[Bro-Dev] Broker::publish API

[Jon Siwek]

On Fri, Aug 3, 2018 at 12:22 PM Robin Sommer <robin at corelight.com> wrote:

> On Fri, Jul 27, 2018 at 10:39 -0700, I wrote:
>
> > Broker::relay(change_topic, change_topic, Config::cluster_set_option, ID, val, location);
>
> Can somebody remind me what the use-case is for changing the topic on
> relay? Grepping over our standard scripts, I see only one use of
> relay(), and that's the one above.

Another use is hidden within Cluster::relay_rr():

event Intel::new_item(item: Item) &priority=5
    {
    if ( Cluster::proxy_pool$alive_count == 0 )
        Broker::publish(indicator_topic, Intel::insert_indicator, item);
    else
        Cluster::relay_rr(Cluster::proxy_pool, "Intel::new_item_relay_rr",
                          indicator_topic, Intel::insert_indicator, item);
    }

That is, if the manager is currently connected to some proxy, it picks
one to do the work of distributing the event to workers.  Manager
sends 1 message instead of N.

I don't know if there's currently other use-cases for Broker::relay
specifically, but Cluster::relay_rr/Cluster::relay_hrw is essentially
an extension of that which just also does the work of choosing the
initial topic based upon a given pool and partition strategy.

Might have been Justin who originally pointed out potential for
avoiding manager overload in this way.

- Jon