On Fri, Aug 21, 2015 at 1:22 PM, Rainer Gerhards <[email protected]> wrote:
> 2015-08-21 12:19 GMT+02:00 Otis Gospodnetić <[email protected]>: > > Hi, > > > > This sounds like something that should be om-specific. What Radu is > > suggesting would definitely help with ES, but may not be relevant for > other > > output targets. > > What I think is overlooked here is the ES side - more specifically ES and > > searches that ES has to handle. If we don't care about maxing out ES and > > just pushing data in it as fast as it arrives, then how > > rsyslog/omelasticsearch works today makes sense. But this approach if > > focused on ingestion and ignores how this can hurt ES's ability to handle > > queries in a timely manner. Exposing controls Radu suggested would help > > people avoid this problem. I know David would like to see numbers :) I > > love numbers, too, but I'm not sure if we'll have the time to provide > them > > :( That said, we work with ES 24/7 and have been doing that for years > > (many hundreds of ES deployments under our belt by now), so I am hoping > > somebody will trust us this option would be great to have in > > omelasticsearch. :) > > Not reading the full thread, I, too, think this makes sense. It would > need to go into the queue engine, as this is the only place where it > can decently be done. Done properly, it should not hurt performance > for other cases. But it needs careful implementation. I suggest to > open a gitub issue tracker, so that I can remember when I have time > later this year (probably November+). > Thanks, Rainer! I've opened an issue here: https://github.com/rsyslog/rsyslog/issues/495 Best regards, Radu -- Performance Monitoring * Log Analytics * Search Analytics Solr & Elasticsearch Support * http://sematext.com/ _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
