Hello rsyslog
omes is the retry information when omelasticsearch is in failure and retry.
The contents of omes are response message from Elasticsearch mainly.
But the response didn't give a full information for retring.
And when retry is happened, the message(smsg_t) is reset.
It means any local variables is invalided, so that people can't get extra
information from it.
For example, If I set pipelineName and set dynPipelineName "on" in
omelasticsearch.
Which the pipelineName was generated by template, like:
template (
name = "es_idx_tpl"
type = "string"
string = "%syslogseverity-text%"
)
When a "status 429" failure is happened, and retry.
Because message variables is reset, there isn't $syslogseverity-text
anymore.
I can't regenerate a valid pipelineName, so retry would be failed or
mistaken.
The searchIndex option with dynSearchIndex="on" in omelasticsearch has same
problem.
Fortunately, I can retrieve it again from $.omes!_index.
A workaround for above is:
I have to make an retryFailure ruleset for each pipelineName.
Like:
ruleset (
name = "es_retry_for_pipeline1"
) {
if strlen($.omes!status) > 0 then {
...
}
action (
name = "es_retry_with_pipeline1"
type = "omelasticsearch"
....
pipelineName = "pipeline1"
)
}
action (
name = "es_for_pipeline"
type = "omelasticsearch"
...
pipelineName = "pipeline1"
retryFailures="on"
retryRuleset="es_retry_for_pipeline1"
)
ruleset (
name = "es_retry_for_pipeline2"
) {
if strlen($.omes!status) > 0 then {
...
}
action (
name = "es_retry_with_pipeline2"
type = "omelasticsearch"
....
pipelineName = "pipeline2"
)
}
action (
name = "es_for_pipeline2"
type = "omelasticsearch"
...
pipelineName = "pipeline2"
retryFailures="on"
retryRuleset="es_retry_for_pipeline2"
)
......
ruleset (
name = "es_retry_for_pipelineN"
) {
if strlen($.omes!status) > 0 then {
...
}
action (
name = "es_retry_with_pipelineN"
type = "omelasticsearch"
....
pipelineName = "pipelineN"
)
}
action (
name = "es_for_pipelineN"
type = "omelasticsearch"
...
pipelineName = "pipelineN"
retryFailures="on"
retryRuleset="es_retry_for_pipelineN"
)
It's so...ugly, isn't it?
So, like pipelineName or any others, it should in omes also?
--
eSX
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
