[Bro] NSQ plugin getting deprecated in 2.5
seth at icir.org
Wed Sep 21 08:06:42 PDT 2016
> On Sep 19, 2016, at 12:15 PM, Azoff, Justin S <jazoff at illinois.edu> wrote:
> That wasn't really NSQ that required that, it was whatever was pulling the records out of NSQ and pushing them into ES that wanted that.
> I think the new logging ext stuff that was added for kafka would make that extra record redundant now.
You're right, that could be skipped, but you run into the issue of having only a single queue which could cause trouble if one log type is overwhelming everything else.
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro