| </a></div><button type="button" class="clean-btn close announcementBarClose_iXyO" aria-label="Close"><svg viewBox="0 0 15 15" width="14" height="14" style="color:white"><g stroke="currentColor" stroke-width="3.1"><path d="M.75.75l13.5 13.5M14.25.75L.75 14.25"></path></g></svg></button></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner" style="padding:"><div class="navbar__items"><div class="navbar-left"><div class="navbar-logo-wrapper flex items-center"><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="https://cdnd.selectdb.com/images/logo.svg" alt="Apache Doris" class="themedImage_ToTc themedImage--light_HNdA"><img src="https://cdnd.selectdb.com/images/logo.svg" alt="Apache Doris" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a></div><a class="navbar__item navbar__link" style="text-align:center" href="/docs/get-starting/quick-start">Docs</a><a aria-current="page" class="navbar__item navbar__link navbar__link--active" style="text-align:center" href="/blog">Blog</a><a class="navbar__item navbar__link" style="text-align:center" href="/users">Users</a><a href="https://github.com/apache/doris/discussions" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link" style="text-align:center">Discussions</a><a class="navbar__item navbar__link" style="text-align:center" href="/ecosystem/cluster-management">Ecosystem</a><a class="navbar__item navbar__link" style="text-align:center" href="/community/join-community">Community</a></div></div><div class="navbar__items navbar__items--right"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><div class="docs-search searchBox_H2mL"><div class="navbar__search searchBarContainer_PzyC"><input placeholder="Search" aria-label="Search" class="navbar__search-input navbarSearchInput_tb6T"><div class="loadingRing__K5d searchBarLoadingRing_e2f0"><div></div><div></div><div></div><div></div></div><div class="searchHintContainer_m7ml"><kbd class="searchHint_zuPL">ctrl</kbd><kbd class="searchHint_zuPL">K</kbd></div></div></div><div class="custom-navbar-item navbar__item dropdown dropdown--hoverable dropdown--right"><a class="navbar__link" aria-haspopup="true" aria-expanded="false" role="button" href="/docs/get-starting/what-is-apache-doris"><span class="text-sm">Versions: </span></a><ul class="dropdown__menu"><li><a class="dropdown__link" style="text-align:center" href="/docs/dev/get-starting/what-is-apache-doris">Dev</a></li><li><a class="dropdown__link" style="text-align:center" href="/docs/get-starting/what-is-apache-doris">2.1</a></li><li><a class="dropdown__link" style="text-align:center" href="/docs/2.0/get-starting/what-is-apache-doris">2.0</a></li><li><a class="dropdown__link" style="text-align:center" href="/docs/1.2/get-starting/">1.2</a></li></ul></div><a class="navbar__item navbar__link header-right-button-primary navbar-download-mobile" style="text-align:center" href="/download">Download</a><a href="https://github.com/apache/doris" target="_blank" rel="noopener noreferrer" class="github-btn desktop header-right-button-github"></a><a href="https://join.slack.com/t/apachedoriscommunity/shared_invite/zt-2kl08hzc0-SPJe4VWmL_qzrFd2u2XYQA" target="_blank" rel="noopener noreferrer" class="slack-btn desktop header-right-button-slack"></a><a class="header-right-button-primary navbar-download-desktop" href="/download">Download</a></div></div><div class="navbar__bottom"></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="__docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0"><div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#__docusaurus_skipToContent_fallback">Skip to main content</a></div><div class="main-wrapper"><div class="mb-[4.875rem] container"><div class="lg:row lg:flex"><main class="col col--9 col--offset-1" itemscope="" itemtype="http://schema.org/Blog"><article class="blog-article-content" itemprop="blogPost" itemscope="" itemtype="http://schema.org/BlogPosting"><header><div class="text-center mb-4"><a class="text-[#8592A6] cursor-pointer hover:no-underline" href="/blog">Blog</a><span class="px-2 text-[#8592A6]">/</span><span><span class="s-tags"><span class="s-tag">Tech Sharing</span></span></span></div><h1 class="blog-post-title text-[2rem] leading-normal lg:text-[2.5rem] text-center" itemprop="headline">Log analysis: Elasticsearch vs Apache Doris</h1><div class="blog-info text-center flex justify-center text-sm text-black"><span class="authors"><span class="s-author text-black">Apache Doris</span></span><time datetime="2023-09-28T00:00:00.000Z" itemprop="datePublished" class="text-black ml-4">September 28, 2023</time></div></header><div id="__blog-post-container" class="markdown" itemprop="articleBody"><p>As a major part of a company's data asset, logs brings values to businesses in three aspects: system observability, cyber security, and data analysis. They are your first resort for troubleshooting, your reference for improving system security, and your data mine where you can extract information that points to business growth.</p><p>Logs are the sequential records of events in the computer system. If you think about how logs are generated and used, you will know what an ideal log analysis system should look like:</p><ul><li><strong>It should have schema-free support.</strong> Raw logs are unstructured free texts and basically impossible for aggregation and calculation, so you needed to turn them into structured tables (the process is called "ETL") before putting them into a database or data warehouse for analysis. If there was a schema change, lots of complicated adjustments needed to put into ETL and the structured tables. Therefore, semi-structured logs, mostly in JSON format, emerged. You can add or delete fields in these logs and the log storage system will adjust the schema accordingly. </li><li><strong>It should be low-cost.</strong> Logs are huge and they are generated continuously. A fairly big company produces 10~100 TBs of log data. For business or compliance reasons, it should keep the logs around for half a year or longer. That means to store a log size measured in PB, so the cost is considerable.</li><li><strong>It should be capable of real-time processing.</strong> Logs should be written in real time, otherwise engineers won't be able to catch the latest events in troubleshooting and security tracking. Plus, a good log system should provide full-text searching capabilities and respond to interactive queries quickly.</li></ul><h2 class="anchor anchorWithStickyNavbar_LWe7" id="the-elasticsearch-based-log-analysis-solution">The Elasticsearch-Based Log Analysis Solution<a href="#the-elasticsearch-based-log-analysis-solution" class="hash-link" aria-label="Direct link to The Elasticsearch-Based Log Analysis Solution" title="Direct link to The Elasticsearch-Based Log Analysis Solution"></a></h2><p>A popular log processing solution within the data industry is the <strong>ELK stack: Elasticsearch, Logstash, and Kibana</strong>. The pipeline can be split into five modules:</p><ul><li><strong>Log collection</strong>: Filebeat collects local log files and writes them to a Kafka message queue.</li><li><strong>Log transmission</strong>: Kafka message queue gathers and caches logs.</li><li><strong>Log transfer</strong>: Logstash filters and transfers log data in Kafka.</li><li><strong>Log storage</strong>: Logstash writes logs in JSON format into Elasticsearch for storage.</li><li><strong>Log query</strong>: Users search for logs via Kibana visualization or send a query request via Elasticsearch DSL API.</li></ul><p><img loading="lazy" alt="ELK-Stack" src="https://cdnd.selectdb.com/assets/images/LAS_1-5855470fa53156592103937c4c267847.png" width="1280" height="230" class="img_ev3q"></p><p>The ELK stack has outstanding real-time processing capabilities, but frictions exist.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="inadequate-schema-free-support">Inadequate Schema-Free Support<a href="#inadequate-schema-free-support" class="hash-link" aria-label="Direct link to Inadequate Schema-Free Support" title="Direct link to Inadequate Schema-Free Support"></a></h3><p>The Index Mapping in Elasticsearch defines the table scheme, which includes the field names, data types, and whether to enable index creation.</p><p><img loading="lazy" alt="index-mapping-in-Elasticsearch" src="https://cdnd.selectdb.com/assets/images/LAS_2-426b7a38106af2b1b439180d5ea5be47.png" width="796" height="772" class="img_ev3q"></p><p>Elasticsearch also boasts a Dynamic Mapping mechanism that automatically adds fields to the Mapping according to the input JSON data. This provides some sort of schema-free support, but it's not enough because:</p><ul><li>Dynamic Mapping often creates too many fields when processing dirty data, which interrupts the whole system.</li><li>The data type of fields is immutable. To ensure compatibility, users often configure "text" as the data type, but that results in much slower query performance than binary data types such as integer.</li><li>The index of fields is immutable, too. Users cannot add or delete indexes for a certain field, so they often create indexes for all fields to facilitate data filtering in queries. But too many indexes require extra storage space and slow down data ingestion.</li></ul><h3 class="anchor anchorWithStickyNavbar_LWe7" id="inadequate-analytic-capability">Inadequate Analytic Capability<a href="#inadequate-analytic-capability" class="hash-link" aria-label="Direct link to Inadequate Analytic Capability" title="Direct link to Inadequate Analytic Capability"></a></h3><p>Elasticsearch has its unique Domain Specific Language (DSL), which is very different from the tech stack that most data engineers and analysts are familiar with, so there is a steep learning curve. Moreover, Elasticsearch has a relatively closed ecosystem so there might be strong resistance in integration with BI tools. Most importantly, Elastisearch only supports single-table analysis and is lagging behind the modern OLAP demands for multi-table join, sub-query, and views.</p><p><img loading="lazy" alt="Elasticsearch-DSL" src="https://cdnd.selectdb.com/assets/images/LAS_3-8dda5ac77b54b4a58682c977efcd3817.png" width="550" height="764" class="img_ev3q"></p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="high-cost--low-stability">High Cost & Low Stability<a href="#high-cost--low-stability" class="hash-link" aria-label="Direct link to High Cost & Low Stability" title="Direct link to High Cost & Low Stability"></a></h3><p>Elasticsearch users have been complaining about the computation and storage costs. The root reason lies in the way Elasticsearch works.</p><ul><li><strong>Computation cost</strong>: In data writing, Elasticsearch also executes compute-intensive operations including inverted index creation, tokenization, and inverted index ranking. Under these circumstances, data is written into Elasticsearch at a speed of around 2MB/s per core. When CPU resources are tight, data writing requirements often get rejected during peak times, which further leads to higher latency. </li><li><strong>Storage cost</strong>: To speed up retrieval, Elasticsearch stores the forward indexes, inverted indexes, and docvalues of the original data, consuming a lot more storage space. The compression ratio of a single data copy is only 1.5:1, compared to the 5:1 in most log solutions.</li></ul><p>As data and cluster size grows, maintaining stability can be another issue:</p><ul><li><p><strong>During data writing peaks</strong>: Clusters are prone to overload during data writing peaks.</p></li><li><p><strong>During queries</strong>: Since all queries are processed in the memory, big queries can easily lead to JVM OOM.</p></li><li><p><strong>Slow recovery</strong>: For a cluster failure, Elasticsearch should reload indexes, which is resource-intensive, so it will take many minutes to recover. That challenges service availability guarantee.</p></li></ul><h2 class="anchor anchorWithStickyNavbar_LWe7" id="a-more-cost-effective-option">A More Cost-Effective Option<a href="#a-more-cost-effective-option" class="hash-link" aria-label="Direct link to A More Cost-Effective Option" title="Direct link to A More Cost-Effective Option"></a></h2><p>Reflecting on the strengths and limitations of the Elasticsearch-based solution, the Apache Doris developers have optimized Apache Doris for log processing. </p><ul><li><strong>Increase writing throughout</strong>: The performance of Elasticsearch is bottlenecked by data parsing and inverted index creation, so we improved Apache Doris in these factors: we quickened data parsing and index creation by SIMD instructions and CPU vector instructions; then we removed those data structures unnecessary for log analysis scenarios, such as forward indexes, to simplify index creation.</li><li><strong>Reduce storage costs</strong>: We removed forward indexes, which represented 30% of index data. We adopted columnar storage and the ZSTD compression algorithm, and thus achieved a compression ratio of 5:1 to 10:1. Given that a large part of the historical logs are rarely accessed, we introduced tiered storage to separate hot and cold data. Logs that are older than a specified time period will be moved to object storage, which is much less expensive. This can reduce storage costs by around 70%. </li></ul><p>Benchmark tests with ES Rally, the official testing tool for Elasticsearch, showed that Apache Doris was around 5 times as fast as Elasticsearch in data writing, 2.3 times as fast in queries, and it consumed only 1/5 of the storage space that Elasticsearch used. On the test dataset of HTTP logs, it achieved a writing speed of 550 MB/s and a compression ratio of 10:1.</p><p><img loading="lazy" alt="Elasticsearch-VS-Apache-Doris" src="https://cdnd.selectdb.com/assets/images/LAS_4-49afc2c61d8929daeb0f51c39686e305.png" width="1280" height="725" class="img_ev3q"></p><p>The below figure show what a typical Doris-based log processing system looks like. It is more inclusive and allows for more flexible usage from data ingestion, analysis, and application:</p><ul><li><strong>Ingestion</strong>: Apache Doris supports various ingestion methods for log data. You can push logs to Doris via HTTP Output using Logstash, you can use Flink to pre-process the logs before you write them into Doris, or you can load logs from Flink or object storage to Doris via Routine Load and S3 Load. </li><li><strong>Analysis</strong>: You can put log data in Doris and conduct join queries across logs and other data in the data warehouse.</li><li><strong>Application</strong>: Apache Doris is compatible with MySQL protocol, so you can integrate a wide variety of data analytic tools and clients to Doris, such as Grafana and Tableau. You can also connect applications to Doris via JDBC and ODBC APIs. We are planning to build a Kibana-like system to visualize logs.</li></ul><p><img loading="lazy" alt="Apache-Doris-log-analysis-stack" src="https://cdnd.selectdb.com/assets/images/LAS_5-cdbff999ed0de15553dee4514a869fd4.png" width="1272" height="432" class="img_ev3q"></p><p>Moreover, Apache Doris has better scheme-free support and a more user-friendly analytic engine.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="native-support-for-semi-structured-data">Native Support for Semi-Structured Data<a href="#native-support-for-semi-structured-data" class="hash-link" aria-label="Direct link to Native Support for Semi-Structured Data" title="Direct link to Native Support for Semi-Structured Data"></a></h3><p><strong>Firstly, we worked on the data types.</strong> We optimized the string search and regular expression matching for "text" through vectorization and brought a performance increase of 2~10 times. For JSON strings, Apache Doris will parse and store them as a more compacted and efficient binary format, which can speed up queries by 4 times. We also added a new data type for complicated data: Array Map. It can structuralize concatenated strings to allow for higher compression rate and faster queries.</p><p><strong>Secondly, Apache Doris supports schema evolution.</strong> This means you can adjust the schema as your business changes. You can add or delete fields and indexes, and change the data types for fields.</p><p>Apache Doris provides Light Schema Change capabilities, so you can add or delete fields within milliseconds:</p><div class="language-SQL codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-SQL codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">-- Add a column. Result will be returned in milliseconds.</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">ALTER TABLE lineitem ADD COLUMN l_new_column INT;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>You can also add index only for your target fields, so you can avoid overheads from unnecessary index creation. After you add an index, by default, the system will generate the index for all incremental data, and you can specify which historical data partitions that need the index.</p><div class="language-SQL codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-SQL codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">-- Add inverted index. Doris will generate inverted index for all new data afterward.</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">ALTER TABLE table_name ADD INDEX index_name(column_name) USING INVERTED;</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">-- Build index for the specified historical data partitions.</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">BUILD INDEX index_name ON table_name PARTITIONS(partition_name1, partition_name2);</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="sql-based-analytic-engine">SQL-Based Analytic Engine<a href="#sql-based-analytic-engine" class="hash-link" aria-label="Direct link to SQL-Based Analytic Engine" title="Direct link to SQL-Based Analytic Engine"></a></h3><p>The SQL-based analytic engine makes sure that data engineers and analysts can smoothly grasp Apache Doris in a short time and bring their experience with SQL to this OLAP engine. Building on the rich features of SQL, users can execute data retrieval, aggregation, multi-table join, sub-query, UDF, logic views, and materialized views to serve their own needs. </p><p>With MySQL compatibility, Apache Doris can be integrated with most GUI and BI tools in the big data ecosystem, so users can realize more complex and diversified data analysis.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="performance-in-use-case">Performance in Use Case<a href="#performance-in-use-case" class="hash-link" aria-label="Direct link to Performance in Use Case" title="Direct link to Performance in Use Case"></a></h3><p>A gaming company has transitioned from the ELK stack to the Apache Doris solution. Their Doris-based log system used 1/6 of the storage space that they previously needed. </p><p>In a cybersecurity company who built their log analysis system utilizing inverted index in Apache Doris, they supported a data writing speed of 300,000 rows per second with 1/5 of the server resources that they formerly used. </p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="hands-on-guide">Hands-On Guide<a href="#hands-on-guide" class="hash-link" aria-label="Direct link to Hands-On Guide" title="Direct link to Hands-On Guide"></a></h2><p>Now let's go through the three steps of building a log analysis system with Apache Doris. </p><p>Before you start, <a href="https://doris.apache.org/download/" target="_blank" rel="noopener noreferrer">download</a> Apache Doris 2.0 or newer versions from the website and <a href="https://doris.apache.org/docs/dev/install/standard-deployment/" target="_blank" rel="noopener noreferrer">deploy</a> clusters.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="step-1-create-tables">Step 1: Create Tables<a href="#step-1-create-tables" class="hash-link" aria-label="Direct link to Step 1: Create Tables" title="Direct link to Step 1: Create Tables"></a></h3><p>This is an example of table creation.</p><p>Explanations for the configurations:</p><ul><li>The DATETIMEV2 time field is specified as the Key in order to speed up queries for the latest N log records.</li><li>Indexes are created for the frequently accessed fields, and fields that require full-text search are specified with Parser parameters.</li><li>"PARTITION BY RANGE" means to partition the data by RANGE based on time fields, <a href="https://doris.apache.org/docs/dev/advanced/partition/dynamic-partition/" target="_blank" rel="noopener noreferrer">Dynamic Partition</a> is enabled for auto-management.</li><li>"DISTRIBUTED BY RANDOM BUCKETS AUTO" means to distribute the data into buckets randomly and the system will automatically decide the number of buckets based on the cluster size and data volume.</li><li>"log_policy_1day" and "log_s3" means to move logs older than 1 day to S3 storage.</li></ul><div class="language-Go codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-Go codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">CREATE DATABASE log_db;</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">USE log_db;</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">CREATE RESOURCE "log_s3"</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">PROPERTIES</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">(</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "type" = "s3",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "s3.endpoint" = "your_endpoint_url",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "s3.region" = "your_region",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "s3.bucket" = "your_bucket",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "s3.root.path" = "your_path",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "s3.access_key" = "your_ak",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "s3.secret_key" = "your_sk"</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">);</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">CREATE STORAGE POLICY log_policy_1day</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">PROPERTIES(</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "storage_resource" = "log_s3",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "cooldown_ttl" = "86400"</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">);</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">CREATE TABLE log_table</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">(</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> `ts` DATETIMEV2,</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> `clientip` VARCHAR(20),</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> `request` TEXT,</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> `status` INT,</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> `size` INT,</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> INDEX idx_size (`size`) USING INVERTED,</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> INDEX idx_status (`status`) USING INVERTED,</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> INDEX idx_clientip (`clientip`) USING INVERTED,</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> INDEX idx_request (`request`) USING INVERTED PROPERTIES("parser" = "english")</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">)</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">ENGINE = OLAP</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">DUPLICATE KEY(`ts`)</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">PARTITION BY RANGE(`ts`) ()</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">DISTRIBUTED BY RANDOM BUCKETS AUTO</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">PROPERTIES (</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">"replication_num" = "1",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">"storage_policy" = "log_policy_1day",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">"deprecated_dynamic_schema" = "true",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">"dynamic_partition.enable" = "true",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">"dynamic_partition.time_unit" = "DAY",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">"dynamic_partition.start" = "-3",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">"dynamic_partition.end" = "7",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">"dynamic_partition.prefix" = "p",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">"dynamic_partition.buckets" = "AUTO",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">"dynamic_partition.replication_num" = "1"</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">);</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="step-2-ingest-the-logs">Step 2: Ingest the Logs<a href="#step-2-ingest-the-logs" class="hash-link" aria-label="Direct link to Step 2: Ingest the Logs" title="Direct link to Step 2: Ingest the Logs"></a></h3><p>Apache Doris supports various ingestion methods. For real-time logs, we recommend the following three methods:</p><ul><li>Pull logs from Kafka message queue: Routine Load </li><li>Logstash: write logs into Doris via HTTP API</li><li>Self-defined writing program: write logs into Doris via HTTP API</li></ul><p><strong>Ingest from Kafka</strong></p><p>For JSON logs that are written into Kafka message queues, create <a href="https://doris.apache.org/docs/dev/data-operate/import/import-way/routine-load-manual/" target="_blank" rel="noopener noreferrer">Routine Load</a> so Doris will pull data from Kafka. The following is an example. The <code>property.*</code> configurations are optional:</p><div class="language-SQL codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-SQL codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">-- Prepare the Kafka cluster and topic ("log_topic")</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain" style="display:inline-block"></span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">-- Create Routine Load, load data from Kafka log_topic to "log_table"</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">CREATE ROUTINE LOAD load_log_kafka ON log_db.log_table</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">COLUMNS(ts, clientip, request, status, size)</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">PROPERTIES (</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "max_batch_interval" = "10",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "max_batch_rows" = "1000000",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "max_batch_size" = "109715200",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "strict_mode" = "false",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "format" = "json"</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">)</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">FROM KAFKA (</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "kafka_broker_list" = "host:port",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "kafka_topic" = "log_topic",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "property.group.id" = "your_group_id",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "property.security.protocol"="SASL_PLAINTEXT", </span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "property.sasl.mechanism"="GSSAPI", </span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "property.sasl.kerberos.service.name"="kafka", </span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "property.sasl.kerberos.keytab"="/path/to/xxx.keytab", </span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "property.sasl.kerberos.principal"="xxx@yyy.com"</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">);</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>You can check how the Routine Load runs via the <code>SHOW ROUTINE LOAD</code> command. </p><p><strong>Ingest via Logstash</strong></p><p>Configure HTTP Output for Logstash, and then data will be sent to Doris via HTTP Stream Load.</p><ol><li>Specify the batch size and batch delay in <code>logstash.yml</code> to improve data writing performance.</li></ol><div class="language-Plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-Plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">pipeline.batch.size: 100000</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">pipeline.batch.delay: 10000</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><ol start="2"><li>Add HTTP Output to the log collection configuration file <code>testlog.conf</code>, URL => the Stream Load address in Doris.</li></ol><ul><li>Since Logstash does not support HTTP redirection, you should use a backend address instead of a FE address.</li><li>Authorization in the headers is <code>http basic auth</code>. It is computed with <code>echo -n 'username:password' | base64</code>.</li><li>The <code>load_to_single_tablet</code> in the headers can reduce the number of small files in data ingestion.</li></ul><div class="language-Plain codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-Plain codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">output {</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> http {</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> follow_redirects => true</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> keepalive => false</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> http_method => "put"</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> url => "http://172.21.0.5:8640/api/logdb/logtable/_stream_load"</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> headers => [</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "format", "json",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "strip_outer_array", "true",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "load_to_single_tablet", "true",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "Authorization", "Basic cm9vdDo=",</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> "Expect", "100-continue"</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> ]</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> format => "json_batch"</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain"> }</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">}</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p><strong>Ingest via self-defined program</strong></p><p>This is an example of ingesting data to Doris via HTTP Stream Load.</p><p>Notes:</p><ul><li>Use <code>basic auth</code> for HTTP authorization, use <code>echo -n 'username:password' | base64</code> in computation</li><li><code>http header "format:json"</code>: the data type is specified as JSON</li><li><code>http header "read_json_by_line:true"</code>: each line is a JSON record</li><li><code>http header "load_to_single_tablet:true"</code>: write to one tablet each time</li><li>For the data writing clients, we recommend a batch size of 100MB~1GB. Future versions will enable Group Commit at the server end and reduce batch size from clients.</li></ul><div class="language-Bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-Bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">curl \</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">--location-trusted \</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">-u username:password \</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">-H "format:json" \</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">-H "read_json_by_line:true" \</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">-H "load_to_single_tablet:true" \</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">-T logfile.json \</span><br></span><span class="token-line" style="color:#F8F8F2"><span class="token plain">http://fe_host:fe_http_port/api/log_db/log_table/_stream_load</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h3 class="anchor anchorWithStickyNavbar_LWe7" id="step-3-execute-queries">Step 3: Execute Queries<a href="#step-3-execute-queries" class="hash-link" aria-label="Direct link to Step 3: Execute Queries" title="Direct link to Step 3: Execute Queries"></a></h3><p>Apache Doris supports standard SQL, so you can connect to Doris via MySQL client or JDBC and then execute SQL queries.</p><div class="language-SQL codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-SQL codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">mysql -h fe_host -P fe_mysql_port -u root -Dlog_db</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p><strong>A few common queries in log analysis:</strong></p><ul><li>Check the latest 10 records.</li></ul><div class="language-SQL codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-SQL codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">SELECT * FROM log_table ORDER BY ts DESC LIMIT 10;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><ul><li>Check the latest 10 records of Client IP "8.8.8.8".</li></ul><div class="language-SQL codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-SQL codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">SELECT * FROM log_table WHERE clientip = '8.8.8.8' ORDER BY ts DESC LIMIT 10;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><ul><li>Retrieve the latest 10 records with "error" or "404" in the "request" field. <strong>MATCH_ANY</strong> is a SQL syntax keyword for full-text search in Doris. It means to find the records that include any one of the specified keywords.</li></ul><div class="language-SQL codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-SQL codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">SELECT * FROM log_table WHERE request MATCH_ANY 'error 404' ORDER BY ts DESC LIMIT 10;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><ul><li>Retrieve the latest 10 records with "image" and "faq" in the "request" field. <strong>MATCH_ALL</strong> is also a SQL syntax keyword for full-text search in Doris. It means to find the records that include all of the specified keywords.</li></ul><div class="language-SQL codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#F8F8F2;--prism-background-color:#282A36"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-SQL codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#F8F8F2"><span class="token plain">SELECT * FROM log_table WHERE request MATCH_ALL 'image faq' ORDER BY ts DESC LIMIT 10;</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg viewBox="0 0 24 24" class="copyButtonIcon_y97N"><path fill="currentColor" d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg viewBox="0 0 24 24" class="copyButtonSuccessIcon_LjdS"><path fill="currentColor" d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h2 class="anchor anchorWithStickyNavbar_LWe7" id="conclusion">Conclusion<a href="#conclusion" class="hash-link" aria-label="Direct link to Conclusion" title="Direct link to Conclusion"></a></h2><p>If you are looking for an efficient log analytic solution, Apache Doris is friendly to anyone equipped with SQL knowledge; if you find friction with the ELK stack, try Apache Doris provides better schema-free support, enables faster data writing and queries, and brings much less storage burden.</p><p>But we won't stop here. We are going to provide more features to facilitate log analysis. We plan to add more complicated data types to inverted index, and support BKD index to make Apache Doris a fit for geo data analysis. We also plan to expand capabilities in semi-structured data analysis, such as working on the complex data types (Array, Map, Struct, JSON) and high-performance string matching algorithm. And we welcome any <a href="https://join.slack.com/t/apachedoriscommunity/shared_invite/zt-2kl08hzc0-SPJe4VWmL_qzrFd2u2XYQA" target="_blank" rel="noopener noreferrer">user feedback and development advice</a>.</p></div></article><div class="pl-4 mt-20 text-[#1D1D1D]"><div class="text-[2rem] leading-[3.25rem]">Recent posts</div><div class="mt-4 flex flex-col"><a href="https://doris.apache.org/blog/evolution-of-the-apache-doris-execution-engine" target="_blank" rel="noopener noreferrer" class="text-lg leading-10 hover:no-underline hover:text-[#444FD9]">Steps to industry-leading query speed: evolution of the Apache Doris execution engine</a><a href="https://doris.apache.org/blog/job-scheduler-for-task-automation" target="_blank" rel="noopener noreferrer" class="text-lg leading-10 hover:no-underline hover:text-[#444FD9]">Another lifesaver for data engineers: Apache Doris Job Scheduler for task automation</a><a href="https://doris.apache.org/blog/release-note-2.0.11" target="_blank" rel="noopener noreferrer" class="text-lg leading-10 hover:no-underline hover:text-[#444FD9]">Apache Doris version 2.0.11 has been released</a><a href="https://doris.apache.org/blog/apache-doris-for-log-and-time-series-data-analysis-in-netease" target="_blank" rel="noopener noreferrer" class="text-lg leading-10 hover:no-underline hover:text-[#444FD9]">Apache Doris for log and time series data analysis in NetEase, why not Elasticsearch and InfluxDB?</a></div><a class="flex group text-primary items-center text-base cursor-pointer hover:no-underline mt-4" href="/blog"><span class="mr-2">View all blogs</span><span class="transition-slide"><svg xmlns="http://www.w3.org/2000/svg" class="transition-slide" width="1em" height="1em" viewBox="0 0 16 14" fill="none"><path d="M9.37549 12.3542L14.8755 6.85419L9.37549 1.35419" stroke="currentColor" stroke-width="1.65" stroke-linecap="round" stroke-linejoin="round"></path><path d="M1.12549 6.85419L14.8755 6.85419" stroke="currentColor" stroke-width="1.65" stroke-linecap="round" stroke-linejoin="round"></path></svg></span></a></div></main><div class="col col--2"><div class="tableOfContents_jeP5 thin-scrollbar"><a href="https://github.com/apache/doris/discussions" target="_blank" rel="noopener noreferrer" class="ml-4 mb-8 flex items-center hover:no-underline"><span class="pr-2">Join Discussion</span><svg viewBox="0 0 1024 1024" version="1.1" xmlns="http://www.w3.org/2000/svg" p-id="8500" id="mx_n_1711090272569" width="16" height="16"><path d="M522.24 896.512c-25.6 4.608-51.712 7.168-78.336 7.168-79.36 0-157.696-21.504-225.792-62.464l-18.432-10.752-103.936 28.16c-28.672 7.68-54.784-18.432-47.104-47.104l28.16-103.936c-10.752-17.92-17.408-30.208-20.992-36.864C20.992 607.232 3.072 536.064 3.584 463.36c0-243.2 197.12-440.32 440.32-440.32 221.696 0 405.504 164.352 435.712 377.856 90.112 55.808 144.896 154.112 144.896 260.096 0 51.2-12.8 100.352-36.352 144.384-2.048 4.096-6.144 10.752-11.776 20.48l17.408 64c7.68 28.672-18.432 54.784-47.104 47.104l-64-17.408-7.68 4.608c-47.616 28.672-101.888 43.52-157.184 43.52-71.68-0.512-140.8-25.088-195.584-71.168z m95.232-28.672c31.232 15.36 65.536 23.04 100.352 23.04 41.472 0 82.432-11.264 117.76-32.768 2.56-1.536 9.728-5.632 22.016-12.8 8.704-5.12 19.456-6.656 29.184-3.584l14.848 4.096-4.096-14.848c-2.56-10.24-1.536-20.48 4.096-29.696 6.144-10.24 12.288-20.992 18.432-31.232 17.92-33.28 27.136-70.656 27.136-108.544 0-59.904-23.552-117.76-65.536-160.256-13.312 164.352-118.272 303.616-264.192 366.592z m-462.848-155.648l-14.848 54.784 54.784-14.848c9.728-2.56 20.48-1.536 29.184 4.096 18.432 10.752 29.184 16.896 32.768 19.456 56.32 33.792 120.832 51.712 186.88 51.712 200.704 0 363.52-162.816 363.52-363.52s-162.816-363.52-363.52-363.52-363.52 162.816-363.52 363.52c0 60.928 14.848 119.296 43.008 171.52 3.584 7.168 13.312 23.04 27.648 47.616 5.632 8.704 6.656 19.456 4.096 29.184z m448.512-382.976c20.992 0 38.4 16.896 38.4 38.4 0 20.992-16.896 38.4-38.4 38.4H284.16c-20.992 0-38.4-16.896-38.4-38.4 0-20.992 16.896-38.4 38.4-38.4h318.976z m-153.088 191.488c20.992 0 38.4 16.896 38.4 38.4 0 20.992-16.896 38.4-38.4 38.4H284.16c-20.992 0-38.4-16.896-38.4-38.4 0-20.992 16.896-38.4 38.4-38.4h165.888z m0 0" p-id="8501" fill="currentColor"></path></svg></a><span class="ml-4">On This Page</span><ul class="table-of-contents table-of-contents__left-border"><li><a href="#the-elasticsearch-based-log-analysis-solution" class="table-of-contents__link toc-highlight">The Elasticsearch-Based Log Analysis Solution</a><ul><li><a href="#inadequate-schema-free-support" class="table-of-contents__link toc-highlight">Inadequate Schema-Free Support</a></li><li><a href="#inadequate-analytic-capability" class="table-of-contents__link toc-highlight">Inadequate Analytic Capability</a></li><li><a href="#high-cost--low-stability" class="table-of-contents__link toc-highlight">High Cost & Low Stability</a></li></ul></li><li><a href="#a-more-cost-effective-option" class="table-of-contents__link toc-highlight">A More Cost-Effective Option</a><ul><li><a href="#native-support-for-semi-structured-data" class="table-of-contents__link toc-highlight">Native Support for Semi-Structured Data</a></li><li><a href="#sql-based-analytic-engine" class="table-of-contents__link toc-highlight">SQL-Based Analytic Engine</a></li><li><a href="#performance-in-use-case" class="table-of-contents__link toc-highlight">Performance in Use Case</a></li></ul></li><li><a href="#hands-on-guide" class="table-of-contents__link toc-highlight">Hands-On Guide</a><ul><li><a href="#step-1-create-tables" class="table-of-contents__link toc-highlight">Step 1: Create Tables</a></li><li><a href="#step-2-ingest-the-logs" class="table-of-contents__link toc-highlight">Step 2: Ingest the Logs</a></li><li><a href="#step-3-execute-queries" class="table-of-contents__link toc-highlight">Step 3: Execute Queries</a></li></ul></li><li><a href="#conclusion" class="table-of-contents__link toc-highlight">Conclusion</a></li></ul></div></div></div></div></div></div><div class="footer pt-16 pb-10"><div class="container"><div class="footer-box"><div class="left"><img src="/images/asf_logo_apache.svg" alt="" class="themedImage_ToTc themedImage--light_HNdA footer__logo"><img src="/images/asf_logo_apache.svg" alt="" class="themedImage_ToTc themedImage--dark_i4oU footer__logo"><div class="row footer__links"><div class="col footer__col"><div class="footer__title">ASF</div><ul class="footer__items clean-list"><li class="footer__item"><a href="https://www.apache.org/" target="_blank" rel="noopener noreferrer" class="footer__link-item">Foundation<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li class="footer__item"><a href="https://www.apache.org/licenses/" target="_blank" rel="noopener noreferrer" class="footer__link-item">License<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li class="footer__item"><a href="https://www.apache.org/events/current-event" target="_blank" rel="noopener noreferrer" class="footer__link-item">Events<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li class="footer__item"><a href="https://www.apache.org/foundation/sponsorship.html" target="_blank" rel="noopener noreferrer" class="footer__link-item">Sponsorship<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li class="footer__item"><a href="https://privacy.apache.org/policies/privacy-policy-public.html" target="_blank" rel="noopener noreferrer" class="footer__link-item">Privacy<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li class="footer__item"><a href="https://www.apache.org/security/" target="_blank" rel="noopener noreferrer" class="footer__link-item">Security<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li class="footer__item"><a href="https://www.apache.org/foundation/thanks.html" target="_blank" rel="noopener noreferrer" class="footer__link-item">Thanks<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li></ul></div><div class="col footer__col"><div class="footer__title">Resources</div><ul class="footer__items clean-list"><li class="footer__item"><a class="footer__link-item" href="/download">Download</a></li><li class="footer__item"><a class="footer__link-item" href="/docs/get-starting/quick-start">Docs</a></li><li class="footer__item"><a class="footer__link-item" href="/blog">Blog</a></li><li class="footer__item"><a class="footer__link-item" href="/ecosystem/cluster-management">Ecosystem</a></li><li class="footer__item"><a class="footer__link-item" href="/users">Users</a></li><li class="footer__item"><a href="https://github.com/apache/doris/discussions" target="_blank" rel="noopener noreferrer" class="footer__link-item">Discussions<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li></ul></div><div class="col footer__col"><div class="footer__title">Community</div><ul class="footer__items clean-list"><li class="footer__item"><a class="footer__link-item" href="/community/how-to-contribute/">How to contribute</a></li><li class="footer__item"><a href="https://github.com/apache/doris/" target="_blank" rel="noopener noreferrer" class="footer__link-item">Source code<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li class="footer__item"><a href="https://cwiki.apache.org/confluence/display/DORIS/Doris+Improvement+Proposals" target="_blank" rel="noopener noreferrer" class="footer__link-item">Improvement proposal<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li><li class="footer__item"><a class="footer__link-item" href="/community/team">Doris team</a></li><li class="footer__item"><a href="https://github.com/apache/doris/issues/30669" target="_blank" rel="noopener noreferrer" class="footer__link-item">Roadmap<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a></li></ul></div></div></div><div class="right"><div class="footer__title">Join the community</div><div class="social-list"><div class="social"><a href="mailto:dev@doris.apache.org" target="_blank" title="mail" class="item"><svg xmlns="http://www.w3.org/2000/svg" width="2em" height="2em" viewBox="0 0 32 32" fill="none"><path d="M5.6003 6H26.3997C27.8186 6 28.982 7.10964 29 8.46946L16.0045 15.454L3.01202 8.47829C3.02405 7.11258 4.1784 6 5.6003 6ZM3.01202 11.1508L3 23.5011C3 24.8756 4.16938 26 5.6003 26H26.3997C27.8306 26 29 24.8756 29 23.5011V11.145L16.3111 17.8028C16.1157 17.9058 15.8813 17.9058 15.6889 17.8028L3.01202 11.1508Z" fill="currentColor"></path></svg></a><a href="https://github.com/apache/doris" target="_blank" title="github" class="item"><svg width="2em" height="2em" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M16.0001 2.66675C8.63342 2.66675 2.66675 8.63341 2.66675 16.0001C2.66524 18.7991 3.54517 21.5276 5.1817 23.7983C6.81824 26.0691 9.12828 27.7668 11.7841 28.6508C12.4508 28.7668 12.7001 28.3668 12.7001 28.0161C12.7001 27.7001 12.6828 26.6508 12.6828 25.5334C9.33342 26.1508 8.46675 24.7174 8.20008 23.9668C8.04942 23.5828 7.40008 22.4001 6.83342 22.0828C6.36675 21.8334 5.70008 21.2161 6.81608 21.2001C7.86675 21.1828 8.61608 22.1668 8.86675 22.5668C10.0668 24.5828 11.9841 24.0161 12.7494 23.6668C12.8668 22.8001 13.2161 22.2174 13.6001 21.8841C10.6334 21.5508 7.53342 20.4001 7.53342 15.3001C7.53342 13.8494 8.04942 12.6507 8.90008 11.7161C8.76675 11.3827 8.30008 10.0161 9.03342 8.18275C9.03342 8.18275 10.1494 7.83342 12.7001 9.55075C13.7855 9.2495 14.907 9.09787 16.0334 9.10008C17.1668 9.10008 18.3001 9.24942 19.3668 9.54942C21.9161 7.81608 23.0334 8.18408 23.0334 8.18408C23.7668 10.0174 23.3001 11.3841 23.1668 11.7174C24.0161 12.6507 24.5334 13.8334 24.5334 15.3001C24.5334 20.4174 21.4174 21.5508 18.4508 21.8841C18.9334 22.3001 19.3508 23.1001 19.3508 24.3508C19.3508 26.1334 19.3334 27.5668 19.3334 28.0174C19.3334 28.3668 19.5841 28.7828 20.2508 28.6494C22.8975 27.7558 25.1973 26.0547 26.8266 23.7856C28.4559 21.5165 29.3327 18.7936 29.3334 16.0001C29.3334 8.63341 23.3668 2.66675 16.0001 2.66675V2.66675Z" fill="currentColor"></path></svg></a><a href="https://twitter.com/doris_apache" target="_blank" title="twitter" class="item"><svg xmlns="http://www.w3.org/2000/svg" width="2em" height="2em" viewBox="0 0 32 32" fill="none"><path d="M4.625 4.625H11.2809L27.375 27.375H20.7191L4.625 4.625ZM7.52549 6.10639L21.5236 25.8936H24.4746L10.4764 6.10639H7.52549Z" fill="currentColor"></path><path d="M14.4268 18.4803L6.53447 27.375H4.625L13.5581 17.2525L14.4268 18.4803ZM18.1299 14.3066L26.7203 4.625H24.7017L17.2525 13.0662L18.1299 14.3066Z" fill="currentColor"></path></svg></a><a href="https://join.slack.com/t/apachedoriscommunity/shared_invite/zt-2kl08hzc0-SPJe4VWmL_qzrFd2u2XYQA" title="slack" target="_blank" class="item"><svg width="2em" height="2em" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#clip0_125_278)"><path d="M12.5875 16.6906C11.0844 16.6906 9.86562 17.9094 9.86562 19.4125V26.2375C9.86562 26.9594 10.1524 27.6517 10.6628 28.1622C11.1733 28.6726 11.8656 28.9594 12.5875 28.9594C13.3094 28.9594 14.0017 28.6726 14.5122 28.1622C15.0226 27.6517 15.3094 26.9594 15.3094 26.2375V19.4531C15.3094 17.9094 14.0906 16.6906 12.5875 16.6906ZM3 19.4531C3 20.175 3.28677 20.8673 3.79722 21.3778C4.30767 21.8882 4.99999 22.175 5.72187 22.175C6.44376 22.175 7.13608 21.8882 7.64653 21.3778C8.15698 20.8673 8.44375 20.175 8.44375 19.4531V16.7312H5.7625C4.25938 16.6906 3 17.9094 3 19.4531ZM12.5875 3C11.8656 3 11.1733 3.28677 10.6628 3.79722C10.1524 4.30767 9.86562 4.99999 9.86562 5.72187C9.86562 6.44376 10.1524 7.13608 10.6628 7.64653C11.1733 8.15698 11.8656 8.44375 12.5875 8.44375H15.3094V5.72187C15.3094 4.21875 14.0906 3 12.5875 3ZM5.72187 15.3094H12.5469C13.2688 15.3094 13.9611 15.0226 14.4715 14.5122C14.982 14.0017 15.2688 13.3094 15.2688 12.5875C15.2688 11.8656 14.982 11.1733 14.4715 10.6628C13.9611 10.1524 13.2688 9.86562 12.5469 9.86562H5.72187C4.99999 9.86562 4.30767 10.1524 3.79722 10.6628C3.28677 11.1733 3 11.8656 3 12.5875C3 13.3094 3.28677 14.0017 3.79722 14.5122C4.30767 15.0226 4.99999 15.3094 5.72187 15.3094ZM26.2375 9.86562C24.7344 9.86562 23.5156 11.0844 23.5156 12.5875V15.3094H26.2375C26.9594 15.3094 27.6517 15.0226 28.1622 14.5122C28.6726 14.0017 28.9594 13.3094 28.9594 12.5875C28.9594 11.8656 28.6726 11.1733 28.1622 10.6628C27.6517 10.1524 26.9594 9.86562 26.2375 9.86562ZM16.6906 5.72187V12.5875C16.6906 13.3094 16.9774 14.0017 17.4878 14.5122C17.9983 15.0226 18.6906 15.3094 19.4125 15.3094C20.1344 15.3094 20.8267 15.0226 21.3372 14.5122C21.8476 14.0017 22.1344 13.3094 22.1344 12.5875V5.72187C22.1344 4.99999 21.8476 4.30767 21.3372 3.79722C20.8267 3.28677 20.1344 3 19.4125 3C18.6906 3 17.9983 3.28677 17.4878 3.79722C16.9774 4.30767 16.6906 4.99999 16.6906 5.72187ZM22.1344 26.2781C22.1344 24.775 20.9156 23.5562 19.4125 23.5562H16.6906V26.2781C16.6906 27 16.9774 27.6923 17.4878 28.2028C17.9983 28.7132 18.6906 29 19.4125 29C20.1344 29 20.8267 28.7132 21.3372 28.2028C21.8476 27.6923 22.1344 27 22.1344 26.2781ZM26.2781 16.6906H19.4125C18.6906 16.6906 17.9983 16.9774 17.4878 17.4878C16.9774 17.9983 16.6906 18.6906 16.6906 19.4125C16.6906 20.1344 16.9774 20.8267 17.4878 21.3372C17.9983 21.8476 18.6906 22.1344 19.4125 22.1344H26.2375C27.7406 22.1344 28.9594 20.9156 28.9594 19.4125C29 17.9094 27.7812 16.6906 26.2781 16.6906Z" fill="currentColor"></path></g><defs><clipPath id="clip0_125_278"><rect width="26" height="26" fill="currentColor" transform="translate(3 3)"></rect></clipPath></defs></svg></a></div><div class="social"><a href="https://www.youtube.com/@apachedoris/channels" title="youtube" target="_blank" class="item"><svg xmlns="http://www.w3.org/2000/svg" width="2em" height="2em" viewBox="0 0 32 32" fill="none"><path d="M28.5167 7.83429C28.9436 8.25423 29.2532 8.77539 29.4154 9.34742C29.8205 11.5462 30.0159 13.7775 29.999 16.0121C30.0144 18.2382 29.819 20.4609 29.4154 22.6515C29.2532 23.2235 28.9436 23.7446 28.5167 24.1645C28.0898 24.5845 27.5601 24.889 26.9785 25.0486C24.7728 25.625 16.0124 25.625 16.0124 25.625C16.0124 25.625 7.22652 25.625 5.04638 25.0486C4.46489 24.889 3.9351 24.5845 3.5082 24.1645C3.08132 23.7446 2.77176 23.2235 2.60948 22.6515C2.19736 20.4617 1.9934 18.239 2.00025 16.0121C1.9918 13.7767 2.19577 11.5455 2.60948 9.34742C2.77176 8.77539 3.08132 8.25423 3.5082 7.83429C3.9351 7.41436 4.46489 7.10985 5.04638 6.95021C7.25103 6.36354 16.0124 6.37502 16.0124 6.37502C16.0124 6.37502 24.796 6.37502 26.9785 6.95021C27.5601 7.10985 28.0898 7.41436 28.5167 7.83429ZM12.5 21.25L21.25 16.008L12.5 10.75V21.25Z" fill="currentColor"></path></svg></a><a href="https://www.linkedin.com/company/doris-apache/" title="linkedin" target="_blank" class="item"><svg width="2rem" height="2rem" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M4.29925 26.9996H9.66738V11.6781H4.29925V26.9996ZM22.1628 11.1949C19.9409 11.1949 18.7157 11.9388 17.3054 13.7407V11.6777H11.9459V26.9996H17.305V18.6738C17.305 16.9168 18.145 15.1982 20.1535 15.1982C22.162 15.1982 22.6559 16.9164 22.6559 18.632V27H28V18.2902C28 12.2386 24.3854 11.1949 22.1628 11.1949ZM6.99325 4C5.3395 4 4 5.21047 4 6.7046C4 8.19759 5.3395 9.40617 6.99325 9.40617C8.6455 9.40617 9.985 8.19722 9.985 6.7046C9.985 5.21047 8.6455 4 6.99325 4Z" fill="white"></path></svg></a><a href="https://medium.com/@ApacheDoris" title="medium" target="_blank" class="item"><svg width="2em" height="2em" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg"><g id="Frame"><path id="Vector" d="M17.7967 16.5385C17.8029 18.53 16.9746 20.4425 15.4937 21.8559C14.0128 23.2693 12.0004 24.0681 9.89836 24.0769C7.79633 24.0681 5.78391 23.2693 4.30302 21.8559C2.82212 20.4425 1.99383 18.53 2.00003 16.5385C1.99383 14.5469 2.82212 12.6344 4.30302 11.221C5.78391 9.80759 7.79633 9.00878 9.89836 9C12.0004 9.00878 14.0128 9.80759 15.4937 11.221C16.9746 12.6344 17.8029 14.5469 17.7967 16.5385ZM26.4533 16.5385C26.4533 20.4514 24.6917 23.6348 22.51 23.6348C20.3283 23.6348 18.555 20.4514 18.555 16.5385C18.555 12.6255 20.3283 9.44214 22.51 9.44214C24.6917 9.44214 26.4533 12.6255 26.4533 16.5385ZM30 16.5385C30 20.0424 29.3817 22.8942 28.6117 22.8942C27.8417 22.8942 27.2233 20.0424 27.2233 16.5385C27.2233 13.0345 27.8417 10.1827 28.6117 10.1827C29.3817 10.1827 30 13.0345 30 16.5385Z" fill="currentColor"></path></g></svg></a><a class="item wechat"><svg width="2em" height="2em" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M20.7578 11.5169C21.0708 11.5169 21.3795 11.5398 21.6851 11.573C20.8524 7.73517 16.7052 4.88306 11.9718 4.88306C6.67951 4.88306 2.34412 8.45283 2.34412 12.9854C2.34412 15.6013 3.78679 17.7498 6.19667 19.4161L5.2339 22.2827L8.59917 20.6122C9.80411 20.8478 10.7698 21.0906 11.9718 21.0906C12.2738 21.0906 12.5728 21.0759 12.8703 21.0523C12.682 20.4159 12.5728 19.7485 12.5728 19.0566C12.5728 14.8947 16.1847 11.5169 20.7578 11.5169ZM15.5822 8.9335C16.3072 8.9335 16.7871 9.40601 16.7871 10.1229C16.7871 10.8369 16.3072 11.3153 15.5822 11.3153C14.8601 11.3153 14.1365 10.8369 14.1365 10.1229C14.1365 9.40601 14.8601 8.9335 15.5822 8.9335ZM8.84429 11.3153C8.12218 11.3153 7.3942 10.8368 7.3942 10.1229C7.3942 9.40597 8.12218 8.93346 8.84429 8.93346C9.56559 8.93346 10.0463 9.40597 10.0463 10.1229C10.0463 10.8369 9.56559 11.3153 8.84429 11.3153ZM29.5453 18.9422C29.5453 15.1332 25.6935 12.0285 21.3677 12.0285C16.7871 12.0285 13.1797 15.1332 13.1797 18.9422C13.1797 22.7567 16.7871 25.8547 21.3677 25.8547C22.326 25.8547 23.2932 25.6169 24.2559 25.3777L26.897 26.8086L26.1726 24.4282C28.1056 22.993 29.5453 21.0906 29.5453 18.9422ZM18.7126 17.7498C18.2335 17.7498 17.7499 17.278 17.7499 16.7966C17.7499 16.3219 18.2335 15.8442 18.7126 15.8442C19.4406 15.8442 19.9176 16.3219 19.9176 16.7966C19.9176 17.278 19.4406 17.7498 18.7126 17.7498ZM24.0079 17.7498C23.5324 17.7498 23.0518 17.278 23.0518 16.7966C23.0518 16.3219 23.5324 15.8442 24.0079 15.8442C24.73 15.8442 25.2128 16.3219 25.2128 16.7966C25.2128 17.278 24.73 17.7498 24.0079 17.7498Z" fill="currentColor"></path></svg><div class="wechat-dropdown"><p class="text-[#4c576c] text-xs">Connect on WeChat</p><img src="https://cdnd.selectdb.com/assets/images/doris-wechat-b949e908a3bc2776d824f79a9100bd4b.png" alt=""></div></a></div></div></div></div><div class="footer__copyright">Copyright © 2024 The Apache Software Foundation,Licensed under the <a href="https://www.apache.org/licenses/LICENSE-2.0" target="_blank">Apache License, Version 2.0</a>. Apache, Doris, Apache Doris, the Apache feather logo and the Apache Doris logo are trademarks of The Apache Software Foundation.</div></div></div></div> |
