doc/eve: Update threaded filename examples

pull/5464/head
Jeff Lucovsky 4 years ago committed by Victor Julien
parent 8f009cf9b5
commit 6f9b7e052a

@ -27,8 +27,8 @@ Output types::
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
# Enable for multi-threaded eve.json output; output files are suffixed
# with an identifier, e.g., eve.json.9.. Default: off
# Enable for multi-threaded eve.json output; output files are amended
# with an identifier, e.g., eve.9.json. Default: off
#threaded: off
#prefix: "@cee: " # prefix to prepend to each log entry
# the following are valid when type: syslog above
@ -309,7 +309,10 @@ Threaded file output
~~~~~~~~~~~~~~~~~~~~
By default, all output is written to the named filename in the outputs section. The ``threaded`` option enables
each output thread to write to individual files prefixed with the configured ``filenmae``.
each output thread to write to individual files. In this case, the ``filename`` will include a unique identifier.
With ``threaded`` enabled, the output will be split among many files -- and
the aggregate of each file's contents must be treated together.
::
@ -319,10 +322,8 @@ each output thread to write to individual files prefixed with the configured ``f
threaded: on
This example will cause each Suricata thread to write to its own "eve.json" file. Filenames are constructed
by adding a suffix with the thread id. For example, the thread with id 7 would write to `eve.json.7`.
by adding a unique identifier to the filename. For example, ``eve.7.json``.
With ``threaded`` enabled, the output will be split among many files -- each having the same prefix and a unique suffix -- and
the aggregate of each file's contents must be treated together.
Rotate log file
~~~~~~~~~~~~~~~

@ -4,8 +4,8 @@ outputs:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
# Enable for multi-threaded eve.json output; output files are suffixed
# with an identifier, e.g., eve.json.9.
# Enable for multi-threaded eve.json output; output files are amended
# with an identifier, e.g., eve.9.json
#threaded: false
#prefix: "@cee: " # prefix to prepend to each log entry
# the following are valid when type: syslog above

Loading…
Cancel
Save