nifi-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Joe Witt <joe.w...@gmail.com>
Subject Re: MergeContent: Correlation Attribute Name syntax for matching syslog events
Date Sun, 07 Feb 2016 13:55:07 GMT
Andre

I believe until this next release which is 0.5.0 merge content did not
allow expression language statements as the correlation attribute.  By
using an expression language statement there it is matching everything
basically.

For now you just put 'syslog.hostname' there instead.

Make sense?

Thanks
Joe
On Feb 7, 2016 8:51 AM, "Andrew Grande" <agrande@hortonworks.com> wrote:

> Hi,
>
> Are you doing anything special between Listen and Parse? Trying to
> understand the reasoning for why you split those.
>
> E.g. in default ListenSyslog mode I can see syslog.hostname correctly set.
> Could it be MergeContent settings? Maybe worth sharing its config.
>
> Andrew
>
> From: Andre <andre-lists@fucs.org>
> Reply-To: "users@nifi.apache.org" <users@nifi.apache.org>
> Date: Sunday, February 7, 2016 at 8:35 AM
> To: "users@nifi.apache.org" <users@nifi.apache.org>
> Subject: MergeContent: Correlation Attribute Name syntax for matching
> syslog events
>
> Hi there,
>
> I was playing with the ListenSyslog processor and hit something I wanted
> to confirm is the expected behavior:
>
> ListenSyslog (parse = false)
>
> connects success to :
>
> ParseSyslog
>
> connects success to:
>
> MergeContent ("Correlation Attribute Name" set to ${syslog.hostname} )
>
> connects merged to:
>
> PutFile
>
>
>
> It has been ages since I used MergeContent but I was wondering, wasn't
> Correlation Attribute Name supposed to create the bins so dataflows
> matching that attribute get bundled together?
>
> If yes, Is ${syslog.hostname} the value I want or am I once again being
> beaten by MergeContent and its black magic?
>
>
> I ask because my dataflows are being bundled in accordance to size and age
> of the bin but not binned in accordance to Is ${syslog.hostname}
>
>
>
> Cheers
>
>
>
>
>
>

Mime
View raw message