General
jKool is a great alternative to Splunk or Elastic Search and goes beyond log analytics.
Here is why:
- Easy, simple to use, cost effective
- No hardware, software, databases required
- Simple web interface from any place, anytime
- Unified model: metrics, logs, transactions
- We automatically discover, stitch transactions — not just logs, metrics
- Combined real-time & historical analytics
- 2 click analytics, root-cause analysis
- Open Source Collectors
- log4j, slf4j, logback, jmx, end-user, browser, APM and more
- Runs on Apache open source stack
A datapoint is computed as follows: total dps = #events + #transactions + #metrics (name=value pairs).
if you stream syslog, log4j #dps = #events + #(name=value pairs extracted from log messages).
Time Series Data: (from Wikipedia):
A time series is a sequence of data points, measured typically at successive points in time spaced at uniform time intervals.
Examples of time series are the daily closing value of the Dow Jones Industrial Average and the annual flow volume of the Nile River at Grand Ethiopian Renaissance Dam.
Quantities that represent or trace the values taken by a variable over a period such as a month, quarter, or year. Time series data occurs wherever the same measurements are recorded on a regular basis. (from BusinessDictionary.com)
Dashboard
- Select your repository (not Sample) when prompted to select repository.
- Sample repository contains only sample data set.
- Streamed data goes to your private repository associated with the API access token.
Create a new dashboard and a new viewlet with a query like: “get events show as table”
See Tutorial for more information.
Query Language
API
The API encapsulates streaming, metrics, state and context into a simple, extensible java framework.
jKool analyzes all streams in real-time: meaning all events streams are processed as soon as they arrive to jKool.
All streams are split into 2 paths in parallel: short path (real-time) with ms latency, long path (seconds latency).
Hence you can see real-time view of your event streams using "subscribe to" JKQL verb and get historical view of your events using "get" verb.
Example real time query: "subscribe to events show as linechart"
Example historical query: "get events for today show as linechart"
NOTE: Analyzed real-time streams show up on display before they get persisted to storage.
If you are streaming data using JESL syslog daemon or log4j/logback appender.
- Make sure tnt4j.properties has the right API access token (included in your jkoolcloud registration email, or "About jKool" menu on your dashboard).
- If you using log4j/logback appenders, include the following java properties:
- tnt4j.dump.on.vm.shutdown=true
- tnt4j.dump.on.exception=true
- tnt4j.dump.provider.default=true
- Check <name>.dump file generated when streaming application stops.
- Open .dump file and find: "JKCloudEventSink" it should show events, bytes sent, any errors, etc, etc — all the stats related to streaming.