search

cloudfoundry-community / splunk-firehose-nozzle

Send CF component metrics, CF app logs, and CF app metrics to Splunk
Apache License 2.0
29 stars 29 forks source link

Updated README with app level index routing #292

Closed hvaghani221 closed 3 years ago

hvaghani221 commented 3 years ago

Lets also add that "ADD_APP_INFO" (cache info) is required to be enabled for per app index routing feature. If Add-app-info is not enabled, nozzle will not have app's metadata which will include SPLUNK_INDEX value.

It doen't depend on ADD_APP_INFO config. As you can see in router, as long as event has app_id, it will call event.AnnotateWithAppData method. In event.AnnotateWithAppData method, it gets app information from cache from cf_app_id. If it find's SPLUNK_INDEX in app env, it'll add _info_splunkindex field in the event

luckyj5 commented 3 years ago

Lets also add that "ADD_APP_INFO" (cache info) is required to be enabled for per app index routing feature. If Add-app-info is not enabled, nozzle will not have app's metadata which will include SPLUNK_INDEX value.

It doen't depend on ADD_APP_INFO config. As you can see in router, as long as event has app_id, it will call event.AnnotateWithAppData method. In event.AnnotateWithAppData method, it gets app information from cache from cf_app_id. If it find's SPLUNK_INDEX in app env, it'll add _info_splunkindex field in the event

ADD_APP_INFO config triggers nozzle to fetch cache info for apps. If it's not selected, then nozzle won't have cache info, which means it won't have env variables either. Let me know if it's otherwise.

hvaghani221 commented 3 years ago

Lets also add that "ADD_APP_INFO" (cache info) is required to be enabled for per app index routing feature. If Add-app-info is not enabled, nozzle will not have app's metadata which will include SPLUNK_INDEX value.

It doen't depend on ADD_APP_INFO config. As you can see in router, as long as event has app_id, it will call event.AnnotateWithAppData method. In event.AnnotateWithAppData method, it gets app information from cache from cf_app_id. If it find's SPLUNK_INDEX in app env, it'll add _info_splunkindex field in the event

ADD_APP_INFO config triggers nozzle to fetch cache info for apps. If it's not selected, then nozzle won't have cache info, which means it won't have env variables either. Let me know if it's otherwise.

On further analysis, found that boltdb cache is initialised only if ADD_APP_INFO is enabled otherwise NoCache is initialised. And app info will never be fetched from remote. I'll make changes according to that. Thanks.

luckyj5 commented 3 years ago

Thanks for the update @harshit-splunk.