On Fri, 25 Nov 2016, David Lang wrote:
On Fri, 25 Nov 2016, [email protected] wrote:
After sleeping on it, I'm still thinking about "defining a separate
pipeline for each application". To sum up, each application could do his
own thing and return the message to the queue, in order to be processed by
other modules...until it's done, and indexed into ES
Is there a way to put the already processed message into the input queue to
be processed again by another *sibling* modules?
input-> queue -> app
<-
-> geoip
<-
-> index
that's exactly what a message modification module (mm*) does, it changes the
messages in the queue so that things after them in the config see the
modified version.
you can also simulate it by having separate rulesets all call one common
ruleset, but that's really not merging the work back into one flow, it's just
executing the same code in many different flows.
Also, rsyslog really isn't structured to support per-application pipelines the
way you are thinking of them. While you could simulate them, they are a bad fit
for how rsyslog actually works, and as a result, your performance and resource
usage will be substantially sub-optimal.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
