Skip to content

Conversation

@tvernum
Copy link
Contributor

@tvernum tvernum commented Dec 31, 2020

This change substantially reduces the CPU and Heap usage of
StringMatcher when processing large complex patterns.

The improvement is achieved by switching the order in which we
perform concatenation and union for common styles of wildcard patterns.

Given a set of wildcard strings:

  • "*-logs-*"
  • "*-metrics-*"
  • "web-*-prod-*"
  • "web-*-staging-*"

The old implementation would perform steps roughly like:

minimize {
    union {
        concatenate { MATCH_ANY, "-logs-", MATCH_ANY }
        concatenate { MATCH_ANY, "-metrics-", MATCH_ANY }
        concatenate { "web-", MATCH_ANY, "prod-", MATCH_ANY }
        concatenate { "web-", MATCH_ANY, "staging-", MATCH_ANY }
    }
}

The outer minimize would require determinizing the automaton, which
was highly inefficient

The new implementation is:

minimize {
    union {
        concatenate {
            MATCH_ANY ,
            minimize {
                union { "-logs-", "-metrics"- }
            }
            MATCH_ANY
        }
        concatenate {
            minimize {
                union {
                    concatenate { "web-", MATCH_ANY, "prod-" }
                    concatenate { "web-", MATCH_ANY, "staging-" }
                }
            }
            MATCH_ANY
        }
    }
}

By performing a union of the inner strings before concatenating the
MATCH_ANY ("*") the time & heap space spent on determinizing the
automaton is greatly reduced.

Backport of: #66724

This change substantially reduces the CPU and Heap usage of
StringMatcher when processing large complex patterns.

The improvement is achieved by switching the order in which we
perform concatenation and union for common styles of wildcard patterns.

Given a set of wildcard strings:
- "*-logs-*"
- "*-metrics-*"
- "web-*-prod-*"
- "web-*-staging-*"

The old implementation would perform steps roughly like:

    minimize {
        union {
            concatenate { MATCH_ANY, "-logs-", MATCH_ANY }
            concatenate { MATCH_ANY, "-metrics-", MATCH_ANY }
            concatenate { "web-", MATCH_ANY, "prod-", MATCH_ANY }
            concatenate { "web-", MATCH_ANY, "staging-", MATCH_ANY }
        }
    }

The outer minimize would require determinizing the automaton, which
was highly inefficient

The new implementation is:

    minimize {
        union {
            concatenate {
                MATCH_ANY ,
                minimize {
                    union { "-logs-", "-metrics"- }
                }
                MATCH_ANY
            }
            concatenate {
                minimize {
                    union {
                        concatenate { "web-", MATCH_ANY, "prod-" }
                        concatenate { "web-", MATCH_ANY, "staging-" }
                    }
                }
                MATCH_ANY
            }
        }
    }

By performing a union of the inner strings before concatenating the
MATCH_ANY ("*") the time & heap space spent on determinizing the
automaton is greatly reduced.

Backport of: elastic#66724
@tvernum tvernum merged commit 5dfaae8 into elastic:7.x Dec 31, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant