Hi Jason, running extractors and writing their output into new fields of course will require some processing time but we try really hard to optimize these operations so that you shouldn't really see an performance impact unless you have 50* or more extractors on your input. You can always measure the actual impact by using the metrics Graylog is recording during runtime (see http://localhost:12900/system/metrics on one of your Graylog servers) if you're really curious about it.
*: Scientific Wild-Ass Guess Cheers, Jochen On Monday, 27 July 2015 02:58:14 UTC+2, Jason Haar wrote: > > Hi there > > I've been adding extractors to our incoming syslog Input and it's been > great - fantastic feature :-) > > However, I'm starting to get worried about the longer-term impact of me > going all hell-for-leather on this: how much of a performance impact does > adding new fields have? > > I've added about 10 new fields so far, and let's assume I'll add another > 10-20 in the next 6 months, what would that really mean from an overhead > perspective. Telling me to just accept the overhead is an acceptable answer > ;-) > > Jason > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
