Dieterbe
commented
10 years ago you might want to look into ES + kibana for this kind off drill down. your approach is not bad, as long as the storage overhead doesn't get too much. (with whisper you might pre-allocate an entire file for every single client even though (s)he is only active rarely, sparse whisper allocation or an alternative backend such as influxdb will help with that). but either way GE currently doesn't support this kind of filtering based on graphite data (it currently only filters based on the metric information (i.e. the metadata about your timeseries), not the actual timeseries itself) sorry for the late reply :(
Hello, In my application I am tracking my customers which are thousands. The customer ID is part of the metric, i.e. it has its own tag because I need to be able to analyze data on a per-client basis. Everything is good -- I successfully sum the requests made by all my clients and get a nice clean graph. When I see some kind of a peak, I remove the sum to see the individual clients actions. However, the legend on the right will display every possible client tag value since the beginning of time. Since a picture is worth more than a thousand words, here is what I am talking about.
Here I detected that some clients were doing something unusual and I zoomed in this area. I can see that the orange and the skyblue guys were doing something. However, on the legend on the right there are all known client ids known since the beginning of time, which in my case could be well over 200 000 and that would render the chart useless.
So my question is, is there a way to filter the unique tag values based on the currently visible area on the chart?
Alternatively, am I going down the wrong path by placing the client ID in the metric thus creating thousands of unique metrics? I could only be logging something like Requests/second, but when those requests reach a peak, I want to be able to see who was making them. Is putting metadata (client ID) in the actual data wrong? I know that StatsD and Graphite work this way -- we only have.
Are you aware of any alternative solutions that would allow me to achieve what I have described -- i.e. graph Requests/second and when I detect unusual activity drill down to see who was making those requests?
Thanks in advance.