On 18/11/2016 5:39 PM, David Lang wrote:
On Fri, 18 Nov 2016, Peter Viskup wrote:
Dear all,
at the moment our message flow is setup like this:
rsyslog remote client->rsyslog server->local
file->Logstash->ElasticSearch
Logstash does any special message processing, just forwards messages
to ES.
We are considering the use of omelasticsearch module for direct
forward to ES (skip local file store and LogStash).
What could be the consequences or drawbacks? What are your experiences
you can share?
going directly to ES will be MUCH faster :-)
one problem with recent versions of ES is that it won't accept any
json that has a '.' in the object name. I don't think Logstash fixes
this, but I don't know what it does in those cases.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
Hi Peter,
ES not accepting '.', but here is a workaround way. Under logstash.conf
you might do some converting, for example. Hope it helps.
mutate {
rename => {
"id.orig_h" => "id_orig_h"
"id.orig_p" => "id_orig_p"
"id.resp_h" => "id_resp_h"
"id.resp_p" => "id_resp_p"
}
}
Thank You.
ST
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
