# nguyentrongduc2005/log-monitoring-system architecture

> Architecture diagram of the GitHub repository nguyentrongduc2005/log-monitoring-system, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nguyentrongduc2005/log-monitoring-system
- Repository: https://github.com/nguyentrongduc2005/log-monitoring-system

## Overview

Log Monitoring System is a Spring Boot modular-monolith backend with a React dashboard: applications submit logs, which are authenticated, sanitized and queued for processing, then stored and exposed for search, live monitoring, alerting, anomaly detection and incident investigation. Other documented product areas include identity/access management, analytics, Prometheus-backed metric detection, and retention. The graph combines README architecture claims with the supplied ingestion, identity, alerting, incident and retention excerpts; wiring for unsampled modules is shown only where documented.

Main entry points: [`apps/backend/src/main/java/com/vdt/log_monitoring/modules/alerting/internal`](https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/alerting/internal) (Alerting), [`apps/backend/src/main/java/com/vdt/log_monitoring/modules/processing/internal`](https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/processing/internal) (Log Processing), [`apps/backend/src/main/java/com/vdt/log_monitoring/modules/ingestion/internal/LogIngestionService.java`](https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/ingestion/internal/LogIngestionService.java) (Ingestion Service), [`apps/backend/src/main/java/com/vdt/log_monitoring/modules/anomaly/internal`](https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/anomaly/internal) (Anomaly Detection)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ingest["Log Intake"]
  node_ingestion_api["Ingestion API"]
  node_ingestion["Ingestion Service"]
  node_raw_kafka["Raw Log Queue"]
end

subgraph group_observe["Processing & Analysis"]
  node_processing["Log Processing"]
  node_clickhouse[("ClickHouse Logs")]
  node_live_kafka["Live Log Queue"]
  node_search_analytics["Search & Analytics"]
  node_anomaly["Anomaly Detection"]
  node_prometheus["Prometheus"]
  node_anomaly_store[("Anomaly Reports")]
  node_anomaly_kafka["Anomaly Event Queue"]
end

subgraph group_response["Alerts & Incidents"]
  node_alerting["Alerting"]
  node_alert_store[("Alert & Rule Store")]
  node_telegram["Telegram"]
  node_websocket["WebSocket"]
  node_incidents["Incident Investigation"]
  node_ai["Incident AI"]
end

subgraph group_platform["Platform Services"]
  node_identity["Identity & Access"]
  node_redis[("Redis")]
  node_retention["Retention"]
end

node_apps(("External Applications"))
node_dashboard(("React Dashboard"))

node_apps -->|"submits logs"| node_ingestion_api
node_ingestion_api -->|"calls facade"| node_ingestion
node_ingestion -->|"verifies API key"| node_identity
node_ingestion -->|"checks idempotency"| node_redis
node_ingestion -->|"publishes raw logs"| node_raw_kafka
node_raw_kafka -->|"delivers logs"| node_processing
node_processing -->|"writes processed logs"| node_clickhouse
node_processing -->|"publishes live events"| node_live_kafka
node_processing -->|"sends critical events"| node_alerting
node_processing -->|"sends log signals"| node_anomaly
node_live_kafka -->|"streams logs"| node_websocket
node_dashboard -->|"subscribes"| node_websocket
node_dashboard -->|"searches logs"| node_search_analytics
node_search_analytics -->|"queries logs"| node_clickhouse
node_dashboard -->|"management requests"| node_identity
node_identity -->|"stores refresh tokens"| node_redis
node_anomaly -->|"queries metrics"| node_prometheus
node_anomaly -->|"stores reports"| node_anomaly_store
node_anomaly -->|"publishes detections"| node_anomaly_kafka
node_anomaly_kafka -->|"delivers detections"| node_alerting
node_alerting -->|"stores alerts and rules"| node_alert_store
node_alerting -->|"deduplicates alerts"| node_redis
node_alerting -->|"sends notifications"| node_telegram
node_alerting -->|"publishes alert events"| node_websocket
node_dashboard -->|"manages alert rules"| node_alerting
node_alerting -->|"starts investigations"| node_incidents
node_incidents -->|"requests analysis"| node_ai
node_ai -.->|"returns findings"| node_incidents
node_dashboard -->|"reviews incidents"| node_incidents
node_retention -->|"deletes expired logs"| node_clickhouse

click node_ingestion_api "https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/api/ingestion/LogIngestionController.java"
click node_ingestion "https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/ingestion/internal/LogIngestionService.java"
click node_identity "https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/identity/internal"
click node_processing "https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/processing/internal"
click node_search_analytics "https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/analytics/internal"
click node_anomaly "https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/anomaly/internal"
click node_alerting "https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/alerting/internal"
click node_websocket "https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/api/realtime/RealtimeWebSocketConfig.java"
click node_incidents "https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/incident/internal/incident/IncidentService.java"
click node_ai "https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/incident/internal/ai/IncidentAnomalyReportAiService.java"
click node_retention "https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/retention/internal/RetentionService.java"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_ingestion_api,node_ingestion,node_raw_kafka toneBlue
class node_processing,node_clickhouse,node_live_kafka,node_search_analytics,node_anomaly,node_prometheus,node_anomaly_store,node_anomaly_kafka toneAmber
class node_alerting,node_alert_store,node_telegram,node_websocket,node_incidents,node_ai toneMint
class node_identity,node_redis,node_retention toneRose
class node_apps,node_dashboard toneIndigo
```

## Components

### Log Intake

- [Ingestion API](https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/api/ingestion/LogIngestionController.java): `apps/backend/src/main/java/com/vdt/log_monitoring/api/ingestion/LogIngestionController.java`
- [Ingestion Service](https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/ingestion/internal/LogIngestionService.java): `apps/backend/src/main/java/com/vdt/log_monitoring/modules/ingestion/internal/LogIngestionService.java`
- **Raw Log Queue**

### Processing & Analysis

- [Log Processing](https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/processing/internal): `apps/backend/src/main/java/com/vdt/log_monitoring/modules/processing/internal`
- **ClickHouse Logs**
- **Live Log Queue**
- [Search & Analytics](https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/analytics/internal): `apps/backend/src/main/java/com/vdt/log_monitoring/modules/analytics/internal`
- [Anomaly Detection](https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/anomaly/internal): `apps/backend/src/main/java/com/vdt/log_monitoring/modules/anomaly/internal`
- **Prometheus**
- **Anomaly Reports**
- **Anomaly Event Queue**

### Alerts & Incidents

- [Alerting](https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/alerting/internal): `apps/backend/src/main/java/com/vdt/log_monitoring/modules/alerting/internal`
- **Alert & Rule Store**
- **Telegram**
- [WebSocket](https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/api/realtime/RealtimeWebSocketConfig.java): `apps/backend/src/main/java/com/vdt/log_monitoring/api/realtime/RealtimeWebSocketConfig.java`
- [Incident Investigation](https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/incident/internal/incident/IncidentService.java): `apps/backend/src/main/java/com/vdt/log_monitoring/modules/incident/internal/incident/IncidentService.java`
- [Incident AI](https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/incident/internal/ai/IncidentAnomalyReportAiService.java): `apps/backend/src/main/java/com/vdt/log_monitoring/modules/incident/internal/ai/IncidentAnomalyReportAiService.java`

### Platform Services

- [Identity & Access](https://github.com/nguyentrongduc2005/log-monitoring-system/tree/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/identity/internal): `apps/backend/src/main/java/com/vdt/log_monitoring/modules/identity/internal`
- **Redis**
- [Retention](https://github.com/nguyentrongduc2005/log-monitoring-system/blob/main/apps/backend/src/main/java/com/vdt/log_monitoring/modules/retention/internal/RetentionService.java): `apps/backend/src/main/java/com/vdt/log_monitoring/modules/retention/internal/RetentionService.java`

### Other components

- **External Applications**
- **React Dashboard**

## Connections

- External Applications → Ingestion API: submits logs
- Ingestion API → Ingestion Service: calls facade
- Ingestion Service → Identity & Access: verifies API key
- Ingestion Service → Redis: checks idempotency
- Ingestion Service → Raw Log Queue: publishes raw logs
- Raw Log Queue → Log Processing: delivers logs
- Log Processing → ClickHouse Logs: writes processed logs
- Log Processing → Live Log Queue: publishes live events
- Log Processing → Alerting: sends critical events
- Log Processing → Anomaly Detection: sends log signals
- Live Log Queue → WebSocket: streams logs
- React Dashboard → WebSocket: subscribes
- React Dashboard → Search & Analytics: searches logs
- Search & Analytics → ClickHouse Logs: queries logs
- React Dashboard → Identity & Access: management requests
- Identity & Access → Redis: stores refresh tokens
- Anomaly Detection → Prometheus: queries metrics
- Anomaly Detection → Anomaly Reports: stores reports
- Anomaly Detection → Anomaly Event Queue: publishes detections
- Anomaly Event Queue → Alerting: delivers detections
- Alerting → Alert & Rule Store: stores alerts and rules
- Alerting → Redis: deduplicates alerts
- Alerting → Telegram: sends notifications
- Alerting → WebSocket: publishes alert events
- React Dashboard → Alerting: manages alert rules
- Alerting → Incident Investigation: starts investigations
- Incident Investigation → Incident AI: requests analysis
- Incident AI → Incident Investigation: returns findings
- React Dashboard → Incident Investigation: reviews incidents
- Retention → ClickHouse Logs: deletes expired logs