On Mon, 16 Dec 2013, Brian Knox wrote:
I believe the output module for elastic search might be a good place to start
looking for anyone interested in writing an "omrest" module? If I recall
correctly the elastic search output uses libcurl.
not really.
currently every om* module consists of code that is executed by a rsyslog worker
thread that is passed a list of messages and acts on each message.
omelasticsearch pushes messages via libcurl
for omrest you would need to change the entire paradigm of how an om* module
would work.
Instead of being code invoked by a worker thread that's invoking many other
om* code as well on a given message, the omrelp module would need to listen for
a connection from the outside, and when it receives a request, it would need to
retrieve messages from the queue, and the worker threads would need to leave the
messages on the queue.
You should see by now that this is a really ugly thing to talk about
implementing. It's almost a complete re-write of the rsyslog core to support
this.
The other approach is to have omrelp maintain it's own queue of messages and
knowledge of who should be asking for messages, timeouts for messages that
aren't asked for, etc. At that point, omrelp's interface to rsyslog is
straightforward, it's just the omrelp queue and interface stuff that gets really
'interesting' and people who want omrelp should work on writing some code that
will perform all the relp functions that you want to support but just accepts
new messages on stdin (which would let it be driven by omprog for now), and then
as you get it running and find it useful the input portion could be changed to
make it into a 'real' rsyslog om* module. Depending on what you do for your
queue, you may be able to use a different language to handle adding things to
the queue and pulling things from the queue. This would make it easy to have
some rsyslog C code that adds things to the queueu.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
