September 2024 Summaries

The Coralogix Scheduled Reports feature is designed to enhance data-driven decision-making by automating the delivery of logs, metrics, and tracing data through custom dashboards to recipients' inboxes at specified intervals. This automation addresses the inefficiencies of manual reporting, allowing users to receive timely and accurate insights without the need for manual data retrieval, thereby simplifying workflows and improving communication. The feature also aids in keeping non-technical stakeholders informed by automatically sending high-level dashboards to executives, ensuring they have the necessary data for decision-making without additional effort from developers. Setting up Scheduled Reports is straightforward, requiring users to configure a custom dashboard, schedule, and recipient list, after which reports are sent automatically according to the set schedule.

Coralogix has introduced a new investigations feature designed to streamline incident investigations by offering real-time collaboration and centralized evidence collection. This tool aids developers in quickly identifying root causes of issues like system outages and RUM errors, thereby enhancing operational efficiency and proactive troubleshooting. It allows SOC admins to efficiently triage alerts by assembling evidence in one place, understanding the context of threats, performing risk assessments, and planning mitigation strategies. By consolidating all relevant data within the Coralogix platform, users can visualize event timelines, ensuring a comprehensive understanding of incidents. This feature reduces the manual labor involved, minimizes errors, and enhances communication among team members, ultimately facilitating more informed decision-making and swift action during investigations.

The article explores how Coralogix tackles the challenge of effectively monitoring Content Delivery Networks (CDNs) by optimizing costs and improving observability without indexing logs. It highlights the importance of request locality in CDN performance and outlines the steps taken using Coralogix's features to address this, such as utilizing the TCO Optimizer for cost reduction, enriching logs with geo-location data, converting logs into metrics, and visualizing them in custom dashboards. The process includes creating alerts for when CDN nodes do not serve requests from the same country, thereby ensuring efficient content delivery. The article emphasizes the capability of Coralogix to maintain deep insights without the cost and complexity of traditional log indexing, allowing users to explore data directly from cloud storage.

The Coralogix team tackled a challenge in translating SQL-like expressions into OpenSearch DSL while maintaining backwards compatibility in their DataPrime query engine. The crux of the task involved handling SQL's null semantics, where expressions can result in TRUE, FALSE, or NULL, and adapting these to OpenSearch, which only recognizes TRUE or FALSE through document filtering. The team explored the logic behind SQL's three-valued logic, focusing on translating expressions using boolean operators like AND, OR, and NOT into OpenSearch's binary system by determining whether an expression is "false or null" or "true or null." This translation demanded creating an intermediate representation of the Elasticsearch DSL to optimize and simplify the conversion process, applying logical principles like De Morgan’s laws. Although OpenSearch DSL's capacity is limited for advanced operations, script queries were used for more complex tasks, highlighting the balance between performance and functionality in achieving accurate translations.

Coralogix offers a streamlined approach to network monitoring on AWS by utilizing indexless observability, which addresses the challenges of noisy and complex network logs. By integrating AWS services like Virtual Private Cloud (VPC), Application Load Balancer (ALB), and Route53 with Coralogix through AWS Firehose, users can easily deploy alarms, dashboards, and parse logs with minimal clicks. The indexless model eliminates traditional storage costs, allowing for efficient telemetry optimization and enabling users to handle more data without sacrificing insight or performance. Coralogix's TCO Optimizer significantly reduces data storage requirements, enabling comprehensive monitoring, alerting, and querying capabilities while maintaining cost-effectiveness. This innovative method enhances the observability of complex network environments, offering limitless insights without the constraints of traditional indexing.

AWS Elemental MediaTailor's transcoding performance, crucial for dynamically inserting relevant advertisements into media streams, poses a challenge in measurement due to the absence of traditional latency metrics. The solution involves leveraging Coralogix's log analytics and tools like the TCO Optimizer and DataPrime, allowing for cost-effective log processing and advanced querying without traditional indexing. By integrating MediaTailor logs into Coralogix and utilizing the Events2Metrics and DataPrime querying language, users can analyze transcoding events and calculate lead times using Little’s Law. Additionally, the platform enables the creation of visualizations and alerts to monitor transcoding performance, providing powerful insights and allowing users to explore various data-driven directions, such as throughput calculations and custom dashboards.