FlumeNG - the evolution

Flume, the decentralized log collector, makes some great progress. Since the project has reached an Apache incubating tier the development on the next generation (NG) has reached a significant level.

Now, what's the advantage of a new flume? Simply the architecture. FlumeNG doesn't need zookeeper anymore, has no master / client concept nor nodes / collectors. Simply run a bunch of agents, connect each of them together and create your own flow. Flume now can run with 20MB heapsize, uses inMemory Channel for flows, can have multiflows, different sinks to one channel and will support a few more sinks as flume =< 1.0.0. But, flumeNG will not longer support tail and tailDir, here a general exec sink is available, which lets the user the freedom to use everything. 

Requirements

On the build host we need jre 1.6.x, maven 3.x and git or svn. 

Installation

To check out the code we use git and maven in a simple one-line command:

git clone git://git.apache.org/flume.git; cd flume; git checkout trunk && mvn clean && mvn package -DskipTests

After few seconds the build should be done:

[INFO] Apache Flume ...................................... SUCCESS [7.276s]

[INFO] Flume NG Core ..................................... SUCCESS [3.043s]

[INFO] Flume NG Sinks .................................... SUCCESS [0.275s]

[INFO] Flume NG HDFS Sink ................................ SUCCESS [0.892s]

[INFO] Flume NG IRC Sink ................................. SUCCESS [0.515s]

[INFO] Flume NG Channels ................................. SUCCESS [0.214s]

[INFO] Flume NG JDBC channel ............................. SUCCESS [0.802s]

[INFO] Flume NG Agent .................................... SUCCESS [0.893s]

[INFO] Flume NG file-based channel ....................... SUCCESS [0.516s]

[INFO] Flume NG distribution ............................. SUCCESS [16.602s]

[INFO] Flume legacy Sources .............................. SUCCESS [0.143s]

[INFO] Flume legacy Thrift Source ........................ SUCCESS [0.599s]

[INFO] Flume legacy Avro source .......................... SUCCESS [0.458s]

[INFO] Flume NG Clients .................................. SUCCESS [0.133s]

[INFO] Flume NG Log4j Appender ........................... SUCCESS [0.385s]

[INFO] ------------------------------------------------------------------------

[INFO] BUILD SUCCESS

Now we find the build and sources in flume-ng-dist/target. Copy the wanted distribution to the host you want to play with, unpack them and start to use flume. 

What is a flow?

A flow in flumeNG describes the whole transport from a source to a sink. The sink could also be a new source to collect different streams into one sink. The process flume starts is an agent. A setup could be run like the example:

source -             -> source => channel => sink

        \           /       

source - => channel => sink 

        /           \

source -             -> channel => source => channel => sink                  

Configuration

Before we can start to play with flumeNG, we need to configure it. The config is logical, but for the first time difficult to understand. The matrix is always <identifier>.type.subtype.parameter.config, where <identifier> is the name of the agent we call later to startup. As the picture above shows, we can have all complexity we want. For that we need also a config which reflects our complexity, so we have to define the source, channel, sink for all entry and end points. 

Let me explain an example (syslog-agent.cnf):

syslog-agent.sources = Syslog

syslog-agent.channels = MemoryChannel-1

syslog-agent.sinks = Console

syslog-agent.sources.Syslog.type = syslogTcp

syslog-agent.sources.Syslog.port = 5140

syslog-agent.sources.Syslog.channels = MemoryChannel-1

syslog-agent.sinks.Console.channel = MemoryChannel-1

syslog-agent.sinks.Console.type = logger

syslog-agent.channels.MemoryChannel-1.type = memory

In the configuration example above we define a simple syslog flow, start point Syslog, endpoint Console and transport channel MemoryChannel-1. The name of a segment we can define as we wish, that are the main identifiers to setup a valid flow. 

The example flow will listen at the configured port and will send all events to the logger (logger is an internal sink for debugging and sends captured events to stdout).  The same config with HDFS as an sink would looks like:

syslog-agent.sources = Syslog

syslog-agent.channels = MemoryChannel-1

syslog-agent.sinks = HDFS-LAB

syslog-agent.sources.Syslog.type = syslogTcp

syslog-agent.sources.Syslog.port = 5140

syslog-agent.sources.Syslog.channels = MemoryChannel-1

syslog-agent.sinks.HDFS-LAB.channel = MemoryChannel-1

syslog-agent.sinks.HDFS-LAB.type = hdfs

syslog-agent.sinks.HDFS-LAB.hdfs.path = hdfs://NN.URI:PORT/flumetest/'%{host}''
syslog-agent.sinks.HDFS-LAB.hdfs.file.Prefix = syslogfiles
syslog-agent.sinks.HDFS-LAB.hdfs.file.rollInterval = 60
syslog-agent.sinks.HDFS-LAB.hdfs.file.Type = SequenceFile
syslog-agent.channels.MemoryChannel-1.type = memory

Flume supports at the moment avro, syslog and exec sources, hdfs and logger sinks. 

Start the flow

Flume-ng starts a single flow per process. That's will be done with:

bin/flume-ng agent -n YOUR_IDENTIFIER -f YOUR_CONFIGFILE 

eg:

bin/flume-ng agent -n syslog-agent -f conf/syslog-agent.cnf

Links: flumeNG Wiki