Building Service Topology at Scale: Architecture, Challenges, and Lessons Learned (opens in new tab)
The post explains how Netflix built a real-time service topology system capable of processing millions of network-flow records per second at production scale. Its core design combines streaming ingestion, reactive backpressure, physically separate data layers, and a distributed aggregation pipeline that resolves network intermediaries into meaningful service dependencies. The system favors slightly delayed but complete updates over stale batch data or incomplete results caused by dropping records. ## The Need for Real-Time Topology - Traditional topology tools rely on hourly or daily batch processing, making their data outdated during incidents. - Netflix combines: - eBPF network flows - IPC metrics delivered through Server-Sent Events - Distributed tracing data - These sources are stored in separate graph or columnar storage layers and can be queried independently or merged. - The goal is near-real-time freshness, faster incident response, blast-radius analysis, and immediate change validation. ## Backpressure for Reliable Streaming - Processing millions of flow records per second creates a risk that downstream systems will become overwhelmed. - Common alternatives are inadequate: - Unbounded queues eventually exhaust memory. - Dropping records produces incomplete topology. - Batch processing introduces unacceptable delays. - Reactive streams propagate slowdown upstream: - A graph database signals Stage 2. - Stage 2 slows Stage 1. - Stage 1 pauses Kafka consumption. - Kafka retains the data until capacity returns. - This allows the system to degrade gracefully during traffic spikes, garbage-collection pauses, or temporary storage slowdowns. - Updates may be delayed by seconds or minutes, but the data remains substantially more complete than a dropped or hourly-processed stream. ## Physically Separate Topology Layers Netflix keeps each data source in storage optimized for its characteristics: - **Network layer:** eBPF flow logs provide broad coverage but limited application context. - **IPC layer:** Application metrics offer detailed endpoint information but cover only instrumented services. - **Tracing layer:** Parquet-based distributed traces show actual request paths but are sampled. - Separate storage enables each layer to evolve and scale independently. - Queries can run in parallel and merge results while preserving sub-second response times. ## Three-Stage Distributed Aggregation The network layer uses a distributed pipeline to transform individual network hops into logical service dependencies. - Cloud traffic commonly passes through load balancers, NAT gateways, API gateways, and proxies. - Flow logs therefore show relationships such as: - `App A → Load Balancer` - `Load Balancer → App B` - The useful topology must infer the logical dependency: `App A → App B`. ### Stage 1: Initial Flow Aggregation - Consumes flow logs from Kafka across four regions. - Filters invalid records. - Groups data into five-minute windows. - Creates initial aggregators for each window. - Uses consistent hashing to distribute aggregators. - Streams the results to Stage 2 through SSE. ### Stage 2: Intermediary Resolution - Receives the initial aggregators from Stage 1. - Groups flows by intermediary components. - Resolves multi-hop network paths into application-level relationships. - This prevents infrastructure components from dominating the resulting service graph. ## Engineering Trade-offs - Streaming provides much fresher data than batch processing but introduces greater operational and conceptual complexity. - Backpressure is essential for stability at Netflix’s scale, even though reactive pipelines are harder to reason about than synchronous systems. - The architecture prioritizes reliable, complete topology updates over perfectly immediate processing. - Production behavior differed substantially from local testing: consumers lagged, memory was exhausted, traffic became unevenly distributed, and garbage collection consumed significant resources. Netflix’s approach demonstrates that large-scale real-time topology requires streaming ingestion, end-to-end backpressure, specialized storage, and staged aggregation. For similar distributed systems, the practical recommendation is to design explicitly for overload and partial slowdown rather than relying on unbounded buffering, dropped data, or stale batch snapshots.