I need to scan very large JSONL files efficiently and am considering a parallel grep-style approach over line-delimited text.
Would love to hear how you would design it.
- How many grep-like ops per file?
- Is it interactive or run by another process?
- Do you know which files ahead of time?
- Do you have any control over that file creation?
- Is the JSONL append only? Is the grep running while the file is modified?
- How large is very large? 100s of MB? Few GB? 100s of GB? Whether or not it fits in memory could change the approach.
- You’re using files, plural, would parallelizing at the file level (e.g. one thread per file) be enough?
- How many files and how often is that executed?
100s of GBs yes.
The question is, what will be your limiting factor: CPU or disk I/O? Parallel processing doesn’t do much good if the workers have to wait on the disk to deliver more data. I’d start with an async architecture, where the program can do its processing while it is waiting on more data.
One additinal trick is to compress your files before writing them to disk, using some kind of fast lightweight compression like parallel gzip (pigz command) or lzop. When parsing them, you will have smaller disk reads but higher CPU usage, which will give speed advantage if you have server-class CPU with lots of cache.
Yeh, JSON will compress well.
How large is very large? Would it be something that
jqcan’t do? Is it purely string search or JSON-tree search?Generally you would want to get file size, split it into ranges which can be read as valid UTF-8. Feed each range into reader thread. Can be inefficient for HDDs because each thread will try to access random location on disk forcing needle to jump back and forth. Also you’ll need reread ranges at split point with some positive and negative offset in case desired content got split. Things are getting much more complicated if you want JSON-tree grep. Branches may get split from parent nodes across multiple ranges.
If you’re writing a program, definitely multiple threads or processes that each scan a chunk of the file, which basically means seek to the start of the chunk, read lines into the scan code until you hit the end of the chunk. For jsonl each chunk will need an alignment step to not break the jsonl.
For command line trickery, maybe the file could be chunked up by running multiple dd instances with an offset parameter piped into grep. This has many synchronization issues and all the outputs should be captured separately then combined afterwards. I can’t think of a good way to align this method to line edges but maybe you can put some fancy regular expression magic into the grep step to ignore malformed json at the beginning and end and overlap the chunks?
Grep is fast already, maybe test the simple approach and see how long it takes.
Could u use an already parallelized solution like ripgrep? I think someone else also mentioned putting it in a database, that shouldnt be too bad either.
Bad idea. First, file is read sequentially, and you can’t parallelize this. Second,
grepis a bad solution for structured files. Better usejqor something similar.https://jsonltools.com/what-is-jsonl
First time hearing about it, but JSONL is like CSV with json per line. So not really structured.
I don’t see why you couldn’t just use grep on it.
Sorry, I missed that L, and I’ve never heard about JSONL before (although worked with JSON logs that are effectively JSONL). So, well, you may use
grep, however it can be inefficient (depends on regex engine and how good you are in regexes). It is also easy to make a mistake if you are not very proficient in regexes. So I’d prefer using JSON parser (jqor another, maybe lower level if performance matters) overgrepanyway.parsing will make it orders of magnitude slower
It will not if your parser is not overcomplicated and does not populate some huge structures with data. You only need to find tokens and compare them with field names and values you are looking for. Regexes are slower and don’t allow processing escaped characters correctly.
Read the JSONL into a real database like Postgres.
