Introduction
Slung is a high-performance time series data platform built in Zig, designed for real-time data ingestion, storage, and query processing. The architecture combines an in-memory cache with disk-backed TSM tree storage, a real-time query engine, and extensible WASM workflow execution.Core Components
Server Architecture
The main server (src/main.zig:26-308) implements a WebSocket-based ingestion system:
- WebSocket Server: Listens on port 2077 for binary time series data
- HTTP Routes:
/(WebSocket upgrade),/health(health check) - Concurrent Processing: Uses the
zioruntime for async I/O with configurable channel capacity (8192 * 2 events)
Data Flow
-
Ingestion: Binary messages arrive via WebSocket in format:
- Series Key Resolution: Tags are hashed and interned for efficient lookups (main.zig:107-138)
-
Storage: Data flows through:
- Write-optimized in-memory cache (skiplist-based)
- Automatic flush to disk when cache exceeds 1M data points
- TSM tree disk entries with columnar storage
-
Query Processing: Real-time queries match against:
- Active series by measurement
- Tag filters (AND/OR/NOT operations)
- Time ranges with relative time support
Component Interactions
Series Indexing
Slung maintains multiple indexes for efficient query routing:- Series Key Cache: Interned strings to reduce memory overhead
- Series by Measurement: Fast lookup of all series for a given measurement
- Series by Measurement+Tag: Enables tag-based filtering
- Hash-based Deduplication: Detects series key collisions (main.zig:117-137)
Query Engine
The query engine (src/query.zig) implements a DSL with syntax:
- AVG, MIN, MAX, SUM, COUNT: Aggregation operations
- Tag Filters:
[region=us AND NOT muted] - Time Ranges:
[1m,now],[1700000000,1700000100]
- Hot Path: In-memory cache for recent data
- Cold Path: Disk entries with Bloom filter optimization
Storage Architecture
See TSM Tree for detailed storage layer architecture.Workflow System
Slung embeds a WASM runtime (zware) that exposes host functions for:
- u_query_live: Register persistent queries that receive updates
- u_query_history: Execute aggregation queries over historical data
- u_write_event: Inject new time series data from workflows
- u_writeback_http: Send HTTP requests from WASM
- u_writeback_ws: Send WebSocket messages to clients
Performance Characteristics
Memory Management
- Debug Mode: Uses
DebugAllocatorfor leak detection - Release Mode: 2GB fixed buffer allocator for zero-allocation operations
Concurrency
- Lock-free atomic operations for connection/query ID generation
- Mutex-protected shared state for query events and connections
- Channel-based message passing between ingestion and processing
Data Encoding
Slung uses two encoding strategies (configurable):- Delta Encoding: Zigzag varint delta encoding for faster queries
- Gorilla Encoding: Delta-of-delta + XOR compression for better compression ratios
Configuration
Build-Time Configuration
TSM tree parameters are compile-time constants:Runtime Configuration
- Channel Capacity: 16,384 events (CHANNEL_CAPACITY = 8192 * 2)
- Cache Flush Threshold: 1,000,000 data points (MAX_CACHE_POINTS)
- Max Concurrent Queries: 16 per server instance
Next Steps
Data Model
Understand series, tags, timestamps, and values
TSM Tree Storage
Deep dive into storage architecture and compression
WASM Workflows
Build real-time data processing workflows