Apache Druid vs Elasticsearch

Apache Druid Overview

Apache Druid is an open-source, real-time analytics database designed for high-performance querying and data ingestion. Originally developed by Metamarkets in 2011 and later donated to the Apache Software Foundation in 2018, Druid has gained popularity for its ability to handle large volumes of data with low latency. With a unique architecture that combines elements of time series databases, search systems, and columnar storage, Druid is particularly well-suited for use cases involving event-driven data and interactive analytics.

Elasticsearch Overview

Elasticsearch is an open-source distributed search and analytics engine built on top of Apache Lucene. It was first released in 2010 and has since become popular for its scalability, near real-time search capabilities, and ease of use. Elasticsearch is designed to handle a wide variety of data types, including structured, unstructured, and time-based data. It is often used in conjunction with other tools from the Elastic Stack, such as Logstash for data ingestion and Kibana for data visualization.

Apache Druid for Time Series Data

Apache Druid is designed for real time analytics and can be a good fit for working with time series data that needs to be analyzed quickly after being written. Druid also offers integrations for storing historical data in cheaper object storage so historical time series data can also be analyzed using Druid.

Elasticsearch for Time Series Data

Elasticsearch can be used for time series data storage and analysis, thanks to its distributed architecture, near real-time search capabilities, and support for aggregations. However, it might not be as optimized for time series data as dedicated time series databases. Despite this, Elasticsearch is widely used for log and event data storage and analysis which can be considered time series data.

Apache Druid Key Concepts

• Data Ingestion: The process of importing data into Druid from various sources, such as streaming or batch data sources.
• Segments: The smallest unit of data storage in Druid, segments are immutable, partitioned, and compressed.
• Data Rollup: The process of aggregating raw data during ingestion to reduce storage requirements and improve query performance.
• Nodes: Druid’s architecture consists of different types of nodes, including Historical, Broker, Coordinator, and MiddleManager/Overlord, each with specific responsibilities.
• Indexing Service: Druid’s indexing service manages the process of ingesting data, creating segments, and publishing them to deep storage.

Elasticsearch Key Concepts

• Inverted Index: A data structure used by Elasticsearch to enable fast and efficient full-text searches.
• Cluster: A group of Elasticsearch nodes that work together to distribute data and processing tasks.
• Shard: A partition of an Elasticsearch index that allows data to be distributed across multiple nodes for improved performance and fault tolerance.

Apache Druid Architecture

Apache Druid is a powerful distributed data store designed for real-time analytics on large datasets. Within its architecture, several core components play pivotal roles in ensuring its efficiency and scalability. Here is an overview of the core components that power Apache Druid.

• Historical Nodes are fundamental to Druid’s data-serving capabilities. Their primary responsibility is to serve stored data to queries. To achieve this, they load segments from deep storage, retain them in memory, and then cater to the queries on these segments. When considering deployment and management, these nodes are typically stationed on machines endowed with significant memory and CPU resources. Their scalability is evident as they can be expanded horizontally simply by incorporating more nodes.
• Broker Nodes act as the gatekeepers for incoming queries. Their main function is to channel these queries to the appropriate historical nodes or real-time nodes. Intriguingly, they are stateless, which means they can be scaled out to accommodate an increase in query concurrency.
• Coordinator Nodes have a managerial role, overseeing the data distribution across historical nodes. Their decisions on which segments to load or drop are based on specific configurable rules. In terms of deployment, a Druid setup usually requires just one active coordinator node, with a backup node on standby for failover scenarios.
• Overlord Nodes dictate the assignment of ingestion tasks, directing them to either middle manager or indexer nodes. Their deployment mirrors that of the coordinator nodes, with typically one active overlord and a backup for redundancy.
• MiddleManager and Indexer Nodes are the workhorses of data ingestion in Druid. While MiddleManagers initiate short-lived tasks for data ingestion, indexers are designed for long-lived tasks. Given their intensive operations, these nodes demand high CPU and memory resources. Their scalability is flexible, allowing horizontal expansion based on the volume of data ingestion.
• Deep Storage is a component that serves as Druid’s persistent storage unit. Druid integrates with various blob storage solutions like HDFS, S3, and Google Cloud Storage.
• Metadata Storage is the repository for crucial metadata about segments, tasks, and configurations. Druid is compatible with popular databases for this purpose, including MySQL, PostgreSQL, and Derby.

Elasticsearch Architecture

Elasticsearch is a distributed, RESTful search and analytics engine that uses a schema-free JSON document data model. It is built on top of Apache Lucene and provides a high-level API for indexing, searching, and analyzing data. Elasticsearch’s architecture is designed to be horizontally scalable, with data distributed across multiple nodes in a cluster. Data is indexed using inverted indices, which enable fast and efficient full-text searches.