[syslog-ng] grouping-by question

[Газин Максим Алексеевич]

bypassed the problem in this way $(- $(context-length) 1)

And one more question: is it possible to use the context-length instead of a timeout as the context closure value?

-----Original Message-----
From: Fabien Wernli [mailto:wernli at in2p3.fr] 
Sent: Thursday, June 20, 2019 12:25 PM
To: Газин Максим Алексеевич <Maksim.Gazin at rt.ru>
Cc: Syslog-ng users' and developers' mailing list <syslog-ng at lists.balabit.hu>
Subject: Re: RE: [syslog-ng] grouping-by question

Hi,

On Thu, Jun 20, 2019 at 07:17:28AM +0000, Газин Максим Алексеевич wrote:
> what does it mean? Is it possible to make the context-length equal to the value of the aggregated messages?

In your original email, your config indicated that you were using `timeout(15)` in the grouping-by config.
As far as I understand the grouping-by parser, this means that the context will only be closed (and thus context-len reinitialized) if no message matches the condition for 15 seconds.