On Thu, 8 Oct 2015, Micah Yoder wrote:
On 10/8/15 1:25 PM, David Lang wrote:
even using puppet, I think you can separate out the template generation
Oh sure i can, it would just be a bit of a re-organization.
worst case, create a separate include directory that only includes the
templates and the code that evaluates the templates into variables, then
your actions in the main include directory can use those.
Well I just took our config and did that manually outside of puppet on
the dev server, in a bit of a hack job. Unfortunately the crashes
persist with the same regularity. I am now getting error 6 in the
segfault whereas it was 15 before - though I've also had error 6 before
and also error 14.
However, the actions still called the templates via the dynamic index
per day name so maybe it wasn't separated enough. But is there even a
way to make it not call the template in that case?
So is it only really important to separate out the templates that set up
the JSON, or all templates?
what I did was to pull out all templates that used any json that wasn't a single
value. This made the vast majority of my action() calls then calling a template
that contained just a single value.
But if your various ES things mostly use the template "all" (which is
what I would expect), then you may be able to do something much simpler
than you are thinking. In my case it turned out that I only had 3
templates that ended up getting used in all the different rules.
I use two templates per omelasticsearch - one to define the index name.
I currently use a separate template per name -
"es_index_name-yyyy.mm.dd" but now I see you're right, I could stick the
name into a variable $.es_index_name and use one template for that.
There are two content templates - one "all" and one other type.
it would be the content templates that I would expect to have problems with,
they are sending out a lot of data and much of it being trees of json data.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
