-persist with fakes, search query building). go build/vet/test -race clean; golangci-lint v2 clean. Woodpecker CI: build/test/pre-commit on PR; on v* tag a container image plus a Gitea binary release + rpm-internal RPM. Docs per subcommand + architecture + retrieval runbook + deployment drop-in. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
98 lines
3.9 KiB
Go
98 lines
3.9 KiB
Go
// Package metrics exposes Prometheus metrics for the logarchiver service. The
|
|
// logging stack ships no metrics convention today, so this is the first
|
|
// /metrics endpoint there; it is opt-in via config.
|
|
package metrics
|
|
|
|
import (
|
|
"github.com/prometheus/client_golang/prometheus"
|
|
"github.com/prometheus/client_golang/prometheus/promauto"
|
|
)
|
|
|
|
// Metrics holds the collectors.
|
|
type Metrics struct {
|
|
objectsStored *prometheus.CounterVec
|
|
eventsArchived *prometheus.CounterVec
|
|
rawBytes *prometheus.CounterVec
|
|
storedBytes *prometheus.CounterVec
|
|
storeFailures *prometheus.CounterVec
|
|
indexFailures *prometheus.CounterVec
|
|
messagesFetched prometheus.Counter
|
|
acksSent prometheus.Counter
|
|
batchesFlushed *prometheus.CounterVec
|
|
pendingEvents prometheus.Gauge
|
|
}
|
|
|
|
// New registers the collectors on reg (use prometheus.DefaultRegisterer for the
|
|
// default /metrics handler).
|
|
func New(reg prometheus.Registerer) *Metrics {
|
|
f := promauto.With(reg)
|
|
return &Metrics{
|
|
objectsStored: f.NewCounterVec(prometheus.CounterOpts{
|
|
Name: "logarchiver_objects_stored_total",
|
|
Help: "Objects successfully sealed, uploaded and indexed.",
|
|
}, []string{"subject"}),
|
|
eventsArchived: f.NewCounterVec(prometheus.CounterOpts{
|
|
Name: "logarchiver_events_archived_total",
|
|
Help: "Log events archived.",
|
|
}, []string{"subject"}),
|
|
rawBytes: f.NewCounterVec(prometheus.CounterOpts{
|
|
Name: "logarchiver_raw_bytes_total",
|
|
Help: "Raw NDJSON bytes archived (pre-compression).",
|
|
}, []string{"subject"}),
|
|
storedBytes: f.NewCounterVec(prometheus.CounterOpts{
|
|
Name: "logarchiver_stored_bytes_total",
|
|
Help: "Stored object bytes written to S3 (post-compression/encryption).",
|
|
}, []string{"subject"}),
|
|
storeFailures: f.NewCounterVec(prometheus.CounterOpts{
|
|
Name: "logarchiver_store_failures_total",
|
|
Help: "Failed store attempts (seal/upload); batch not acked.",
|
|
}, []string{"subject"}),
|
|
indexFailures: f.NewCounterVec(prometheus.CounterOpts{
|
|
Name: "logarchiver_index_failures_total",
|
|
Help: "Failed index writes after a successful S3 upload; batch not acked.",
|
|
}, []string{"subject"}),
|
|
messagesFetched: f.NewCounter(prometheus.CounterOpts{
|
|
Name: "logarchiver_messages_fetched_total",
|
|
Help: "JetStream messages fetched.",
|
|
}),
|
|
acksSent: f.NewCounter(prometheus.CounterOpts{
|
|
Name: "logarchiver_acks_total",
|
|
Help: "JetStream acknowledgements sent (after successful persist).",
|
|
}),
|
|
batchesFlushed: f.NewCounterVec(prometheus.CounterOpts{
|
|
Name: "logarchiver_batches_flushed_total",
|
|
Help: "Batches flushed, labelled by trigger (full|age|shutdown).",
|
|
}, []string{"trigger"}),
|
|
pendingEvents: f.NewGauge(prometheus.GaugeOpts{
|
|
Name: "logarchiver_pending_events",
|
|
Help: "Events currently buffered in open batches (unacked).",
|
|
}),
|
|
}
|
|
}
|
|
|
|
// ObjectStored records a successful persist.
|
|
func (m *Metrics) ObjectStored(subject string, events int, rawBytes, storedBytes int64) {
|
|
m.objectsStored.WithLabelValues(subject).Inc()
|
|
m.eventsArchived.WithLabelValues(subject).Add(float64(events))
|
|
m.rawBytes.WithLabelValues(subject).Add(float64(rawBytes))
|
|
m.storedBytes.WithLabelValues(subject).Add(float64(storedBytes))
|
|
}
|
|
|
|
// StoreFailed records a seal/upload failure.
|
|
func (m *Metrics) StoreFailed(subject string) { m.storeFailures.WithLabelValues(subject).Inc() }
|
|
|
|
// IndexFailed records an index-write failure.
|
|
func (m *Metrics) IndexFailed(subject string) { m.indexFailures.WithLabelValues(subject).Inc() }
|
|
|
|
// MessagesFetched records fetched messages.
|
|
func (m *Metrics) MessagesFetched(n int) { m.messagesFetched.Add(float64(n)) }
|
|
|
|
// Acked records sent acknowledgements.
|
|
func (m *Metrics) Acked(n int) { m.acksSent.Add(float64(n)) }
|
|
|
|
// BatchFlushed records a flush by trigger.
|
|
func (m *Metrics) BatchFlushed(trigger string) { m.batchesFlushed.WithLabelValues(trigger).Inc() }
|
|
|
|
// SetPending sets the pending-events gauge.
|
|
func (m *Metrics) SetPending(n int) { m.pendingEvents.Set(float64(n)) }
|