What is the difference between a push vs pull based monitoring system

Question

I am looking at Prometheus vs ElasticStack for monitoring and there seems to be a discussion regarding pull based and push based monitoring systems. However, though Prometheus is considered a pull based system and ElasticStack is considered a push based system, I can't see the issue. Though ElasticStack has agents that push to the central server, those agents in turn have to periodically pull from the applications to monitor. There is no way around that unless all applications had built-in support for ElasticStack and pushed their metrics on their own, without any agents. It seems to me that all monitoring systems have to be pull based in the end. What am I missing?

Answer 1

The main difference between push and pull for monitoring systems is how data is collected by the monitoring system.

For Push model, you are goin to be streaming data by pushing to a queue like Kafka directly from the system(VMs). From there, data is processed and stored/alerted on.

For Pull model, you rely on service discovery like etcd, zookeeper, etc to know the http endpoints to pull data from. The monitoring service periodically polls the endpoints for data which is subsequently processed and stored.

You can use both push and pull models for ELK and Prometheus.