Re:Simple Alerting for the ELK Stack
by zenlikethat on Monday April 25, 2016 @12:13AM
(#11562492)
Using Clojure, especially to slap together Riemann configs, is really not an insurmountable obstacle, especially when something as useful as Riemann is on the line. The more the self-defeating attitude that "Clojure's too hard" propagates the less likely people will be to even try. Most SRE's are pretty smart, I believe in them.
There are some great commercial options in this space like SignalFX and Sumo Logic. The cost of Riemann's learning and implementation challenges would have to be made significantly less for entire teams to make it a viable alternative to those, in my experience.
If anyone runs a team of 25 or more SREs and effectively uses Riemann (and there's more than 3 domain experts), and is not otherwise a Clojure shop, I'd love to hear from you.
> as a practical matter, its use of Clojure is simply not a hurdle most SRE types are going to overcome to use it
And yet, it's the most widely used option in this role. Crazy days.
Can you site something specific for this claim? Are you talking about clojure or riemann or both?
ElasticSearch is a great search engine. It's not a CEP or SEP. I don't mean to discourage its use, but for this purpose it's not a good fit. It does make sense to tee incoming logs to both as they suit different purposes, but I'd delegate pattern analysis to the latter.