Github user nickwallen commented on the issue:
    I completed some fairly extensive performance testing comparing this new 
Unified topology against the existing Split-Join implementation.  The 
difference was dramatic. 
    - The Unified topology _performed roughly 3.4 times faster than Split-Join._
    Both topologies in this side-by-side test included the same fixes, 
including the Guava cache problem fixed in #947. The tests included two 
    * GeoIP enrichment; `geo := GEO_GET(ip_dst_addr)`
    * Compute-only Stellar enrichment; `local := IN_SUBNET(ip_dst_addr, 
    The number one driver of performance is the cache hit rate, which is 
heavily dependent on what your data looks-like.  With these enrichments, that's 
driven by how varied the `ip_dst_addr` is in the data.  
    I tested both of these topologies with different sets of data intended to 
either increase or decrease that cache hit rate.  The differences between the 
two topologies were fairly consistent across the different data sets. 
    When running these topologies, reasonably well-tuned, on the same data, I 
was able to consistently maintain 70,000 events per second with the Split/Join 
topology.  In the same environment, I was able to maintain 312,000 events per 
second using the Unified topology.  
    The raw throughput numbers are relative and depend on how much hardware you 
are willing to throw at the problem.  I was running on 3 nodes dedicated to 
running the Enrichment topology only.  But with the same data, on the same 
hardware, the difference was 3.4 times.  That's big.
    Pushing as much as you can into a single executor and avoiding network hops 
is definitely the way to go here.


Reply via email to