mirror of
https://github.com/akvorado/akvorado.git
synced 2025-12-11 22:14:02 +01:00
ac68c5970e
This change split the inlet component into a simpler inlet and a new outlet component. The new inlet component receive flows and put them in Kafka, unparsed. The outlet component takes them from Kafka and resume the processing from here (flow parsing, enrichment) and puts them in ClickHouse. The main goal is to ensure the inlet does a minimal work to not be late when processing packets (and restart faster). It also brings some simplification as the number of knobs to tune everything is reduced: for inlet, we only need to tune the queue size for UDP, the number of workers and a few Kafka parameters; for outlet, we need to tune a few Kafka parameters, the number of workers and a few ClickHouse parameters. The outlet component features a simple Kafka input component. The core component becomes just a callback function. There is also a new ClickHouse component to push data to ClickHouse using the low-level ch-go library with batch inserts. This processing has an impact on the internal representation of a FlowMessage. Previously, it was tailored to dynamically build the protobuf message to be put in Kafka. Now, it builds the batch request to be sent to ClickHouse. This makes the FlowMessage structure hides the content of the next batch request and therefore, it should be reused. This also changes the way we decode flows as they don't output FlowMessage anymore, they reuse one that is provided to each worker. The ClickHouse tables are slightly updated. Instead of using Kafka engine, the Null engine is used instead. Fix #1122
53 lines
1.5 KiB
Go
53 lines
1.5 KiB
Go
// SPDX-FileCopyrightText: 2022 Free Mobile
|
|
// SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
// Package decoder handles the protocol-independent part of flow
|
|
// decoding.
|
|
package decoder
|
|
|
|
import (
|
|
"net/netip"
|
|
"time"
|
|
|
|
"akvorado/common/pb"
|
|
"akvorado/common/reporter"
|
|
"akvorado/common/schema"
|
|
)
|
|
|
|
// Decoder is the interface each decoder should implement.
|
|
type Decoder interface {
|
|
// Decoder takes a raw flow and options. It should enqueue new flows in the
|
|
// provided flow message. When a flow is enqueted, it will call the finalize
|
|
// function. It is important to not set an error once the flow is being
|
|
// built (as there is no rollback possible).
|
|
Decode(in RawFlow, options Option, bf *schema.FlowMessage, finalize FinalizeFlowFunc) (int, error)
|
|
|
|
// Name returns the decoder name
|
|
Name() string
|
|
}
|
|
|
|
// Option specifies option to influence the behaviour of the decoder
|
|
type Option struct {
|
|
// TimestampSource is a selector for how to set the TimeReceived.
|
|
TimestampSource pb.RawFlow_TimestampSource
|
|
}
|
|
|
|
// Dependencies are the dependencies for the decoder
|
|
type Dependencies struct {
|
|
Schema *schema.Component
|
|
}
|
|
|
|
// RawFlow is an undecoded flow.
|
|
type RawFlow struct {
|
|
TimeReceived time.Time
|
|
Payload []byte
|
|
Source netip.Addr
|
|
}
|
|
|
|
// NewDecoderFunc is the signature of a function to instantiate a decoder.
|
|
type NewDecoderFunc func(*reporter.Reporter, Dependencies) Decoder
|
|
|
|
// FinalizeFlowFunc is the signature of a function to finalize a flow. The
|
|
// caller has a reference to the flow message he provided.
|
|
type FinalizeFlowFunc func()
|