Hey there!
I did not find an optimal solution for myself yet. But I guess many of you have similar use cases, so maybe you can explain how you handle such situations:
Let's say you have an application consisting of:
load balancers
web servers
application servers
database servers
And you have separate environments for:
production
staging
development
So you probably want to slice your searches different ways:
Either by server role: Show me any errors on web servers (no matter whether prod, staging or dev)
Or by server environment: Show me any errors in production environment (for all: lb, web, app, db)
So I started tagging my hosts like this:
[host=server1]
production = enabled
webserver = enabled
[host=server2]
production = enabled
database = enabled
[host=server3]
staging = enabled
webserver = enabled
...
Now I can quickly perform normal searches like index=perfmon tag=webserver or index=perfmon tag=production .
I know one can also use eventtypes, macros or lookups to achieve almost the same. The reason I prefer tags over the others is I can assign multiple attributes to one host easily. Doing the same with eventtypes or macros gets tedious quickly. If you add a webserver to production, you have to change two macros. And if you have more attributes (pci etc), it doesn't scale well.
So here is my current problem:
I have built a KV Store lookup storing the currently deployed application builds by host: _key=host and value=buildnumber .
If I e.g. want to query the buildnumber for a specific environment I cannot use my tags:
| inputlookup my_buildnumbers where tag=webserver would be great because the filtering would be done directly in KV Store / MongoDB. But obviously this doesn't work because Mongo doesn't know my tags.
| inputlookup my_buildnumbers | eval host=_key | search tag=webserver unfortunately doesn't work either. I guess because tags aren't added for inputlookups. Only for real events.
| inputlookup my_buildnumbers | search `webservers` with the macro expanding to (host=server1 OR host=server2) would probably work. But as mentioned I dislike the macro approach for the reason above.
Does anybody have a good idea? How do you handle such things?
Cheers!
Thomas
... View more
