[Bro-Dev] Broker::publish API

[Robin Sommer]

On Wed, Aug 08, 2018 at 14:20 +0000, Justin Azoff wrote:

> There's also a bunch of places that I think were written standalone first and then updated to work on a cluster in
> place resulting in some awkwardness..

Yeah, indeed, that's another other source of complexity with these
scripts.

> But if this was written in a more 'cluster by default' way, it would just look like:

Nice example. That's the kind of thing I hope we can do during the
next cycle: streamline the scripts to unify these kinds of logic.

> Broker::publish could possibly be optimized for standalone to raise the event directly if not being ran in a cluster.

Or we generally raise published events locally as well if the node is
subscribed to the destination topic. There are pros and cons for that
I think.

Robin

-- 
Robin Sommer * Corelight, Inc. * robin at corelight.com * www.corelight.com