Details
-
Improvement
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
None
-
None
Description
Currently, performance of ListenSyslog is pretty reasonable. If I configure logging to WARN level, and I use a Yield Duration of 0 ms, 3 threads, 25 ms run duration, then I can push about 23,000 messages per second to a single NiFi node without any loss, with message parsing enabled.
However, I think we can do a lot better than that. Since these Syslog events are just log messages, they lend themselves very well to concatenation. We should have a Max Batch Size property as well as a Message Delimiter property.
If using batch, though, it's important that we do not allow the Parse Messages property to be true, since it doesn't really make sense to add attributes if we have multiple messages.
However, since we cannot parse the messages if bundled together, we should have a separate ParseSyslog processor that does parse them. This way, we can route specific events to a ParseSyslog processor. For instance, using RouteText to pull out events of interest.