How Netflix Maps Thousands of Microservices in Real-Time

2026-06-05 · Source: InfoQ · Field: Technology & Digital — Software Development & Engineering, Cloud Computing & IT Infrastructure, Data Science & Analytics · Depth: Advanced, short

Summary

Netflix has detailed its internal Service Topology system, designed to create and update a live dependency graph for thousands of microservices in real-time. This system unifies three distinct data sources—eBPF network flow logs, IPC metrics from instrumented services, and aggregated distributed traces—into a single, queryable graph. It addresses a long-standing engineering challenge of understanding service interdependencies and blast radii during incident resolution. A three-stage aggregation pipeline resolves raw network flows, collapsing multi-hop paths into direct application-to-application connections. The processing runs on Apache Pekko Streams and Kafka, with graph storage built on Netflix's distributed key-value system, offering a gRPC API with sub-second response times for multi-hop and filtered queries. Historical queries use time-window aggregation to correlate dependency changes with incidents without high storage costs.

Key takeaway

For MLOps Engineers or DevOps teams managing complex microservice architectures, understanding real-time service dependencies is critical for incident response. You should consider integrating diverse observability data sources like eBPF, IPC metrics, and traces into a unified, queryable service topology graph. This approach provides a clear blast radius analysis and accelerates root cause identification, preventing misdiagnoses from incomplete data. Prioritize sub-second query performance and historical analysis capabilities for effective operational insights.

Key insights

Unifying diverse data sources into a real-time, queryable service topology graph enhances incident resolution.

Principles

• Merge diverse data sources for comprehensive views.
• Incomplete data is worse than no data.
• Real-time maps are crucial for dynamic environments.

Method

Ingest eBPF, IPC metrics, and traces; aggregate multi-hop flows into direct edges; store in a graph database for fast, multi-hop queries.

In practice

• Use eBPF for uninstrumented service visibility.
• Implement time-window aggregation for historical views.
• Design for sub-second query response times.

Topics

• Microservices
• Service Topology
• Real-time Observability
• eBPF
• Graph Databases
• Incident Management

Best for: CTO, VP of Engineering/Data, DevOps Engineer, Software Engineer, MLOps Engineer

Related on AIssential

• TopoEvo: A Topology-Aware Self-Evolving Multi-Agent Framework for Root Cause Analysis in Microservices — Topology-aware, self-evolving multi-agent frameworks improve microservice root cause analysis by integrating multimodal data and structured reasoning.
• Monitoring & Observability in Microsoft Foundry — Production AI requires continuous, integrated observability beyond traditional APM to manage dynamic behavior and ensure quality, safety, and cost.
• Netflix Introduces ‘Model Lifecycle Graph’ to Scale Enterprise Machine Learning — Graph-based architectures can effectively manage complex ML system dependencies and improve discoverability at enterprise scale.
• GitHub Uses eBPF to Eliminate Deployment Risks and Prevent Circular Failures — eBPF enables kernel-level network control to prevent circular deployment dependencies and enhance system resilience.
• Using observability data to prevent incidents — Proactive reliability intelligence, enabled by rapid data access, prevents incidents by identifying risk trends before they manifest.
• Observability and human intuition in an AI world — Observability platforms and AI-driven incident resolution tools enhance debugging and operational efficiency.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by InfoQ.