2016-12-02 9:30 GMT+01:00 Bob Gregory <[email protected]>: > The problem there is that I'd need to reformat the json output of impstats > in order for it to fit this module. I might be tempted to add a separate > output format to impstats for that case, though, because it seems perverse > to make people do that templating themselves.
+1 for additonal format. Should work out of the box. Pls open issue tracker (and I don't mind if you create a PR for it). > > We can amortize that work if we also support a statsd output, which seems > like a logical next step. +1, also worth an issue Side-note: I like the issues as they can cleanly show what work is supposed to happen.I'll align all of them to the REK project in github. Rainer > > On Fri, 2 Dec 2016 at 08:12 Rainer Gerhards <[email protected]> > wrote: > >> I need to think a bit before casting a ballot, but >> >> a) json blob sounds great >> b) sounds useful for impstats -- impstats can generate json >> >> Raienr >> >> 2016-12-02 8:41 GMT+01:00 Bob Gregory <[email protected]>: >> > Evening all, >> > >> > I've mostly finished my last personal project, so my thoughts are turning >> > to omriemann. >> > >> > I'm trying to work out how we might configure the module. Riemann >> requires >> > that we send a protobuf encoded message containing a few pre-set fields, >> > plus whatever additional fields we feel like forwarding. >> > >> > host: localhost >> > service: cpu-load-average/1m >> > state: ok >> > time: 1480661786 >> > description: "everything is perfectly fine" >> > tags: ["laptop", "personal"] >> > metric: 0.58 >> > ttl: 120 >> > my-custom-field: 27 >> > >> > This makes it unusual for an rsyslog module: usually rsyslog is happy to >> > ship arbitrary strings to a destination and only cares about the >> _framing_ >> > of your data: omelasticsearch, ommysql, omkafka, omrelp etc. all accept >> > some number of static parameters, plus a free-form template for the >> actual >> > message. >> > >> > Omriemann, in order to be useful, will need to impose some structure on >> the >> > message itself. >> > >> > How do people think we should configure the module so that people have >> > flexibility over the host, metric value, metric name, and tags on a >> > per-message basis? >> > >> > I guess the simplest thing that could possibly work is defining a simple >> > message format, eg. `host=foo; metric_f=0.6; >> > service=rsyslog.impstats/utime; timestamp=1480661786` that messages need >> to >> > conform to. We can then parse out the key/value pairs in the module and >> > encode them to protobuf. >> > >> > Alternatively, we could set up the structure of the message in the config >> > itself, like this: >> > >> > action( >> > type="omriemann" >> > host="$hostname" >> > metric="$!metric.value" >> > service="$!metric.name") >> > >> > That seems more user-friendly, but rules out using custom fields. I guess >> > I'd have to create a new template per-field during module begin. >> > >> > On a related note, I think I remember seeing some discussion of >> conversion >> > functions recently. Some of the fields need to valid integers, floats, >> unix >> > timestamps etc. What's the best way of parsing those out? >> > _______________________________________________ >> > rsyslog mailing list >> > http://lists.adiscon.net/mailman/listinfo/rsyslog >> > http://www.rsyslog.com/professional-services/ >> > What's up with rsyslog? Follow https://twitter.com/rgerhards >> > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> _______________________________________________ >> rsyslog mailing list >> http://lists.adiscon.net/mailman/listinfo/rsyslog >> http://www.rsyslog.com/professional-services/ >> What's up with rsyslog? Follow https://twitter.com/rgerhards >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you >> DON'T LIKE THAT. >> > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of > sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T > LIKE THAT. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
