nifi-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Andre <andre-li...@fucs.org>
Subject Re: MergeContent: Correlation Attribute Name syntax for matching syslog events
Date Sun, 07 Feb 2016 14:10:55 GMT
Joe,

It sure does.

However I am using 0.4.2 snapshot that in theory should be based on 0.5.0 ?
(e.g. my current dev instance already has the ListenRELP processor Bryan
put together).

So far I tried:

syslog.hostname
'syslog.hostname'
${syslog.hostname}
${'syslog.hostname'}
${"syslog.hostname"}

All with the same result.

I wonder if this is linked to
https://issues.apache.org/jira/browse/NIFI-1438 ?





On Mon, Feb 8, 2016 at 12:55 AM, Joe Witt <joe.witt@gmail.com> wrote:

> Andre
>
> I believe until this next release which is 0.5.0 merge content did not
> allow expression language statements as the correlation attribute.  By
> using an expression language statement there it is matching everything
> basically.
>
> For now you just put 'syslog.hostname' there instead.
>
> Make sense?
>
> Thanks
> Joe
> On Feb 7, 2016 8:51 AM, "Andrew Grande" <agrande@hortonworks.com> wrote:
>
>> Hi,
>>
>> Are you doing anything special between Listen and Parse? Trying to
>> understand the reasoning for why you split those.
>>
>> E.g. in default ListenSyslog mode I can see syslog.hostname correctly
>> set. Could it be MergeContent settings? Maybe worth sharing its config.
>>
>> Andrew
>>
>> From: Andre <andre-lists@fucs.org>
>> Reply-To: "users@nifi.apache.org" <users@nifi.apache.org>
>> Date: Sunday, February 7, 2016 at 8:35 AM
>> To: "users@nifi.apache.org" <users@nifi.apache.org>
>> Subject: MergeContent: Correlation Attribute Name syntax for matching
>> syslog events
>>
>> Hi there,
>>
>> I was playing with the ListenSyslog processor and hit something I wanted
>> to confirm is the expected behavior:
>>
>> ListenSyslog (parse = false)
>>
>> connects success to :
>>
>> ParseSyslog
>>
>> connects success to:
>>
>> MergeContent ("Correlation Attribute Name" set to ${syslog.hostname} )
>>
>> connects merged to:
>>
>> PutFile
>>
>>
>>
>> It has been ages since I used MergeContent but I was wondering, wasn't
>> Correlation Attribute Name supposed to create the bins so dataflows
>> matching that attribute get bundled together?
>>
>> If yes, Is ${syslog.hostname} the value I want or am I once again being
>> beaten by MergeContent and its black magic?
>>
>>
>> I ask because my dataflows are being bundled in accordance to size and
>> age of the bin but not binned in accordance to Is ${syslog.hostname}
>>
>>
>>
>> Cheers
>>
>>
>>
>>
>>
>>

Mime
View raw message