About Metrics

Stored vs. Not Stored

The architecture of Unryo is quite unique as it can work differently to fit your monitoring strategy.

Use Case	How Unryo works
You have existing observability tools	Unryo will connect to your observability tools (such as Prometheus, InfluxDB, Azure Monitor, VictoriaMetrics, Thanos, Cortex, Elastic...), and analyze key data from them to correlate and surface problems. In other words, Unryo acts as the correlation/AIOps engine on top of your existing monitoring stack to provide central visibility and in-context observability. Your data (metrics, logs, traces) stay in your existing tools and is not duplicated.
You don't have existing observability tools	Unryo works as an all-in-one observability platform, collecting all data directly from your devices and systems and sent to the Unryo Time-Serie database and log engine for storage.

The Time-Serie DB

To store metrics, Unryo uses a schemaless database. Designed for real-time analytics, high-speed data ingestion and fast queries, it stores data points into Measurements, Tags and Fields. Because Unryo receives metrics from many external data sources, it enriches them with metadata tags, so that they are aligned with a common data model. This data unification allows the upper engines - analytic, correlation, reporting - to efficiently process the information. The metric tagging is extensible and customizable, and customers can enrich metrics by adding their own dimensions to get better context.

Measurements, Tags and Fields

Time Series data points are written to the time-series database by collectors, that use a text-based format and a structure composed of measurement, tags and fields.

<measurement>,<tag_key>=<tag_value>[,<tag_key>=<tag_value>] <field_key>=<field_value>[,<field_key>=<field_value>] [<timestamp>]

The example below shows a data point for an NGINX server:

  nginx,                         <-- measurement
  resource=10.1.1.1,             <-- tag
  resource_type=Nginx Server,    <-- tag
  technology=Nginx,              <-- tag
  port=80,                       <-- tag
  <space>                        <-- separator
  accepts=605,                   <-- field
  active=2,                      <-- field
  requests=12132,                <-- field
  <space>                        <-- separator
  145669099470178433             <-- timestamp

Where:

• Measurement is a data structure that stores data over time. Typically, it stores fields that are meant to coexist together. You could think of a measurement as an 'SQL table'.
• Tags represent 'columns' where you could store data. The biggest difference between tags and fields is that tags are indexed, and fields are not. So, queries on tags are highly performant. Tags can be seen as metadata defining data in the measurement. They are hints giving additional information about data, but not data itself. For example, the region 'column' would be a tag.
• Fields, on the other hand, are literally data. For example, the temperature 'column' would be a field. The field value can be a string, float, integer, or boolean.
• Timestamp is a date and time defined in RFC3339 format.

Unryo Data Model

Unryo applies a common set of tags to data points, in order to provide a unified data model to simplify grouping, searching and filtering when querying data.

Those common tags are:

Tag	Description
resource	name of the resource
resource_type	type of the resource. Metadata associated with this tag is listed here.
technology	technology (or domain) of the resource. Metadata associated with this tag is listed here.
resource_parent	parent resource
resource_component	resource components (i.e. a component can be a network interface, a processor, ...)
resource_component_type	resource component type

In addition to those common tags, all points have an additional set of tags that are specific to their domain. For example, a Google VM resource has specific tags such as the project_id, the zone, etc.