[Bro] NSQ plugin getting deprecated in 2.5

Seth Hall seth at icir.org
Wed Sep 21 08:06:42 PDT 2016


> On Sep 19, 2016, at 12:15 PM, Azoff, Justin S <jazoff at illinois.edu> wrote:
> 
> That wasn't really NSQ that required that, it was whatever was pulling the records out of NSQ and pushing them into ES that wanted that.
> 
> I think the new logging ext stuff that was added for kafka would make that extra record redundant now.

You're right, that could be skipped, but you run into the issue of having only a single queue which could cause trouble if one log type is overwhelming everything else.

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/




More information about the Bro mailing list