The ugly way to do this would be a series of
if $programname = "group/appX" then set $.owner =
"\"group\":\"group\","\"unit\":\"unit\",\"app\":\"appX\",";
do having multiple templates affect performance? (what I really noticed
it's they affect loading time!)
a far more elegant way to do this would be to do a table lookup on the
programname and have it return the string.
I have readed about how lookup tables can be used for geoIP. Could you
provide a link to doc where there's an example?
you can also simplify the template a bit. Instead of crafting the json
in the template, create a variable that has what you want in/under it
and output that variable. but compared to collapsing all the templates
together, that's a minor change :-)
one variable for each file and one template which use it, isnt it?
I question the value of having a separate sending queue for each app.
I think it's better to send them in one combined firehose and split
them on the receiving side. It makes it less disruptive when you find
you want to change the groupings of things and all those queues on the
sender can eat up a lot of ram.
Probably this is because i came from redis.
Talking about elastic, probably ingest node would be the best option,
while having index name as metadata.
I'll have an eye on that too.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
