Re: How random is Metron's Doppler selection?
|
Mike Youngstrom <youngm@...>
As far as your comment John about having our applications send their
toggle quoted message
Show quoted text
syslogs to a remote syslog server. Though that would certainly provide a way to get better logs into splunk it would eliminate all the value we get from loggregator. * cf logs won't work (unless we fork our logs) * we won't get the redundancy and reliability of logging locally (same reason why metron exists as an agent) * Complex customer config for a solution that should for the most part "just work" * etc. There are all kinds of hacks we can use to improve our multi-line logging. But, they are all hacks that diminish the customer experience. I understand that nobody here can "speculate as to the future of CF and whether or not a particular feature will someday be included". All I'm asking for is an acknowledgement from the LAMB team that draining multi-line log messages is a point point for users and that the team would consider investing some future time to a solution (any solution) for this issue. If the logging team really believes that the way multi-line log events are currently handled isn't a problem then lets discuss that. I as a user believe this is a problem that ought to be looked at some point in the future. Mike On Mon, Jun 15, 2015 at 3:48 PM, Mike Heath <elcapo(a)gmail.com> wrote:
I think our situation is a little bit different since we have a custom |
|
|