topic Re: Single Event vs. multi-events for scripted inputs in All Apps and Add-ons

Single Event vs. multi-events for scripted inputs

mikelanghorst — Mon, 14 Oct 2013 21:32:30 GMT

Previously the scripted inputs (source=cpu, source=netstat, etc) all created a single event per run. Recently however I noticed the openports (was probably that way for awhile) creates an event per line of output.

Why the differences? Just trying to understand the reason behind one vs. the other.

Re: Single Event vs. multi-events for scripted inputs

yannK — Mon, 28 Sep 2020 14:57:57 GMT

This is not new.
The props.conf config in older and current versions calls for a single line per event.

in unix app 4.6
[cpu] SHOULD_LINEMERGE=false LINE_BREAKER=^()$ TRUNCATE=1000000 DATETIME_CONFIG = CURRENT REPORT-fields_for_cpu_sh = fields_for_cpu_sh

in unix app 5.0.0
`
[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=(^$|[\r\n]+[\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = multi
FIELDALIAS-dest_for_cpu = host as dest
FIELDALIAS-src_for_cpu = host as src
FIELDALIAS-cpu_for_cpu = CPU as cpu
FIELDALIAS-idle_time_for_cpu = pctIdle AS PercentIdleTime
FIELDALIAS-nice_time_for_cpu = pctNice AS PercentNiceTime
FIELDALIAS-cpu_load_percent_for_cpu = pctSystem AS PercentSystemTime,pctSystem as cpu_load_percent
FIELDALIAS-cpu_user_percent_for_cpu = pctUser AS PercentUserTime,pctUser as cpu_user_percent
FIELDALIAS-wait_time_for_cpu = pctIowait AS PercentWaitTime

Re: Single Event vs. multi-events for scripted inputs

mikelanghorst — Mon, 14 Oct 2013 22:33:39 GMT

Odd, source=cpu is still showing up as a single event for me. But the question was more "why the change", it kinda made sense to have one event as it's a snapshot in time, but yea always having to "| multikv" is a pain. Just trying to understand the reasoning, to mirror the functionality on my own inputs.

Re: Single Event vs. multi-events for scripted inputs

mikelanghorst — Mon, 14 Oct 2013 22:36:01 GMT

Though I've not updated to the TA for my *nix inputs yet, will roll that into my 6.0 upgrade.