I think TLS compression is a good answer. I see options documented in logstash, ES, SPLUNK, SUMO.

We have 2 syslog relays that send data over strait TCP right now to another syslog-ng master.

I was looking for ways to optimize that communication as well as a network JSON input from logstash and how other connections to the above could be optimized.

Just a thought without much thought put into it I guess.

Scot

On Tue, Mar 13, 2018 at 12:53 PM, Nagy, Gábor <gabor.nagy@balabit.com> wrote:

Hi Scot,

I don't know about native compression abilities in syslog-ng.
You could use TLS compression, but I don't know if that suits you.

Other options would require that you write your compressing programs and include them in program source/destination or using unix sockets.

Can you explain what is your use case, please?
Maybe compression is not the goal, just the tool to achieve it and we can propose something else.

Gabor

On 13 Mar 2018 3:05 pm, "Scot" <scotrn@gmail.com> wrote:
Hi,

Has anyone looked at enabling compression between sources and destinations?

Looks like Kafka is the only destination that supports compression by documentation. No inputs.

Would be great to also compress between a syslog-ng relay and a syslog-ng target.

Scot

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq