Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Repo info
Activity
  • 09:18
    lbudai milestoned #2937
  • 09:12
    juhaszviktor commented #2918
  • 08:54
    bazsi commented #2939
  • 08:38
    bazsi commented #2936
  • 08:27
    liupei-al opened #2939
  • 07:44
    alltilla unlabeled #2913
  • 07:44
    alltilla closed #2913
  • 07:40
    Travis Kokan/syslog-ng (geoip_dep) errored (755)
  • 07:32
    kira-syslogng commented #2780
  • 07:07
    Kokan edited #2780
  • 07:07
    Kokan synchronize #2780
  • 06:58
    alltilla commented #2913
  • 06:50
    czanik commented #2938
  • 05:44
    Travis Kokan/syslog-ng (geoip_dep) passed (754)
  • 05:33
    kira-syslogng commented #2780
  • 05:11
    Kokan synchronize #2780
  • 04:38
    bazsi commented #2934
  • 04:36
    revaniki starred syslog-ng/syslog-ng
  • 02:10
    liupei-al closed #2934
ComputerFrek
@ComputerFrek
oh
Kókai Péter
@Kokan
so you could do something like this:
  block parser foo() {
    ...
   };

   parser foo {
      foo();
   };

   log { ... parser(foo); .. };
ComputerFrek
@ComputerFrek
I prefer to keep all log statements in my main syslog config file so at one glance i can see where all my logs are going
Kókai Péter
@Kokan
there are two type of way you can reference parsers, sources
ComputerFrek
@ComputerFrek
oh wait
i think i saw it
Kókai Péter
@Kokan
one is a reference in such way:
  parser some-name {
  };

  log { ... parser(some-name); ... };
ComputerFrek
@ComputerFrek
i can do log { source(s_udp); es-checkpoint-parser(); destination; };
?
Kókai Péter
@Kokan
yes, kinda. just some minor modification
ComputerFrek
@ComputerFrek
but
these are just for readability
does it affect any performance?
if i do parser(es-checkpoint-parser); vs es-checkpoint-parser();
Kókai Péter
@Kokan
it could effect, when you use es-checkpoint-parser(); thats a new parser instance for that logpath (thats what you want for performance)
ComputerFrek
@ComputerFrek
hmmmm
i seee
Kókai Péter
@Kokan
when you use parser(es-checkpoint-parser) all of the places just points to one instance (well in reality there is a clonning mechanism)
ComputerFrek
@ComputerFrek
thanks for the advise
advice*
how about
Kókai Péter
@Kokan
the nasty thing I am not sure right now is about dbparser, as that has a state
ComputerFrek
@ComputerFrek
state?
is there an issue with dbparser? i tried writting the pattern and it seems working
im planning to write more to classifiy my logs
classify*
Kókai Péter
@Kokan
no, it is fine that you are using it
I was just not sure how it is cloned (internal stuff)
ComputerFrek
@ComputerFrek
oh
hahaha
performance lah
anyway
don't mind i ask one more question, in my scl, you saw i created new kv pairs
the huge chunk
i believe every keypair would be some form of variable in code right
do u think that creating these additional marcos would kill performance significantly?
Kókai Péter
@Kokan
I don't mind.
i'll see the config from that poitn of view
let me ask back, so you are afraid that remapping those values might have performance implication ?
ComputerFrek
@ComputerFrek
was wondering if it does
cox
from a code point of view
seems like declaring additional variables right
since when i use the kvparser already
i tried renaming the kv parser key
which there was some issues
Kókai Péter
@Kokan
well it is going to have some performance impact, and even memory as that could store twice the same information
but dbparser probably going to be the most heaviyweight here
ComputerFrek
@ComputerFrek
oh
hmmm