Re: [syslog-ng] db-parser reuse for multiple logs?

Hi Mikkel, On Fri, Apr 10, 2015 at 06:11:44AM +0000, Mikkel Leth Carlsen wrote:

Thanks! I'm not too familiar with how syslog-ng actually implements the configuration and processes syslog messages, but I would think that parsing before filtering could have an impact on performance? I.e. I would want to exclude unwanted data before applying the parser - which I assume is a more costly operation even if it does not match? Perhaps by inserting:

I wouldn't worry too much about patterndb's performance. That being said, feel free to try out the two approaches and report back :) Cheers