[syslog-ng] grouping-by question

Fabien Wernli wernli at in2p3.fr
Thu Jun 20 09:25:11 UTC 2019


On Thu, Jun 20, 2019 at 07:17:28AM +0000, Газин Максим Алексеевич wrote:
> what does it mean? Is it possible to make the context-length equal to the value of the aggregated messages?

In your original email, your config indicated that you were using `timeout(15)` in the grouping-by config.
As far as I understand the grouping-by parser, this means that the context
will only be closed (and thus context-len reinitialized) if no message
matches the condition for 15 seconds.

More information about the syslog-ng mailing list