111 karma · joined October 11, 2016
This was not an issue of being in a vacuum, it was an issue of not reading documentation beforehand, which for some reason is acceptable in the development world
I don't think there are so many people attempting to perform surgery or to build a bridge without reading a number of textbooks on the topic.
And this is why back in the day everyone said RTFM
Usually when this happens is because the source uses what could be considered user input as keys, for example in access logs with stuff such as headers o query parameter, and you make a new field for each header or query parameter. In the latter case all you need to exhaust your available fields in the index is some nasty bot trying random query strings on your site. This can be easily solved in the ingest/logstash pipeline
It is true that you have to spend time to carefully map and process the documents you're ingesting in elasticsearch, but once you do I don't think there's any other solution with the same performance and features for logs, especially considering the licensed features (like alerting from anomaly detection machine learning jobs)
The elastic stack is complex and might be hard to grasp (their own training courses are a great help though), requires significant computing resources, and managing a big deployment can be a full time job, but once implemented correctly you can do awesome stuff with it.
Loki is a simpler and slower solution which does less things, so if you don't need what elastic provides, it could be a better fit as it's probably easier to manage
Taking also in account that that version of A/UX ran only on the quadra 700/800/950, it's probably one of the OS with less hardware support around
The OS itself was so simple, it didn't even use init scripts to start its services, but everything was (re)spawned by /etc/inittab like /bin/getty; this was so clever I started doing it with all the services I wanted to automatically restart on my other linux servers