[Hindsight] Multiple Syslog Templates

Michael Trinkala mtrinkala at mozilla.com
Wed Nov 23 15:58:02 UTC 2016


Decoder modules are designed to be single instance. See
https://mozilla-services.github.io/lua_sandbox_extensions/#decoder-api-convention.
However, you have a few options:
1) run multiple inputs by running the old/new syslog on different
interfaces or ports (highly recommended)
2) Use the existing building blocks to: (more dev work and less efficient
since you have to run two grammars against one of the inputs)
    a) create your own decoder that produces the combined grammar you are
looking for
    b) roll everything you need into a single input plugin

Trink

On Wed, Nov 23, 2016 at 6:30 AM, Thota, Madhukar <
madhukar.thota at libertymutual.com> wrote:

> Friends,
>
>
>
> I am building a syslog listener setup with hindsight which needs to
> process both RFC5424 and RFC3164 formatted messages. Is it possible to
> define multiple syslog templates with syslog decoder?
>
>
>
> Thanks
>
> M
>
>
>
>
>
> _______________________________________________
> Hindsight mailing list
> Hindsight at mozilla.org
> https://mail.mozilla.org/listinfo/hindsight
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/hindsight/attachments/20161123/f2c247bc/attachment.html>


More information about the Hindsight mailing list