...
- Artem Naluzhnyy
- Dave Williamson
- Lorraine A. Welch
- Sanjay Agraharam
- Luke Parker
Notes
- Prudence not Au not available today.
- Reviewed Lorraine's analysis of POMBA logs:
- An encouraging number of attributes populated.
- InvocationID possibly unset.
- Looked like the provider config still explicitly specified MDCs by name with %X{name}, so that's a pre-Amsterdam configuration.
- Canonical examples:
- No truly canonical examples. POMBA is probably among the best.
- We've had past success identifying flows from SO/APPC/SDNC output:
- What they execute is of interest in analytics (in a way that SDC, for example, is less interesting).
- It took a lot of finessing, though, to allow for differences in naming, missing data, etc.
- Action on Luke Parker to do a little analysis and summarize at the next meeting.
- Regarding what canonical looks like:
- The spec:
- Is still daunting.
- Understandably nobody is eager to reopen this issue.
- But it probably couldn't hurt to separate out and emphasize the 1/3 (~10) or so that are critical.
- The pipeline:
- Filebeat was meant to be temporary, in response to:
- EELF, and no authority to bypass logfiles.
- Heterogeneous logging provider types and versions.
- The impossibility of getting fancier transports into the classpath for every provider in every Java runtime in every container.
- But if we can reconfigure the pipeline, then:
- The output format won't necessarily matter, because we can ship logs in a structured format: syslog, logstash, JSON, etc.
- Then Filebeat can be optional, and maybe can even cease to be enabled by default.
- This has a much better ROI than fussing over formats.
- (It's noteworthy that we've made it so far without even minimal extension points).
- Spoke to Borislav Glozman and Mike Elliottand Avi Chapnick from OOM about this:
- About making the Filebeat sidecar optional in deployment manifests.
- About allowing provider configuration docs to be replaced (and thereby to enable other transports):
- Individually.
- En masse.
- And their response was that they're working on generating manifests, which:
- Could allow these kinds of changes to be made without nearly so much busy work.
- But which also means coordination and delays.
- Should try to get Mike Elliott along next time.
- Filebeat was meant to be temporary, in response to:
- The spec:
- Next meeting: July 9, 2019
...