nifi-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Andrew Grande <agra...@hortonworks.com>
Subject Re: MergeContent: Correlation Attribute Name syntax for matching syslog events
Date Sun, 07 Feb 2016 13:50:53 GMT
Hi,

Are you doing anything special between Listen and Parse? Trying to understand the reasoning
for why you split those.

E.g. in default ListenSyslog mode I can see syslog.hostname correctly set. Could it be MergeContent
settings? Maybe worth sharing its config.

Andrew

From: Andre <andre-lists@fucs.org<mailto:andre-lists@fucs.org>>
Reply-To: "users@nifi.apache.org<mailto:users@nifi.apache.org>" <users@nifi.apache.org<mailto:users@nifi.apache.org>>
Date: Sunday, February 7, 2016 at 8:35 AM
To: "users@nifi.apache.org<mailto:users@nifi.apache.org>" <users@nifi.apache.org<mailto:users@nifi.apache.org>>
Subject: MergeContent: Correlation Attribute Name syntax for matching syslog events

Hi there,

I was playing with the ListenSyslog processor and hit something I wanted to confirm is the
expected behavior:

ListenSyslog (parse = false)

connects success to :

ParseSyslog

connects success to:

MergeContent ("Correlation Attribute Name" set to ${syslog.hostname} )

connects merged to:

PutFile



It has been ages since I used MergeContent but I was wondering, wasn't Correlation Attribute
Name supposed to create the bins so dataflows matching that attribute get bundled together?

If yes, Is ${syslog.hostname} the value I want or am I once again being beaten by MergeContent
and its black magic?


I ask because my dataflows are being bundled in accordance to size and age of the bin but
not binned in accordance to Is ${syslog.hostname}



Cheers





Mime
View raw message