fbacchella / loghub Goto Github PK

path[a] {
    path[b] {
        grok {
             field: ".message"
        }
    }
}

seems to fails.

When loghub is stopped, nothing is logged.

The name timeout may be a little confusing, maybe rename it to expire?

The dropped counter should be for explicit dropped. discared are for failure (exception, blocked).
Should add initiated, (notice, merge).

Instead of != null an unary operator exist should be defined.
Le '@' (mapping) should define a fall-trough case, and be able to handle regexp.

The input is configured as:

input {
     loghub.receivers.ZMQ {
         decoder: loghub.decoders.Msgpack,
         listen: "tcp://somehost:1518",
         hwm: 500,
     }
 } | $log4j

And it fails with:

ERROR loghub.receivers.ZMQ : failed to start ZMQ input tcp://somehost:1518: Address already in use

But the problem is that somehost is not the name of this host. Could the warning be improved ?

Needs to recover more values from a org.snmp4j.PDUv1:
enterprise, SpecificTrap OID, timestamp, agentAddress, genericTrap.

Have a look at:
https://dzone.com/articles/a-specialized-high-performance-concurrent-queue
https://github.com/JCTools/JCTools
https://github.com/LMAX-Exchange/disruptor
https://vmlens.com/articles/cp/why_so_many_queues/

To avoid lost events with crash, all bytes received should be save to a persistent ring buffer on disk, before deserialization. Once acknowledge, events can be removed.

But the question is to save decoder configuration so the good one to use should be identified.

log4j configuration should be replaced with one that send everything to console.