Using Apache Flume and Apache Solr

This article will discuss the high-level architecture of how we can keep track of all the messages consumed by a JMS consumer. This use case can also be used to keep track of all the web service requests and responses. 

Before reading this article, it's good that you have little knowledge about Apache Flume and  Apache Solr. This historical collection of all the enterprise messages, web service requests, and responses will provide a new domain to analyze the client's interaction with our applications.

We want to save all the messages from topic foo.bar. We will use Apache Flume to get the data from ActiveMQ and finally index them, later to be searched with Apache Solr.

The flow is simple. Messages from ActiveMQ flow into flume agents via JMS source, then we use memory channel, and finally we use morphlineSolrSink  to index the data into Solr.

Snippet from flume-conf.properties file, which is at flume/conf.

# Name the components on this agent
a1.sources = r1
a1.sinks = k1
a1.channels = c1

# Describe/configure the source
a1.sources.r1.type = jms
a1.sources.r1.initialContextFactory = org.apache.activemq.jndi.ActiveMQInitialContextFactory
a1.sources.r1.providerURL = tcp://PC258117:61616
a1.sources.r1.destinationName = foo.bar
a1.sources.r1.destinationType = QUEUE


# Describe the sink
a1.sinks.k1.type = org.apache.flume.sink.solr.morphline.MorphlineSolrSink
a1.sinks.k1.morphlineFile = D:/Apache_Flume/apache-flume-1.5.0-bin/conf/morphline.conf

# Use a channel which buffers events in memory
a1.channels.c1.type = memory
a1.channels.c1.capacity = 10000
a1.channels.c1.transactionCapacity = 1000

# Bind the source and sink to the channel
a1.sources.r1.channels = c1

a1.sinks.k1.channel = c1

At line 16, provide the location of your morphline.conf  file. Below is the snippet from the morphline.conf file.

morphlines : [
  {
    # Name used to identify a morphline. E.g. used if there are multiple
    # morphlines in a morphline config file
    id : morphline1

    # Import all morphline commands in these java packages and their
    # subpackages. Other commands that may be present on the classpath are 
    # not visible to this morphline.
    importCommands : ["com.cloudera.**", "org.apache.solr.**"]

    commands : [
      {
        # Parse input attachment and emit a record for each input line                
        readLine {
          charset : UTF-8
        }
      }

      {
        grok {
          # Consume the output record of the previous command and pipe another
          # record downstream.
          #
          # A grok-dictionary is a config file that contains prefabricated
          # regular expressions that can be referred to by name. grok patterns
          # specify such a regex name, plus an optional output field name.
          # The syntax is %{REGEX_NAME:OUTPUT_FIELD_NAME}
          # The input line is expected in the "message" input field.
          dictionaryFiles : [src/test/resources/grok-dictionaries]
          expressions : {
             message : """%{POSINT:serial} %{DATA:message}"""

          }
        }
      }

      # Consume the output record of the previous command, convert 
      # the timestamp, and pipe another record downstream.
      #
      # convert timestamp field to native Solr timestamp format
      # e.g. 2012-09-06T07:14:34Z to 2012-09-06T07:14:34.000Z


      # Consume the output record of the previous command, transform it
      # and pipe the record downstream.
      #
      # This command deletes record fields that are unknown to Solr
      # schema.xml. Recall that Solr throws an exception on any attempt to
      # load a document that contains a field that isn't specified in
      # schema.xml.
      {
        sanitizeUnknownSolrFields {
          # Location from which to fetch Solr schema
          solrLocator : {            
            collection : gettingstarted      
            zkHost : "localhost:9983/solr" 
          }
        }
      }

      # log the record at INFO level to SLF4J
      { logInfo { format : "output record: {}", args : ["@{}"] } }

      # load the record into a Solr server or MapReduce Reducer
      {
        loadSolr {
          solrLocator : {            
            collection : gettingstarted      
            zkHost : "localhost:9983/solr" 
          }
        }
      }
    ]
  }
]

You can read more about morphlineSolrSink here. You can transform your data before indexing and do a lot of other processing with morphlineSolrSink. Basic morph line commands are: 

• readLine: Reads.

• grok: Formats/processes.

• loadSolr: Loads to Solr.

Now, fire up your browser to the Solr Web Admin console and search all the messages that you indexed. 

You can use this architecture to also log all the web service requests and responses. You need to change the Flume source and configure it to use your requests and responses.

Note: Remember that MorphlineSolrSink currently does not work on Windows-based systems.