How trip.com migrated from Elasticsearch and built a 50PB logging solution with ClickHouse

Trip.com built a centralized logging platform using Elasticsearch in 2012 to address challenges posed by decentralized logging systems. However, as data volume increased, they faced issues with cluster stability and high costs. In search of an alternative solution, they migrated their storage and query layer to ClickHouse due to its columnar storage, vectorized query execution, high compression rates, and insertion throughput. The migration involved creating a new table design, setting up a similar architecture as Elasticsearch with master nodes (ClickHouse-Keeper instances), multiple query nodes, and data nodes, customizing Kibana for ClickHouse integration, and developing Triplog for managing tables, users, and roles. After the migration, they achieved significant storage space savings, faster query performance, and reduced operational costs. As their platform grew to 20PB, they faced new challenges such as performance issues due to poorly written queries and poor index choices by users. To address these issues, they moved away from a single cluster approach, implemented virtual table partitioning for efficient routing of queries, and used Antlr4 SQL parsing for query optimization. They also started exploring ClickHouse Enterprise Service (via Alibaba Cloud) to handle their high peak usage more gracefully.