docs

Set up full stack observability

Set up log aggregation with Elastic and scale-out Prometheus with VictoriaMetrics

Setting the Stage

If you're actually going to use this infrastructure in earnest, you'll need some form of monitoring and observability. Plural integrates directly with several observability providers, but the easiest and cheapest way to get going quickly is to use our most streamlined setup, namely:

  • VictoriaMetrics - a scale-out, Prometheus-compatible time series datastore, with a feature-rich agent, vmagent. This gives you unified metrics observability
  • ELK stack - handles log aggregation and search, and integrates directly with the Plural Console. It also doubles as a vector store if you wish to use some of our advanced AI functionality.

We already have a few streamlined setups in our service catalog to do this. You'll want to go to Catalogs -> devops (you can do this with Cmd + K -> Catalog, or use the sidebar); from there you should see a page like this:

Go through the wizards for both elastic and prometheus-setup. When they ask you to select a cluster, be sure to choose a cluster which has an actual load balancer and externaldns configured, as both expose an HTTP API that needs to be externally queried.

We recommend deploying both to the same cluster for ease of maintenance; your workload clusters will likely have everything, or you can configure the mgmt cluster to support load balancing as well and deploy them there.

What this configures and confirm it's working

In total, these two PR Automations will deploy:

  • Elasticsearch Cluster - by default this will have three pods and whatever disk size you chose
  • VictoriaMetrics Cluster - similar to ES
  • VMAgent Global Service - deploys vmagent on all clusters managed by Plural, with auto-configuration to ship upstream to VictoriaMetrics
  • Logstash Global Service - deploys Filebeat + Logstash on all clusters managed by Plural, with auto-configuration to ship to Elasticsearch using appropriately scoped permissions

You should be able to use the Plural Kubernetes Dashboard to see all the pods configured, and confirm they're shipping to the upstream. If they're failing, you'll see clear HTTP errors in the logs explaining they either cannot connect or have incorrect credentials.

You should also see your bootstrap/settings.yaml file has been modified to register the new Elasticsearch and Prometheus connections. It'll have data like the following:

yaml
apiVersion: deployments.plural.sh/v1alpha1
kind: DeploymentSettings
metadata:
  name: global
  namespace: plrl-deploy-operator
spec:
  logging:
    driver: ELASTIC
    elastic:
      host: https://{your-elastic-fqdn}
      index: plrl-logs-*
      passwordSecretRef:
        key: password
        name: plrl-elastic-user
      user: plrl
    enabled: true
  
  prometheusConnection:
    host: https://{your-vmmetrics-fqdn}/select/0/prometheus
    passwordSecretRef:
      key: password
      name: basic-auth-prom
    user: plrl

  ai:
    vectorStore:
      enabled: true
      vectorStore: ELASTIC
      elastic:
        host: https://{your-elastic-fqdn}
        user: plrl
        index: plrl-ai-vectors
        passwordSecretRef:
          name: plrl-elastic-user
          key: password

This ensures the Plural Console can also query your newly created datastores, and the vector store integration enables our RAG workflows which can index incoming PRs, PagerDuty events, and other items for holistic AI root cause analysis of application failures.

Use Plural Metrics and Logging

With everything in place, you should start seeing both metrics data and log aggregations in the Plural UI. To see metrics data, navigate to a Deployment or StatefulSet component of a Plural Service, and you'll see a Metrics tab with graphs like:

To see a log aggregation, either navigate to a cluster or to an individual service, and find the Logs tab. You'll see a log aggregation view like:

And you can tune the log view with the filter modal like: