doc/eve: Update threaded filename examples

pull/5464/head
Jeff Lucovsky 6 years ago committed by Victor Julien
parent 8f009cf9b5
commit 6f9b7e052a

@ -27,8 +27,8 @@ Output types::
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json filename: eve.json
# Enable for multi-threaded eve.json output; output files are suffixed # Enable for multi-threaded eve.json output; output files are amended
# with an identifier, e.g., eve.json.9.. Default: off # with an identifier, e.g., eve.9.json. Default: off
#threaded: off #threaded: off
#prefix: "@cee: " # prefix to prepend to each log entry #prefix: "@cee: " # prefix to prepend to each log entry
# the following are valid when type: syslog above # the following are valid when type: syslog above
@ -309,7 +309,10 @@ Threaded file output
~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~
By default, all output is written to the named filename in the outputs section. The ``threaded`` option enables By default, all output is written to the named filename in the outputs section. The ``threaded`` option enables
each output thread to write to individual files prefixed with the configured ``filenmae``. each output thread to write to individual files. In this case, the ``filename`` will include a unique identifier.
With ``threaded`` enabled, the output will be split among many files -- and
the aggregate of each file's contents must be treated together.
:: ::
@ -319,10 +322,8 @@ each output thread to write to individual files prefixed with the configured ``f
threaded: on threaded: on
This example will cause each Suricata thread to write to its own "eve.json" file. Filenames are constructed This example will cause each Suricata thread to write to its own "eve.json" file. Filenames are constructed
by adding a suffix with the thread id. For example, the thread with id 7 would write to `eve.json.7`. by adding a unique identifier to the filename. For example, ``eve.7.json``.
With ``threaded`` enabled, the output will be split among many files -- each having the same prefix and a unique suffix -- and
the aggregate of each file's contents must be treated together.
Rotate log file Rotate log file
~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~

@ -4,8 +4,8 @@ outputs:
enabled: yes enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json filename: eve.json
# Enable for multi-threaded eve.json output; output files are suffixed # Enable for multi-threaded eve.json output; output files are amended
# with an identifier, e.g., eve.json.9. # with an identifier, e.g., eve.9.json
#threaded: false #threaded: false
#prefix: "@cee: " # prefix to prepend to each log entry #prefix: "@cee: " # prefix to prepend to each log entry
# the following are valid when type: syslog above # the following are valid when type: syslog above

Loading…
Cancel
Save