[Bro] NSQ plugin getting deprecated in 2.5
Azoff, Justin S
jazoff at illinois.edu
Mon Sep 19 07:55:17 PDT 2016
> On Sep 16, 2016, at 5:50 PM, Robin Sommer <robin at icir.org> wrote:
> I'm wondering if there's anybody who'd be interested in taking over
> ownership of the plugin. We are planing to move bro-plugins/* into
> separately distributed Bro packages anyways, using the new Bro package
> manager. If somebody wanted to take ownership of the plugin that way,
> they could just starting maintaining a package for it. An option could
> also be turning it into a NSQ-only plugin?
I was thinking the same thing.
I think the issues with the elasticsearch plugin was that bro -> remote ES never worked well in practice and users were better off using something else to get logs into ES.
But bro -> local NSQ was rock solid for the people that used it.
Also, another thing to keep in mind is that there are only a few lines in the entire plugin that are actually specific to NSQ, with a few strings moved into options it could possibly be turned into a generic http/json log writer.
- Justin Azoff
More information about the Bro