Load balancing computing resources in an observability pipeline system

1. A method of load balancing across computing resources in an observability pipeline system, the method comprising:

in an observability pipeline system deployed on one or more computer nodes operating in a leader role and a plurality of worker roles, identifying a plurality of computing jobs, each of the computing jobs comprising a plurality of computing tasks, each of the computing tasks associated with event data to be processed by the observability pipeline system;

by operation of the leader role, dispatching the plurality of computing tasks to the plurality of worker roles according to a least in-flight task dispatch criterion, wherein dispatching the plurality of computing tasks according to the least in-flight task dispatch criterion comprises, iteratively:

identifying one of the plurality of worker roles as an available worker role;

identifying, from the plurality of computing jobs, one or more incomplete computing jobs comprising one or more computing tasks that have not been executed in the observability pipeline system;

selecting, from the one or more incomplete computing jobs, a computing job that has the least number of in-flight computing tasks currently being executed in the observability pipeline system;

identifying a next computing task from the selected computing job; and

dispatching the next computing task to the available worker role;

by operation of the worker roles in the observability pipeline system, executing the computing tasks dispatched to the respective worker roles, wherein executing each respective computing task comprises applying an observability pipeline process to the event data associated with the respective computing task.

2. The method of claim 1 , comprising:

at the observability pipeline system, receiving pipeline input data comprising at least a portion of the event data from a plurality of external data sources;

generating at least a subset of the plurality of computing jobs based on the pipeline input data, wherein each of the computing tasks comprises a respective subset of the event data, and the worker roles generate pipeline output data by executing the computing tasks; and

delivering the pipeline output data from the observability pipeline system to a plurality of external data destinations.

3. The method of claim 1 , wherein one or more of the computing jobs are data collection jobs, each of the data collection jobs comprises a plurality of data collection tasks, and the method comprises:

receiving configuration information comprising event filter criteria for the data collection jobs; and

based on the event filter criteria, identifying a data payload comprising at least a portion of the event data,

wherein executing the computing tasks comprises executing each respective data collection task comprising:

communicating with an external data storage system to obtain a subset of filtered event data from the data payload, each subset of filtered event data comprising a respective portion of the event data; and

streaming the subset of filtered event data to the observability pipeline process.

4. The method of claim 1 , wherein applying the observability pipeline process to the event data comprises:

applying schema normalization to the event data to generate normalized event data;

routing the normalized event data to a streaming analytics and processing module;

generating structured output data from the normalized event data by operation of the streaming analytics and processing module; and

applying output schemas to the structured output data to generate observability pipeline output data for a plurality of external data destinations.

5. The method of claim 1 , wherein the available worker role is identified based on a work request from the available worker role, and dispatching the next computing task to the available worker role comprises sending the next computing task from the leader role to the available worker role in response to the work request.

6. The method of claim 1 , wherein:

the plurality of computing jobs comprises a first computing job and a second computing job, and

dispatching the plurality of computing tasks according to the least in-flight task dispatch criterion causes the first computing job to be completed in less time compared to dispatching the plurality of computing tasks according to a round robin dispatch criterion.

7. The method of claim 6 , wherein:

the first computing job comprises a first plurality of computing tasks,

the second computing job comprises a second plurality of computing tasks, and

the first plurality of computing tasks all have shorter execution times than the second plurality of computing tasks.

8. The method of claim 1 , wherein the observability pipeline system is deployed on a distributed computer system comprising a leader node operating as the leader role and a plurality of worker nodes operating as the worker roles.

9. The method of claim 1 , wherein the observability pipeline system is deployed on a standalone computer system comprising a single computer node operating as the leader role and the plurality of worker roles.

10. An observability pipeline system comprising one or more computer nodes that operate a leader role and a plurality of worker roles, the one or more computer nodes comprising:

one or more processors; and

memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

identifying a plurality of computing jobs, each of the computing jobs comprising a plurality of computing tasks, each of the computing tasks associated with event data to be processed by the observability pipeline system;

by operation of the leader role, dispatching the plurality of computing tasks to the plurality of worker roles according to a least in-flight task dispatch criterion, wherein dispatching the plurality of computing tasks according to the least in-flight task dispatch criterion comprises, iteratively:

identifying one of the plurality of worker roles as an available worker role;

identifying, from the plurality of computing jobs, one or more incomplete computing jobs comprising one or more computing tasks that have not been executed in the observability pipeline system;

selecting, from the one or more incomplete computing jobs, a computing job that has the least number of in-flight computing tasks currently being executed in the observability pipeline system;

identifying a next computing task from the selected computing job; and

dispatching the next computing task to the available worker role;

by operation of the worker roles in the observability pipeline system, executing the computing tasks dispatched to the respective worker roles, wherein executing each respective computing task comprises applying an observability pipeline process to the event data associated with the respective computing task.

11. The system of claim 10 , comprising:

at the observability pipeline system, receiving pipeline input data comprising at least a portion of the event data from a plurality of external data sources;

generating at least a subset of the plurality of computing jobs based on the pipeline input data, wherein each of the computing tasks comprises a respective subset of the event data, and the worker roles generate pipeline output data by executing the computing tasks; and

delivering the pipeline output data from the observability pipeline system to a plurality of external data destinations.

12. The system of claim 10 , wherein one or more of the computing jobs are data collection jobs, each of the data collection jobs comprises a plurality of data collection tasks, and the operations comprise:

receiving configuration information comprising event filter criteria for the data collection jobs; and

based on the event filter criteria, identifying a data payload comprising at least a portion of the event data,

wherein executing the computing tasks comprises executing each respective data collection task comprising:

communicating with an external data storage system to obtain a subset of filtered event data from the data payload, each subset of filtered event data comprising a respective portion of the event data; and

streaming the subset of filtered event data to the observability pipeline process.

13. The system of claim 10 , wherein applying the observability pipeline process to the event data comprises:

applying schema normalization to the event data to generate normalized event data;

routing the normalized event data to a streaming analytics and processing module;

generating structured output data from the normalized event data by operation of the streaming analytics and processing module; and

applying output schemas to the structured output data to generate observability pipeline output data for a plurality of external data destinations.

14. The system of claim 10 , wherein the available worker role is identified based on a work request from the available worker role, and dispatching the next computing task to the available worker role comprises sending the next computing task from the leader role to the available worker role in response to the work request.

15. The system of claim 10 , wherein:

the plurality of computing jobs comprises a first computing job and a second computing job, and

dispatching the plurality of computing tasks according to the least in-flight task dispatch criterion causes the first computing job to be completed in less time compared to dispatching the plurality of computing tasks according to a round robin dispatch criterion.

16. The system of claim 15 , wherein:

the first computing job comprises a first plurality of computing tasks,

the second computing job comprises a second plurality of computing tasks, and

the first plurality of computing tasks all have shorter execution times than the second plurality of computing tasks.

17. The system of claim 10 , wherein the observability pipeline system comprises a distributed computer system comprising a leader node that operates as the leader role and a plurality of worker nodes that operate as the worker roles.

18. The system of claim 10 , wherein the observability pipeline system comprises a standalone computer system comprising a single computer node operating as the leader role and the plurality of worker roles.

19. A non-transitory computer-readable medium comprising instructions that are operable when executed by data processing apparatus to perform operations comprising:

defining a leader role and a plurality of worker roles of an observability pipeline system;

identifying a plurality of computing jobs, each of the computing jobs comprising a plurality of computing tasks, each of the computing tasks associated with event data to be processed by the observability pipeline system;

by operation of the leader role, dispatching the plurality of computing tasks to the plurality of worker roles according to a least in-flight task dispatch criterion, wherein dispatching the plurality of computing tasks according to the least in-flight task dispatch criterion comprises, iteratively:

identifying one of the plurality of worker roles as an available worker role;

identifying, from the plurality of computing jobs, one or more incomplete computing jobs comprising one or more computing tasks that have not been executed in the observability pipeline system;

selecting, from the one or more incomplete computing jobs, a computing job that has the least number of in-flight computing tasks currently being executed in the observability pipeline system;

identifying a next computing task from the selected computing job; and

dispatching the next computing task to the available worker role;

by operation of the worker roles in the observability pipeline system, executing the computing tasks dispatched to the respective worker roles, wherein executing each respective computing task comprises applying an observability pipeline process to the event data associated with the respective computing task.

20. The non-transitory computer-readable medium of claim 19 , wherein one or more of the computing jobs are data collection jobs, each of the data collection jobs comprises a plurality of data collection tasks, and the operations comprise:

receiving configuration information comprising event filter criteria for the data collection jobs; and

based on the event filter criteria, identifying a data payload comprising the some or all of the event data,

wherein executing each respective data collection task comprises:

communicating with an external data storage system to obtain a subset of filtered event data from the data payload, each subset of filtered event data comprising a respective portion of the event data;

streaming the subset of filtered event data to the observability pipeline process.