Publish SQL-based endpoints on NGINX log analysis
Blog post from Tinybird
Tinybird, while not a traditional log analysis tool, can effectively analyze log-like datasets such as NGINX logs by leveraging its SQL-based framework to publish queries as API endpoints and model data sources for enhanced speed. Although Tinybird only supports CSV files, its CLI tool can load space-separated files by guessing the delimiter, allowing users to transform and query data through a process called "piping." For scalability, especially with millions of daily log entries, Tinybird enables the creation of materialized views (MV) that provide faster real-time data processing by using SQL with state modifiers and an AggregatingMergeTree engine to aggregate columns efficiently. This process ensures that endpoints are significantly faster, as they utilize pre-aggregated data stored in MVs rather than recalculating with each request. The materialized views update automatically with new data, providing users with rapid and reliable real-time analytics, and can be applied to various use cases like tracking unique IP addresses by day or analyzing payload size percentiles per hour. A GitHub repository is available to help users reproduce these steps and start analyzing their logs with Tinybird.