Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 05:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Some documentation updates for elasticsearch plugin.

Browse source
This commit is contained in:
Seth Hall 2012-07-20 08:51:39 -04:00
parent 0c4c5ff335
commit db3d89d290
1 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

15
scripts/base/frameworks/logging/writers/elasticsearch.bro
View file

@ -1,7 +1,16 @@
##! Log writer for sending logs to an ElasticSearch server.
##!
##! Note: This module is in testing and is not yet considered stable!
##!
##! There is one known memory issue. If your elasticsearch server is
##! running slowly and taking too long to return from bulk insert
##! requests, the message queue to the writer thread will continue
##! growing larger and larger giving the appearance of a memory leak.
module LogElasticSearch; module LogElasticSearch;
export { export {
## Name of the ES cluster ## Name of the ES cluster
const cluster_name = "elasticsearch" &redef; const cluster_name = "elasticsearch" &redef;
## ES Server ## ES Server
@ -18,16 +27,16 @@ export {
const type_prefix = "" &redef; const type_prefix = "" &redef;
## The time before an ElasticSearch transfer will timeout. ## The time before an ElasticSearch transfer will timeout.
## This is not working!
const transfer_timeout = 2secs; const transfer_timeout = 2secs;
## The batch size is the number of messages that will be queued up before ## The batch size is the number of messages that will be queued up before
## they are sent to be bulk indexed. ## they are sent to be bulk indexed.
## Note: this is mainly a memory usage parameter.
const max_batch_size = 1000 &redef; const max_batch_size = 1000 &redef;
## The maximum amount of wall-clock time that is allowed to pass without ## The maximum amount of wall-clock time that is allowed to pass without
## finishing a bulk log send. This represents the maximum delay you ## finishing a bulk log send. This represents the maximum delay you
## would like to have with your logs before they show up in ElasticSearch. ## would like to have with your logs before they are sent to ElasticSearch.
const max_batch_interval = 1min &redef; const max_batch_interval = 1min &redef;
## The maximum byte size for a buffered JSON string to send to the bulk ## The maximum byte size for a buffered JSON string to send to the bulk