arobinsongit
commented
9 years ago I think what you are looking for/referring to is probably the ApplyLogRecordPostFilter function. You can stack filters to narrow down to just what you want to return. Right now I read in all of the records and then apply a filter before passing the records along to the output. It might be more efficient to filter records as you read them in but the issue is that you already have to read the entire record to start with so no savings there and I suspect using Linq technology to do mass filtering is probably much faster than onesy twosy filtering before you add to the return list.
Is this along the lines of what you were thinking? My main reason for developing this was to support a user who had a slow connection with expensive bandwidth so I wanted to pre-filter the results before I actually returned them from the source back to the client.
I think there is another main bit of development here that maybe you have worked on already... what kinds of messages are worth looking for?
For example, I might want to have more detailed info on a node disconnected message, and it might be worth writing a Logstash filter to grab the node name that has been disconnected if it finds such a message. I can go through a couple clients' logs and see what looks nasty, and it's prob worth filtering based on severity, but is there any standard of health for an archestra system? Any log messages worth special attention?
I feel like we should put some effort into extracting meaning from the message field, either on the aaLog side or the destination side, for important messages. This would probably be a pretty major piece of info that isn't exactly code, but would be really good to have.