Hadoop: What you need to know

Core Apache Hadoop

Core Hadoop is a software platform and framework for distributed computing of data. Hadoop is a platform in the sense that it is a long-running system that runs and executes computing tasks. Platforms make it easier for engineers to deploy applications and analytics because they don’t have to rebuild all of the infrastructure from scratch for every task. Hadoop is a framework in the sense that it provides a layer of abstraction to developers of data applications and data analytics that hides a lot of the intricacies of the system.

The core Apache Hadoop project is organized into three major components that provide a foundation for the rest of the ecosystem:

HDFS (Hadoop Distributed File System)

A filesystem that stores data across multiple computers (i.e., in a distributed manner); it is designed to be high throughput, resilient, and scalable

YARN (Yet Another Resource Negotiator)

A management framework for Hadoop resources; it keeps track of the CPU, RAM, and disk space being used, and tries to make sure processing runs smoothly

MapReduce

A generalized framework for processing and analyzing data in a distributed fashion

HDFS can manage and store large amounts of data over hundreds or thousands of individual computers. However, Hadoop allows you to both store lots of data and process lots of data with YARN and MapReduce, which is in stark contrast to traditional storage that just stores data (e.g., NetApp or EMC) or supercomputers that just compute things (e.g., Cray).

The Hadoop Ecosystem

The Hadoop ecosystem is a collection of tools and systems that run alongside of or on top of Hadoop. Running “alongside” Hadoop means the tool or system has a purpose outside of Hadoop, but Hadoop users can leverage it. Running “on top of” Hadoop means that the tool or system leverages core Hadoop and can’t work without it. Nobody maintains an official ecosystem list, and the ecosystem is constantly changing with new tools being adopted and old tools falling out of favor.

There are several Hadoop “distributions” (like there are Linux distributions) that bundle up core technologies into one supportable platform. Vendors such as Cloudera, Hortonworks, Pivotal, and MapR all have distributions. Each vendor provides different tools and services with their distributions, and the right vendor for your company depends on your particular use case and other needs.

A typical Hadoop “stack” consists of the Hadoop platform and framework, along with a selection of ecosystem tools chosen for a particular use case, running on top of a cluster of computers (Figure 1-1).

Hadoop and its ecosystem represent a new way of doing things, as we’ll look at next.

The Benefits of Schema-on-Read

Schema-on-read seems like a pretty basic idea but it is a drastic departure from the “right way” of doing things in relational databases. With it comes one fundamental and drastic benefit: the ability to easily load and keep the data in its original and raw form, which is the unmodified bytes coming out of your applications and systems. Why would you want to keep this around? At first glance you might not take data sources like these too seriously, but the power of keeping the original data around cannot be ignored as long as you can handle the work associated with processing it.

The NameNode Runs the Show and the DataNodes Do All the Work

HDFS is implemented as a “master and slave” architecture that is made up of a NameNode (the master) and one or more data nodes (the slaves). The data on each data node is managed by a program called a DataNode, and there is one DataNode program for each data node. There are other services like the Checkpoint node and NameNode standbys, but the two important players for understanding how HDFS works are the NameNode and the DataNode.

The NameNode does three major things: it knows where data is, it tells clients where to send data, and tells clients where to retrieve data from. A client is any program that connects to HDFS to interact with it in some way. Client code is embedded in MapReduce, custom applications, HBase, and anything else that uses HDFS. Behind the scenes, DataNodes do the heavy lifting of transferring data to clients and storing data on disk.

Transferring data to and from HDFS is a two-step process:

1. The client connects to the NameNode and asks which DataNode it can get the data from or where it should send the data.

2. The client then connects to the DataNode the NameNode indicated and receives or sends the data directly to the DataNode, without the NameNode’s involvement.

This is done in a fault-tolerant and scalable way. An example of the communication behind the scenes for a HDFS command is shown in Figure 1-6.

There are all kinds of things going on behind the scenes, but the major takeaway is that the NameNode is solely a coordinator. Large volumes of data are not being sent back and forth to the single NameNode; instead, the data is spread out across the several DataNodes. This approach makes throughput scalable to the point of the network bandwidth, not just the bandwidth of a single node.

The NameNode also keeps track of the number of copies of your data (covered in more detail in HDFS Stores Files in Three Places) and will tell DataNodes to make more copies if needed.

HDFS Stores Files in Three Places

By default, HDFS stores three copies of your files scattered across the cluster somewhat randomly. These are not backup copies; they are first-class files and can all be accessed by clients. As a user you’ll never notice that there are three copies. Even if some failure occurs and there are temporarily only two copies, you’ll never know because it is all handled behind the scenes by the NameNode and the DataNodes (Figure 1-6).

When the Google File System (GFS) paper was released, which HDFS was based on, most people were really confused about some of the choices made in the GFS, but over time they started making sense. Storing three copies of files is one of the curiosities that got attention. Why did Google decide to do that?

First, storing three copies of the data is really inefficient: 33% storage efficiency. For each three-terabyte hard drive you add to your system, you’re only able to store an additional one terabyte of data. When we are talking about tens of petabytes of data, that can get really expensive. There are numerous distributed storage approaches that store data in a redundant manner over multiple computers that achieve efficiencies upwards of 80%.

However, upon further examination there are benefits to the replication that outweigh the costs. First let’s look at network bandwidth and a concept called data locality. Data locality is the practice of processing data where it resides without transferring it over a network. We’ll talk about how important data locality is later on, but for now just be aware that it’s important.

Now, let’s contrast the way data is broken up and stored in GFS/HDFS versus traditional distributed storage systems. Traditional storage systems use data striping or parity bits to achieve high efficiency. With striping, a file is split up into alternating little pieces of data and moved onto separate storage devices. The chunking approach taken by HDFS, on the other hand, doesn’t split up the data in a fine-grained manner—instead, it chunks the data into contiguous blocks.

Traditional storage systems that use striping may be good at retrieving a single file with a high number of IOPS (input and output operations per second), but are fundamentally flawed for large-scale data analysis. Here is the problem: if you want to read a file that has been split out by striping and analyze the contents, you need to rematerialize the file from all of the different locations it resides in within the cluster, which requires network usage and makes data locality impossible. On the other hand, if you store the file in contiguous chunks but instead store three copies of it (how GFS/HDFS does it), when a client is ready to analyze the file, the file doesn’t need to be rematerialized; the processing can work on that one contiguous chunk in isolation. The client can analyze that file on the same computer on which the data resides without using the network to transfer data (data locality). Data locality dramatically reduces the strain on the network, and thus allows for more data processing–in other words, greater scalability. When MapReduce is processing thousands of files at once, this scalability greatly outweighs the price of storage density and high IOPS.

If you are set on storing a file as a single sequential chunk instead of in stripes (e.g., in HDFS), you need to store complete copies somewhere else in case that chunk gets lost in a failure. But why three copies? How about two? Or four? Three copies is empirically a sweet spot in two ways: fault tolerance and performance. The fault tolerance aspect is obvious: GFS/HDFS can lose two computers in short order and not only will the data not be lost, the NameNode will be able to command DataNode processes to replicate the remaining copy to get back up to three copies. The benefits to performance may not be as intuitive: with more copies, each piece of data is more available to clients since they can access any of the three copies. This smooths out hot spots (i.e., computers that are overwhelmed because they host files that are getting used a lot) by spreading the traffic for a single file over multiple computers. This is important when running multiple jobs over the same data at the same time. To answer the original question: two replicas is a bit too risky for most people and you may notice performance degradation; four replicas is really conservative and doesn’t improve performance enough to make it worthwhile.

Files in HDFS Can’t Be Edited

HDFS does a good job of storing large amounts of data over large numbers of computers, but in order to achieve its throughput potential and scalability, some functionality had to be sacrificed—namely the ability to edit files. Most first-time users of HDFS are disappointed that it can’t be used as a normal storage device (e.g., network-attached storage or a USB thumb drive), which would allow them to use first-class applications (even something like Microsoft Word) on data in HDFS. Instead, you are limited by the Hadoop commands and a programming interface. By sacrificing this feature, the designers of HDFS kept HDFS simple and good at what it needs to do.

Once you write a file, that’s it: the file will have that content until it gets deleted. This makes things easier for HDFS in a number of ways, but mostly it means that HDFS doesn’t need to make synchronized changes, which is pretty hard to do in a distributed system.

For all intents and purposes, a file in HDFS is the atomic building block of a data set, not the records inside the file. The implication of this is that you have to design your data ingest flow and your applications in a way that doesn’t edit files, but instead adds files to a folder. If the use case really requires editing records, check out the BigTable-based key/value stores HBase and Accumulo.

The NameNode Can Be HDFS’s Achilles’ Heel

With great power comes great responsibility. The NameNode is really important because it knows where everything is. Unfortunately, given its importance there are a number of ways it can fall short that you need to be aware of.

SPOF—it’s fun to say, but unfortunately it has been one of the major criticisms of Hadoop. SPOF stands for Single Point Of Failure and is a very bad thing to have in a distributed system. In traditional HDFS, the NameNode is a SPOF because if it fails or becomes unavailable, HDFS as a whole becomes unavailable. This does not mean that the data stored within HDFS has been lost, merely that it is unavailable for retrieval because it’s impossible to find out where it is. It’s like losing your phone book but phone numbers still work.

There are ways of reducing the chances of the NameNode becoming unavailable (referred to as implementing NameNode High Availability, or NameNode HA). However, the downside of doing that is added complexity, and when things break they are harder to fix. Eric Baldeschweiler, one of the fathers of Hadoop at Yahoo! and a founder of Hortonworks (a Hadoop vendor), told me that sometimes it doesn’t make sense to worry about configuring the NameNode for high availability, because using the regular NameNode configuration is simple to implement and easy to fix. It may break more often, but it takes far less time to fix when it does break. With enough metrics and monitoring, and a staff that has fixed NameNodes before, a recovery could take an order of minutes. It’s just a tradeoff you have to consider, but by no means think that NameNode HA is an absolute requirement for production clusters. However, significant engineering efforts are being applied to NameNode HA, and it gets easier and more reliable with every new Hadoop release.

Developers Don’t Need to Know Much About YARN

The best thing about YARN is that YARN does everything in the background and doesn’t require much interaction with Hadoop developers on a day-to-day basis to accomplish tasks. For the most part, developers work with the MapReduce APIs and other frameworks’ APIs—the resource negotiation is handled behind the scenes. The framework itself is interacting with YARN and asking for resources, and then utilizing them without requiring developers to do anything.

Usually the most time spent with YARN is when there is a problem of some sort (such as applications not getting enough resources or the cluster not being utilized enough). Fixing these problems falls within the responsibilities of the system administrator, not the developer.

YARN really pays off in the long run by making developers’ lives easier (which improves productivity) and by reducing the barrier of entry to Hadoop.

Map and Reduce Use the Notion of Shared Nothing

Unlike the other names you may have come across in Hadoop—e.g., Pig, Hive, ZooKeeper, and so on—MapReduce is actually describing a process: it stands for two major processing phases called “map” and “reduce” (surprise!). In a MapReduce job, the analytic developer writes custom code for the map phase and the reduce phase. Then, the Hadoop system takes that code and applies it to the data in a parallel and scalable way. The map phase performs record-by-record alterations by taking a close look at each record, but only that record. The reduce phase performs the higher-level groupings, counting, and summarizations on groups of records. The ability to customize code for the map and reduce phases is what gives Hadoop the flexibility to answer the questions that couldn’t be answered before. With both map and reduce, you can do just about anything with your data.

This section is going to dive into the technical weeds a bit deeper than the other portions of this report, but it describes a couple of really important points about what makes Hadoop and MapReduce different. Try not to get too held up if you don’t fully comprehend the technical details, just focus on understanding that MapReduce has advantage in linear scalability.

In programming, map typically means applying some function (such as absolute value or uppercase) to every element in a list, and then returning that series of outcomes as a list. See some examples of map outside of a Hadoop context in Example 1-3.

# apply the "abs" function (absolute value) to the list of numbers
map(abs, [1, -3, -5, 0, 4])
# returns [1, 3, 5, 0, 4]

# apply the uppercase function to the list of strings
map(lambda s: s.upper(), ['map', 'AND', 'Reduce'])
# returns ['MAP', 'AND', 'REDUCE']

There is something really interesting to note about map: the order in which map functions are applied doesn’t really matter. In the first example above, we could have applied the abs function to the third element in the list, then the first, then the second, then the fifth, then the fourth and the result would have been the same as if it was done in some other order.

Now, suppose you wanted to apply a map function to a list of a trillion integers (which on a single computer would take a long time, so it would help to split it across several computers). Since the order in which the items get applied doesn’t matter, you avoid one of the largest challenges in distributed systems: getting different computers to agree on when things are done and in what order. This concept in distributed systems is called shared nothing, which basically means that each node doing work is independent of the others and can do its job without sharing anything with the other data nodes.

The result is a very scalable system because you can add more data nodes without adding a lot of overhead. Shared nothing, along with data locality, provides a foundation for theoretically limitless linear scalability and is why MapReduce works so well.

So, the map phase of a MapReduce job is a shared nothing approach to processing data stored in HDFS. A MapReduce developer writes a piece of custom code that looks at one record at a time (the equivalent to abs or the lambda expression in Example 1-3) and MapReduce figures out how to run that code on every record in the data set. But unlike the map in Python from Example 1-3, MapReduce’s map is expected to output a key/value pair—essentially a set of linked data with the key being a unique identifier and the value being the data itself. Behind the scenes, the MapReduce framework will group together the pairs with the same key and send all of the values with the same key to the same reduce function.

Reduce in MapReduce takes results from the map phase, groups them together by key, and performs aggregation operations such as summations, counts, and averages over the key groups. The term reduce, like map, is a programming term that is used in several languages. The traditional reduce operation takes a function as a parameter (like map). But unlike map, the function takes two parameters instead of one. It applies the parameter function to the first two elements of the list, takes the result, then reapplies the function to that outcome with the next element—then reapplies the function to that outcome with the next element, and so on. See some examples outside of a Hadoop context in Example 1-4.

# sum the numbers using a function that adds two numbers
reduce(lambda x, y: x + y, [1, 2, 3, 3])
# returns 9

# find the largest number by using the +max+ function
reduce(max, [1, 2, 3, 3])
# returns 3

# concatenate the list of strings and add a space between each token
reduce(lambda x, y: x + ' ' + y, ['map', 'and', 'reduce'])
# returns 'map and reduce'

In Hadoop, reduce is a bit more general in how it does its job than its traditional counterpart seen in the Python examples, but the concept is the same: take a list of items and run some sort of processing over that list as a whole. Sometimes that means distilling down to a summation (like the max example), or just reformatting the list in a new form that isn’t really reducing the size of the output (like the string concatenation example).

To summarize how MapReduce works, here are the map and reduce functions explained without code. This summary uses the canonical example of MapReduce: “word count” (which you saw Java code for earlier in Example 1-1). This program goes through a corpus of text and counts the words seen in that text:

Map

• Take a line of text as input.

• Split up the text by whitespace (e.g., spaces, tabs, or newlines).

• Normalize each word (i.e., remove capitalization, punctuation, and if you are getting fancy spell checking or Porter stemming).

• Output each word as a key and the number one as a value, which means “we saw the word ‘Hadoop’ once.”

Reduce

• Take a key and a bunch of ones as input.

• Sum the ones to get the count for that word.

• Output the sum, which means “we saw the word ‘Hadoop’ X-number of times.”

There are a ton of other things going on behind the scenes that Hadoop is handling for you. Most notably, I skipped over how MapReduce gets data from the map functions to the reduce functions (which is called the “shuffle and sort”), but this is meant as a high-level introduction and you can find this information in either Hadoop: The Definitive Guide (Tom White, O’Reilly) or MapReduce Design Patterns (Donald Miner and Adam Shook, O’Reilly) if you think you’d like to know more. The main takeaway here is that MapReduce uses a shared nothing approach to achieve extreme scalability in computation. The tradeoff is that the analytic developer has to write their job in terms of map and reduce and can’t just write a general-purpose program. MapReduce knows how to parallelize map and reduce functions, but not anything else.

Data Locality is One of the Main Reasons Hadoop is Scalable

Shared nothing lets us scale compute well, but once you fix one bottleneck, you move on to the next one. In this case, the next bottleneck is the scalability of the network fabric in the cluster.

In many traditional data processing systems, storage (where the data is at rest) and compute (where the data gets processed) have been kept separate. In these systems, data would be moved over a very fast network to computers that would then process it. Moving data over a network is really expensive in terms of time, in comparison to, say…not going over the network at all. The alternative is to process the data in place, where it’s stored (which is referred to as data locality; see Figure 1-7).

Data locality seems like a really straightforward idea, but the concept of not moving data over the network and processing it in place is actually pretty novel. Hadoop was one of the first general-purpose and widely available systems that took that approach. It turns out that shipping the instructions for computation (i.e., a compiled program containing code for map and reduce functions, which is relatively small) over the network is much faster than shipping a petabyte of data to where the program is.

Data locality fundamentally removes the network as a bottleneck for linear scalability. Little programs are moved around to an arbitrarily large number of computers that each store their own data—and data, for the most part, doesn’t need to leave the computer it rests on. Together with shared nothing, there isn’t much left to prevent Hadoop from scaling to thousands or tens of thousands of nodes.

This is where we come full circle back to HDFS. HDFS is built to support MapReduce, and without some key design decisions MapReduce wouldn’t be able to achieve data locality. Namely, storing files as large contiguous chunks allows map tasks to process data from a single disk instead of having to pull from several disks or computers over the network. Also, because HDFS creates three replicas, it drastically increases the chances that a node will be available to host local computation, even if one or two of the replica nodes are busy with other tasks.

There Are Alternatives to MapReduce

MapReduce in many cases is not abstract enough for its users, which you may find funny since that is its entire point: to abstract away a number of the details in distributed computation. However, computer scientists love building abstractions on abstractions and were able to make MapReduce a lot easier to use with frameworks like Apache Crunch, Cascading, and Scalding (data pipeline-based computation tools that abstract the usage of map and reduce in MapReduce), and higher-level languages like Apache Pig (a dataflow language) and Apache Hive (a SQL-like language). In many cases, MapReduce can be considered the assembly language of MapReduce-based computation.

As with everything else, this abstraction comes at a cost, and masking too many details can be dangerous. In the worst case, code can get convoluted and performance may be affected. Sometimes using MapReduce code is the best way to achieve the needed control and power. However, be careful of the power user that wants to always do things in MapReduce…there is a time and place for the higher-level abstractions.

MapReduce is “Slow”

One recurring complaint with MapReduce is that it is slow. Well, what does slow mean?

First, MapReduce has a decent amount of spin-up time, meaning that it has a fixed time cost to do anything and that fixed cost is nontrivial. A MapReduce job that does very little other except load and write data might take upward of 30 to 45 seconds to execute. This latency makes it hard to do any sort of ad hoc or iterative analysis because waiting 45 seconds for every iteration becomes taxing on the developer. It also prevents the development of on-demand analytics that run in response to user actions.

Second, MapReduce writes and reads to disk a lot (upwards of seven times per MapReduce job) and interacting with disk is one of the most expensive operations a computer can do. Most of the writing to disk helps with fault tolerance at scale and helps avoid having to restart a MapReduce job if just a single computer dies (which is a downside of some of the more aggressive parallel computational approaches).

MapReduce works best when its jobs are scheduled to run periodically and have plenty of time, also known as running in batch. MapReduce is really good at batch because it has enormous potential for throughput and aggregating large amounts of data in a linearly scalable way. For example, it is common to once a day run collaborative filtering recommendation engines, build reports on logs, and train models. These use cases are appropriate for batch because they are over large amounts of data and the results only need to be updated now and then. But, batch is not the only thing people want to do.

Nowadays, there’s a lot of interest in real-time stream processing, which is fundamentally different from batch. One of the early free and open source solutions to real-time stream processing was Apache Storm, which was originally an internal system at Twitter. Other technologies that are used to do streaming include Spark Streaming (a microbatch approach to streaming that is part of the Spark platform), and Apache Samza (a streaming framework built on top of Apache Kafka). Storm and the other streaming technologies are good at processing data in motion in a scalable and robust way, so when used in conjunction with MapReduce, they can cover the batch-induced blind spot.

So why not do everything in a streaming fashion if it handles real time? The streaming paradigm has issues storing long-term state or doing aggregations over large amounts of data. Put plainly, it’s bad at things batch is good at, which is why the two technologies are so complementary. The combination of streaming and batch (particularly MapReduce and Storm) is the foundation for an architectural pattern called the Lambda Architecture, which is a two-pronged approach where you pass the same data through a batch system and a streaming system. The streaming system handles the most recent data for keeping real-time applications happy, while the batch system periodically goes through and gets accurate results on long-term aggregations. You can read more about it at http://lambda-architecture.net.

Fundamentally, the frameworks we mentioned in the past section (Pig, Hive, Crunch, Scalding, and Cascading) are built on MapReduce and have the same limitations as MapReduce. There have been a couple of free and open source approaches for alternative execution engines that are better suited for interactive ad hoc analysis while also being higher level. Cloudera’s Impala was one of the first of these and implements SQL through a Massively Parallel Processing (MPP) approach to data processing, which has been used by numerous proprietary distributed databases in the past decade (Greenplum, Netezza, Teradata, and many more). Apache Tez is an incremental improvement to generalize how MapReduce passes between phases of MapReduce. Spark uses memory intelligently so that iterative analytics run much faster without much downside over MapReduce. These are just some of the frameworks getting the most attention.

The thing to take away from this conversation is that MapReduce is the 18-wheeler truck hauling data across the country: it has impressive and scalable throughput in delivering large batches. It’s not going to win in a quarter-mile race against a race car (the Impalas and Sparks of the world), but in the long haul it can get a lot of work done. Sometimes it makes sense to own both a 18-wheeler and a race car so that you can handle both situations well, but don’t be fooled into thinking that MapReduce can be easily overtaken by something “faster.”