Data Pipelines

5 posts

datadog3 min readCurated summary

How we measure data completeness at scale

Datadog built a real-time data-completeness system to ensure that every customer’s telemetry is available for dashboards, alerts, queries, and AI-driven decisions. Because ingestion spans hundreds of distributed paths and customers may send delayed or retried data, global or watermark-based tracking is unreliable. The system instead tracks payloads segment by segment, using idempotent create and acknowledgment events to identify losses and calculate end-to-end completeness. ## Defining Completeness at Datadog’s Scale - Completeness means every ingested payload—metrics, logs, spans, or other telemetry—is ultimately available to customers. - The system must measure completeness: - Across hundreds of services and ingestion paths - For each individual customer - In real time - With enough detail to identify where degradation occurred - Customer traffic may take different routes because of partitioning, isolation, and traffic patterns. - Metrics and APM pipelines can each involve hundreds or tens of distinct paths, creating a large number of possible failure points. - The completeness system must remain independent of the services it monitors so it can provide trustworthy diagnostics during incidents. ## Tracking Completeness by Pipeline Segment - Datadog considered watermark-based tracking, but delayed customer data, replayed traffic, and pipeline loops made predictable watermarks impractical. - Pipelines are divided into segments representing steps within or between services. - For example, intake-in to intake-out is one segment. - Intake-out to processing-in is another. - Each segment is measured independently, allowing engineers to locate degradation within a service or between services. - Segment-level tracking also adapts to pipelines whose branches appear or disappear over time. ## Counting Creates and Acknowledgments - When a payload enters a segment, the system records a create event. - When it exits, the system records an acknowledgment using the payload’s unique identifier. - Comparing creates with acknowledgments reveals whether payloads were lost in that segment. - Events are organized into time buckets based on when the payload first entered Datadog, using a Datadog-controlled timestamp rather than the customer’s clock. - Each identifier has a state per segment: - Created - Acknowledged - Acknowledged before the create event arrived - Duplicate create or acknowledgment events are ignored, making the system idempotent despite retries and event reordering. ## Calculating End-to-End Completeness - Segment completeness is the ratio of payloads exiting a segment to those entering it. - For sequential services, overall completeness is calculated by multiplying segment ratios. - Parallel branches require a different approach: - Treating branches as one pipeline would make completeness wait for the slowest branch. - Instead, Datadog uses a weighted average, giving each branch influence proportional to the volume it processes. - In the example, one branch reaches 94% completeness by multiplying 98% and 96% across two sequential services, while another branch reaches 100%. - Combining these branch measurements produces a more accurate view of currently available data without incorrectly marking all data incomplete because one branch is slower. ## Practical Conclusion Segment-level, identifier-based tracking gives Datadog a real-time and customer-specific view of data completeness. It both supports reliable end-to-end calculations and helps humans or automated systems quickly determine where ingestion problems are occurring.

Read original(opens in new tab)
netflix3 min readCurated summary

The Data Canary: How Netflix Validates Catalog Metadata

Netflix built an automated “data canary” system to validate catalog metadata changes with real production traffic. The system compares a new catalog version against a known-good baseline, detects customer-impacting regressions in under 10 minutes, and blocks corrupted data before it reaches most members. The effort treats data deployments with the same rigor traditionally applied to code deployments. ## Why Catalog Data Needs Canarying - Catalog metadata defines available titles, artwork, playback eligibility, and regional availability. - A previous incident corrupted a feed without any code or configuration change. - The resulting empty data for some titles prevented manifest generation and caused playback failures. - Existing code canaries detected nothing because the failure occurred in transformed data, not application code. - Validating individual upstream feeds was insufficient because corruption could emerge during final transformation. ## Challenges of Fast, Production-Level Validation - Data cycles occur frequently, leaving only one cycle to detect problems and block publication. - Traditional canary analysis requires 30–60 minutes to reach statistical confidence. - Shadow traffic could replay catalog requests but could not reproduce the full playback lifecycle across services. - Real production traffic was necessary to expose actual customer impact. - The system also needed to contain regressions so that validation itself did not create a large outage. ## The Data Canary Orchestrator - Netflix created a dedicated canary environment with: - An orchestrator instance coordinating validation. - A permanent baseline cluster serving the latest production catalog. - A canary cluster receiving the new catalog version. - Before testing, the orchestrator verifies that both clusters are healthy and version-synchronized. - It then triggers a chaos experiment that compares customer behavior across the two versions. - Results are returned to the transformer through a generic REST endpoint, allowing other data sources to adopt the pattern without transformer-specific changes. ## Extending the Chaos Platform - Experiment thresholds were customized to meet the 10-minute detection requirement. - Separate tests were run for major client types because they have different traffic patterns and dependencies. - Playback traffic was especially effective at revealing failures. - Sticky canaries used session affinity to keep each user on either the baseline or canary cluster, enabling a clean comparison. - Starts Per Second (SPS) became the primary metric because it measures successful playback attempts more directly than latency or catalog-service error rates. - Metrics are streamed in real time, and experiments abort immediately when a regression appears. - This prioritizes rapid protection over maximum statistical confidence, which is appropriate given the strong customer-impact signal. ## Production-Hardened Reliability - The orchestrator resumes polling experiments after restarts instead of abandoning active validation cycles. - Leader election prevents multiple orchestrator instances from triggering duplicate experiments during deployment. - Version tracking ensures baseline and canary clusters are aligned across tenants with different data-consumption schedules. ## Controlled Failure Injection - Netflix validated the validator by deliberately corrupting catalog data. - Tests included denylisting prominent titles and simulating realistic data-corruption scenarios. - These experiments demonstrated whether the canary could identify meaningful playback regressions before corrupted metadata was broadly released. Netflix’s approach shows that high-velocity data pipelines require deployment safeguards distinct from code canaries. Teams managing critical data should validate final transformed outputs with representative production traffic, use direct business-impact metrics, and automatically stop publication when regressions appear.

Read original(opens in new tab)
netflix3 min readCurated summary

Scaling Global Storytelling: Modernizing Localization Analytics at Netflix

Netflix is modernizing its localization analytics to support more than 300 million members across 190+ countries and 50+ languages. Rapid growth created duplicated pipelines, inconsistent business logic, and siloed dashboards, making basic questions such as who produced a dub difficult to answer reliably. The company’s solution is to consolidate data foundations, improve usability, and centralize reusable business logic. ## The Challenge of Fragmented Localization Data - Localization metrics were historically built independently across different teams and workflows. - Determining who created a dub or subtitle required combining multiple sources with complex, frequently changing rules. - Duplicated logic led to: - Inconsistent reporting across tools - High maintenance costs when upstream systems changed - Siloed analytics and dashboards ## Auditing and Consolidating Analytics - Netflix audited more than 40 dashboards and tools for usage, quality, and code health. - The focus shifted from repeatedly fixing frontend visualizations to consolidating backend data pipelines. - Three legacy dashboards covering dubbing-partner operations, capacity, and finances are being unified around a shared data and backend layer. - This foundation can support multiple future frontend experiences instead of forcing each dashboard to maintain separate logic. ## Reducing User Experience Debt - Netflix defines “Not-So-Tech Debt” as stakeholder friction caused by confusing tools or weak analytical storytelling. - The Language Asset Consumption tool was redesigned to combine audio and text languages into a single consumption-language view. - This distinguishes: - Original-language viewing from localized consumption - Subtitle, dubbing, or combined preferences - Recurring member preferences for a given language - The result is more intuitive analysis aligned with real stakeholder questions. ## Centralizing Reusable Business Logic - Netflix is adopting a “write once, read many” architecture. - Shared tables, including a Language Asset Producer table, solve common questions in one centralized location. - The same trusted data can feed downstream domains such as Dub Quality and Translation Quality. - Updates to business rules propagate across the analytics ecosystem instead of requiring changes in multiple pipelines. ## Moving Toward Event-Level Analytics - Future work will analyze individual timed-text events rather than only complete language assets. - A generic model will capture details such as individual subtitle lines and reading speed. - Netflix plans to connect subtitle characteristics with member engagement. - These findings can improve style guidelines for subtitle linguists and ultimately enhance the localized viewing experience. Netflix’s recommendation is to treat analytics modernization as both a technical and product-quality effort: consolidate data foundations, centralize business logic, and design tools around how stakeholders actually make decisions. This creates more trustworthy reporting while enabling deeper analysis of how localization affects member enjoyment.

Read original(opens in new tab)
netflixOriginal article

100X Faster: How We Supercharged Netflix Maestro’s Workflow Engine | by Netflix Technology Blog | Netflix TechBlog (opens in new tab)

Netflix has significantly optimized Maestro, its horizontally scalable workflow orchestrator, to meet the evolving demands of low-latency use cases like live events, advertising, and gaming. By redesigning the core engine to transition from a polling-based architecture to a high-performance event-driven model, the team achieved a 100x increase in speed. This evolution reduced workflow overhead from several seconds to mere milliseconds, drastically improving developer productivity and system efficiency. ### Limitations of the Legacy Architecture The original Maestro architecture was built on a three-layer system that, while scalable, introduced significant latency during execution. * **Polling Latency:** The internal flow engine relied on calling execution functions at set intervals, creating a "speedbump" where tasks waited seconds to be picked up by workers. * **Execution Overhead:** The process of translating complex workflow graphs into parallel flows and sequentially chained tasks added internal processing time that hindered sub-hourly and ad-hoc workloads. * **Concurrency Issues:** A lack of strong guarantees from the internal flow engine occasionally led to race conditions, where a single step might be executed by multiple workers simultaneously. ### Transitioning to an Event-Driven Engine To support the highest level of user needs, Netflix replaced the traditional flow engine with a custom, high-performance execution model. * **Direct Dispatching:** The engine moved away from periodic polling in favor of an event-driven mechanism that triggers state transitions instantly. * **State Machine Optimization:** The new design manages the lifecycle of workflows and steps through a more streamlined state machine, ensuring faster transitions between "start," "restart," "stop," and "pause" actions. * **Reduced Data Latency:** The team optimized data access patterns for internal state storage, reducing the time required to write Maestro data to the database during high-volume executions. ### Scalability and Functional Improvements The redesign not only improved speed but also strengthened the engine's ability to handle massive, complex data pipelines. * **Isolation Layers:** The engine maintains strict isolation between the Maestro step runtime (integrated with Spark and Trino) and the underlying execution logic. * **Support for Heterogeneous Workflows:** The supercharged engine continues to support massive workflows with hundreds of thousands of jobs while providing the low latency required for iterative development cycles. * **Reliability Guarantees:** By moving to a more robust internal event bus, the system eliminated the race conditions found in the previous distributed job queue implementation. For organizations managing large-scale Data or ML workflows, moving toward an event-driven orchestration model is essential for supporting sub-hourly execution and low-latency ad-hoc queries. These performance improvements are now available in the Maestro open-source project for wider community adoption.

datadog3 min readCurated summary

Building highly reliable data pipelines at Datadog

Datadog’s approach to reliable data pipelines focuses on delivering correct data on time, even when individual jobs fail. Reliability therefore requires fault tolerance, monitoring, and fast recovery rather than eliminating every failure. The company achieves this through isolated, short-lived clusters and pipelines designed to limit the impact of failures. ## Reliability Means Timely, Correct Results - A reliable pipeline is one that consistently produces correct outputs within the required time window. - Occasional crashes do not necessarily make a pipeline unreliable if automatic recovery still delivers the data on schedule. - Pipelines should be designed with the expectation that failures will eventually occur. - Monitoring must detect unexpected failures early, while operational processes should support rapid recovery. ## Architecture for Batch Pipelines - Datadog streams and analyzes live data in real time but uses batch pipelines for features such as optimized long-term storage. - Historical data is stored in object storage. - Cloud Hadoop/Spark services launch and configure processing clusters. - Luigi workers manage tasks and workflows, while Spark workers compile code and submit jobs. - Jobs can be launched through a web interface, command line, or scheduler. ## One Cluster per Pipeline Instead of placing all workloads on one large Hadoop cluster, Datadog gives each pipeline its own cluster. - **Isolation:** Jobs do not compete for resources or interfere with one another, simplifying monitoring and diagnosis. - **Workload-specific hardware:** Clusters can use CPU-optimized or memory-optimized instances depending on the job. - **Elastic scaling:** Clusters can be expanded to catch up with delays or handle growing data volumes without waiting for a shared cluster. - **Safer upgrades:** Hadoop and Spark versions can be upgraded gradually across separate clusters. - Clusters are typically short-lived, averaging about three hours, although dozens may run simultaneously. ## Using Spot Instances to Encourage Fault Tolerance - AWS spot instances can reduce infrastructure costs by as much as 80%, but their nodes may be terminated whenever capacity or demand changes. - Rather than avoiding this failure mode, Datadog designs pipelines to tolerate disappearing clusters. - Long-running jobs are risky because failures discard more work and make recovery slower. - Pipelines are split into smaller jobs: - **Vertically:** Separate transformations into multiple stages, persisting intermediate results in S3. - **Horizontally:** Partition input data so multiple jobs process different portions concurrently. ## Breaking Up the Rollup Pipeline - Datadog’s rollup pipeline generates aggregated time-series data for historical metrics queries. - A single job would take more than 14 hours, making failures costly and difficult to recover from. - The pipeline is divided into two stages: - Aggregate high-resolution data and checkpoint it to S3 as Parquet files. - Convert the intermediate data into a custom format optimized for queries. - As these jobs grew, they were partitioned further using Kafka’s partitioning scheme. - Kafka partitions are grouped into shards, allowing Datadog to: - Adjust how much data each job processes. - Run more or fewer jobs as needed. - Isolate unusually large or sensitive shards. - This decomposition adds overhead because launching jobs and checkpointing to S3 take extra time, but it substantially limits the work lost during failures. ## Practical Recommendation Design pipelines around failure rather than assuming uninterrupted execution. Use isolated, scalable clusters, short jobs, intermediate checkpoints, and partitioned processing so that failures affect only a small portion of the workload and recovery remains fast.

Read original(opens in new tab)