Hadoop has catch my attention recently when I was looking for a BI solution which can tell me application usage and trends through various angles over the years. It took me while to understand what exactly Hadoop is, how MapReduce complements it and how together they can help me in resolving problem of finding trends through unstructured and huge log files. I thought of putting this learning in simple terms to help others to get it with quickly. I have also presented this topic; recording is available at
http://www.anymeeting.com/tushar/EA55DC838847
What is Hadoop: It is a framework which allows processing of large data sets across cluster of computers (commodity hardware).
Hadoop includes three major sub-projects
Hadoop Common: It is a set of utilities to support Hadoop subprojects. It includes serialization, RPC and filesystem.
HDFS: It is a scalable, fault tolerant, high performance distributed filesystem
Hadoop MapReduce: Its a programming mode which supports parallel processing of large datasets
Hadoop Architecture:
Client data gets written at multiple datanodes as directed by masternode.
We specify the block size in Hadoop configuration file. The client data gets split into blocks of this size and distributed across the cluster of datanodes. We also specify the replication level. The block will be replicated at these number of datanodes to support failover.
HDFS itself does not claim faster lookup/access. It is for storing large files. The datastore systems built on top of it like Hbase stores the indexes of the files stored onto HDFS to search the data quickly. This is point of confusion
What is MapReduce: It is a simple programming model for processing highly distributed datasets using a large number of computers (nodes). The datasets can be filesystem (unstructured) or database (structured).
Map: It solves small subset of problem and pass the result to master node. The solution to the problem is same for every element of input parameter. The output is always a new list.
e.g. if you have list(2,4,5,6……n) and want square of each element, then map is Map(Square(2,4,5)) = (4,16,25). The important points is that function “square” can be applied to each element in the list. Hence you can pass the function square itself to computing node where it can be applied to small subset of entire list. The computing node already contains subset of i/p list (block) which is spread across the cluster of datanodes.
Reduce: This is a combiner. It collects o/p of each Map and reduces/combines it to provide the desired o/p. e.g. if you want a sum of all square of list (2,4,5…n) then multiple Maps completes squaring of sublist and pass the result to reducer. The reducer then append all Maps o/p and applies function sum to calculate desired o/p.
MapReduce in Hadoop

JobTracker (Master)
Split i/p and assigns to various map tasks
Schedules and monitors map tasks (heartbeat)
On completion schedules and reduce tasks
If any of datanode fails then it reschedules those tasks for re-execution where ever its replication block is available in a cluster
TaskTracker (Slave)
Execute map and reduce tasks
Handle partitioning of map o/p
Handle sorting and grouping of reducer i/p
WordCount example: This is a “hello world” program to explain MapReduce.
Suppose you have a text file “The quick brown fox. The fox ate the mouse. How now brown cow?” and you want to know how many times each word has repeated within a file.
The Hadoop configuration (MasterNode) will split this i/p file. Say it split it as three blocks spread onto three datanodes (computers).
1. the quick brown fox
2. the fox ate the mouse
3. how now brown cow
As shown in above figure the jobtracker, will ask three tasktrackers to run the map on these three blocks on respective datanode.
Please note the computing is happening where the data resides, this helps the faster processing. Its also possible that all i/p blocks available on single datanode and multiple maps runs in parallel on that datanode.
The JobTracker divided the big one task into three smaller tasks which can be completed quickly by running them in parallel.
So Map counts the each word and produces a new list [{the,1} {quick,1},{the,1}] etc. The “shuffle and sort” phase then partition the o/p of each map using hashing mechanism so that same word (‘the’) fall under same partition. The reducer then process these partition to count occurances of each word [{the,2}, {quick,1}] etc. The Reducer waits till all Map finishes their tasks and partition completes.
Map Phase:
Map tasks run in parallel
Shuffle and sort phase:
Map task o/p is partitioned by hashing o/p key
Number of partitions are equal to number of reducers
Partitioning ensures all key/value pairs sharing same key belong to same partition
The map partition is sorted by key to group all values for the same key
Reduce Phase:
Each partition is assigned to one reducer
Reducer also runs in parallel
No two reducers process the same intermediate key
Reducer gets all values for a given key at the same time
Advantage
Locality
Parallelism
Fault tolerance
Hadoop-streaming utility allows you to create and run map/reduce jobs with any exe /script as the mapper/reducer
Uses of Hadoop:
Building search index at Google, Amazon
Widely used for analyzing user logs, data warehousing and analytics
Used for large scale machine learning and data mining applications
Legacy data processing where it requires massive computational
How did Hadoop help solving my problem?
The following ecosystem diagram explains how the Hadoop and its other subprojects has helped me to solve my problem of analyzing huge log files.
