I'm trying to better understand how helicone works underthe hood for curiosity. What exactly is the jawn service doing, is it just a kafka instance that is used to log to clickhouse?
Yes, workers push events to Kafka via HTTP since Cloudflare workers don't support TCP.
Events are pushed one at a time because each request arrives individually. We can't batch on the worker side because workers are serverless, and storing them in memory isn't feasible. Pushing them to Kafka immediately is more reliable; if a worker fails, we'd lose any stored events.
Kafka handles individual logs well, and we consume them in batches. This has significantly reduced our database load and stopped it from dying.