Single Event vs. multi-events for scripted inputs

[mikelanghorst]

Previously the scripted inputs (source=cpu, source=netstat, etc) all created a single event per run. Recently however I noticed the openports (was probably that way for awhile) creates an event per line of output.

Why the differences? Just trying to understand the reason behind one vs. the other.

[yannK · Accepted solution]

This is not new.
The props.conf config in older and current versions calls for a single line per event.

in unix app 4.6

[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=^()$
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
REPORT-fields_for_cpu_sh = fields_for_cpu_sh


in unix app 5.0.0
`
[cpu]
SHOULD_LINEMERGE=false
LINE_BREAKER=(^$|[\r\n]+[\r\n]+)
TRUNCATE=1000000
DATETIME_CONFIG = CURRENT
KV_MODE = multi
FIELDALIAS-dest_for_cpu = host as dest
FIELDALIAS-src_for_cpu = host as src
FIELDALIAS-cpu_for_cpu = CPU as cpu
FIELDALIAS-idle_time_for_cpu = pctIdle AS PercentIdleTime
FIELDALIAS-nice_time_for_cpu = pctNice AS PercentNiceTime
FIELDALIAS-cpu_load_percent_for_cpu = pctSystem AS PercentSystemTime,pctSystem as cpu_load_percent
FIELDALIAS-cpu_user_percent_for_cpu = pctUser AS PercentUserTime,pctUser as cpu_user_percent
FIELDALIAS-wait_time_for_cpu = pctIowait AS PercentWaitTime

`

[mikelanghorst]

Though I've not updated to the TA for my *nix inputs yet, will roll that into my 6.0 upgrade.

[mikelanghorst]

Odd, source=cpu is still showing up as a single event for me. But the question was more "why the change", it kinda made sense to have one event as it's a snapshot in time, but yea always having to "| multikv" is a pain. Just trying to understand the reasoning, to mirror the functionality on my own inputs.