Query Prediction for Log Search for Distributed Tracing with External Monitoring Alerts

• Main Authors: Koyama, Tomoyuki, Kushida, Takayuki, Ikuno, Soichiro
• Format: Conference Proceeding
• Language: English
• Subjects: Log Search; Metadata; Microservice architectures; Monitoring; Observability; Prediction methods; Query Prediction; Root cause analysis; Search engines; Soft sensors; Time factors; Time measurement
• ISSN: 2159-6972
• DOI: 10.1109/CIoT63799.2024.10757147

Microservice systems consist of services that are separated into subsystems. Root cause analysis in a microservice system presents challenges compared with a monolithic system because a stack trace cannot provide end-to-end tracing in a microservice system. Distributed tracing is a method for improving observability in microservice systems. System administrators use distributed tracing to find requests that cause system failures when a system failure occurs. A trace is a distributed trace record for distributed tracing and is stored on a search engine. The search engine takes time to reply to a query without a query cache when a search engine receives a query that has not been issued before. Query prediction allows search response time reduction before a search query is issued. This paper proposes query prediction method for distributed tracing to prepare a query cache before a search query is issued. The query prediction aims to make search queries that are likely to be issued. The proposed method utilizes alerts of external monitoring and attributes within traces for search query prediction. Using these data sources increases the query hit rate for the first-time issued queries. The evaluation experiment measures search response time from issuing search queries to receiving responses with and without applying the proposed method.