On Fri, 18 Nov 2016, Peter Viskup wrote:
Dear all,
at the moment our message flow is setup like this:
rsyslog remote client->rsyslog server->local file->Logstash->ElasticSearch
Logstash does any special message processing, just forwards messages to ES.
We are considering the use of omelasticsearch module for direct
forward to ES (skip local file store and LogStash).
What could be the consequences or drawbacks? What are your experiences
you can share?
going directly to ES will be MUCH faster :-)
one problem with recent versions of ES is that it won't accept any json that has
a '.' in the object name. I don't think Logstash fixes this, but I don't know
what it does in those cases.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
