I can assure you that doing this with a single SandboxDecoder is
possible, and would be more efficient. It's more work, however, so if
the MultiDecoder is working for you and you're satisfied with the
throughput you're seeing then there's no need to change anything.
-r
On 10/06/2015 01:32 AM, Robert Gardam wrote:
I managed to get it to work. I think the only way to make this work is
to use the multi-decoder as I still need all other syslog messages to be
processed in heka and passed onto es.
On 05/10/15 22:58, Rob Miller wrote:
On 10/5/15 9:59 AM, Robert Gardam wrote:
Hi All,
I'm just trying out moving from logstash and I'm wondering how does one
push one message from one decoder into another decoder after it has been
decoded the first time.
Essentially i'm decoding json rsyslog messages from a tcp input and then
I want to pass only one field into the nginx access log decoder.
Most of the work for the nginx access decoder is done in a module, so
I'd recommend just copying the nginx decoder code and adding your JSON
parsing right in the same decoder.
I can multi decode, but this only seems to decode json first but not
pass the json message into the second decoder.
MultiDecoder should work, albeit less efficiently. You have to set
`cascade_strategy = "all"` (the default is "first-wins") for your use
case, though; did you set that?
-r
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
_______________________________________________
Heka mailing list
[email protected]
https://mail.mozilla.org/listinfo/heka
