Feature #3321
openEvaluate different encoders for eve-log
Description
We were thinking that it could be useful to be able to choose a specific encoders for eve JSON logs.
As of now these logs are encoded as normal JSON strings, however in some use cases it could be better to use a different encoder to write output.
In example msgpack could be a good choice when sending output to redis (or even to file) because it reduces output size. This may also help increasing output performances in high throughput environments.
Updated by Victor Julien about 5 years ago
- Assignee set to Community Ticket
We will definitely need help with this.
Updated by Jason Ish about 5 years ago
Some discussion of this has occurred before. Do we find some intermediate data format that we can then render to JSON, msgpack, etc? Or do we give up that idea and make the most performance JSON output we can.
The most common answer I hear is JSON, but its something that needs to be settled before doing anything about it, as its a huge change to do either.
Updated by Jason Ish about 5 years ago
- Priority changed from Normal to Low
Optimizing eve output for performance is the current priority. That may be hard to do, and offer alternative output formats.