On Fri, 18 Nov 2016, Simon Tiong wrote:
On 18/11/2016 5:39 PM, David Lang wrote:
On Fri, 18 Nov 2016, Peter Viskup wrote:
Dear all,
at the moment our message flow is setup like this:
rsyslog remote client->rsyslog server->local file->Logstash->ElasticSearch
Logstash does any special message processing, just forwards messages to
ES.
We are considering the use of omelasticsearch module for direct
forward to ES (skip local file store and LogStash).
What could be the consequences or drawbacks? What are your experiences
you can share?
going directly to ES will be MUCH faster :-)
one problem with recent versions of ES is that it won't accept any json
that has a '.' in the object name. I don't think Logstash fixes this, but I
don't know what it does in those cases.
David Lang
Hi Peter,
ES not accepting '.', but here is a workaround way. Under logstash.conf you
might do some converting, for example. Hope it helps.
the question was how to not use logstash and what the problems/advantages of not
using logstash are.
mutate {
rename => {
"id.orig_h" => "id_orig_h"
"id.orig_p" => "id_orig_p"
"id.resp_h" => "id_resp_h"
"id.resp_p" => "id_resp_p"
}
}
this requires that you know all the values that have '.' in their name. If you
know that you can also manually do the same thing in rsyslog.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
