Append-Only Logging at 73 Million Rows: Trade-offs Measured with Apache Doris

About this session

Append-only storage simplifies high-throughput log ingestion, but business judgments about those logs can change after the data becomes immutable. Logiqum tested this tension on a live Apache Doris deployment ingesting real router, macOS, Windows and OTLP traffic, using a 73-million-row store to compare alternative designs for noise filtering and changing classifications. This session presents the measured write, query, storage and operational trade-offs of each approach, then explains how the team separated immutable facts from mutable decisions. Attendees will learn when append-only modeling is a practical advantage, when it shifts complexity downstream, and how to evaluate the trade-off with evidence.

Speaker

Ákos Zalaváry

Founder · Logiqum

Ákos Zalaváry is the founder of Logiqum and builds logrok, an AI-driven log intelligence platform for security-sensitive, air-gapped and regulated environments, with Apache Doris as its primary store. Before founding Logiqum he spent four years at One Identity owning product governance for the enterprise central log management stack — syslog-ng Premium Edition and syslog-ng Store Box — and, before that, fifteen years at Nokia on mobile core, IMS/TAS and cloud-native productization. He holds an M.Sc. in Electrical Engineering and Information Technology from the Budapest University of Technology and Economics and is based in Hungary.

LinkedIn ↗ · Ákos Zalaváry