<div dir="ltr">Hi Fabien,<div><br></div><div>Thanks for you input. I didn't know about the fact that you end up with a comma-separated list of tags.</div><div><br></div><div>The thing is, in Logsene we currently keep tags not analyzed for two reasons:</div>
<div>- let users do exact matches, especially for multi-word tags like "user error"</div><div>- be able to run a terms aggregation on them and show the available tags</div><div><br></div><div>An array there would meet our requirements. But I will think about what you suggested and maybe find a good compromise.</div>
<div><br></div><div>Thanks again!</div><div><br></div><div>Best regards,</div><div>Radu</div><div class="gmail_extra"><div><div dir="ltr"><div>--</div><div>Performance Monitoring * Log Analytics * Search Analytics</div><div>
<span style="font-family:arial,sans-serif;font-size:13px">Solr & Elasticsearch Support * </span><a href="http://sematext.com/" style="font-size:13px;font-family:arial,sans-serif" target="_blank">http://sematext.com/</a></div>
</div></div>
<br><br><div class="gmail_quote">On Mon, Jul 21, 2014 at 1:46 PM, Fabien Wernli <span dir="ltr"><<a href="mailto:wernli@in2p3.fr" target="_blank">wernli@in2p3.fr</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Radu,<br>
<br>
As Bazsi explained, there is currently no array implementation in syslog-ng,<br>
but you can naturally add as many tags to a message as you want.<br>
<br>
Now, when including the TAGS macro in a `format-json` statement, you will<br>
end up with a coma-separated field containing all tags.<br>
<br>
As it happens, if sent to Elasticsearch, this field will be indexed by<br>
default using a field of type 'string' and the standard 'analyzer'. This<br>
basically means you will be able to search your documents naturally by tag.<br>
<br>
So yes, out of the box, you don't need to do anything, just make sure the<br>
TAGS macro is being sent to ES.<br>
<br>
If you want to handle space-separated tags or be case-sensitive, you could<br>
define a custom ES analyzer to only tokenize at the comas, etc.<br>
<br>
Cheers<br>
<div class="HOEnZb"><div class="h5"><br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</div></div></blockquote></div><br></div></div>