eve: per thread output files
Updated by Victor Julien almost 3 years ago
- Subject changed from Add support to split eve json output to dedicated worker thread files similiar to pcap to eve: per thread output files
To avoid contention on the single output structure (+lock) when having many worker threads, add a mode where we have a eve.json per thread.
Modern tools like logstash/filebeat support tracking & processing multiple files w/o issue.
Updated by Mats Klepsland over 2 years ago
Jeff Lucovsky wrote:
@Mats Klepsland Will you be able to work on this issue? If not, I'd be happy to pick it up.
My time is stretched both at work and at home, at the moment, so please do if you want to. This is a feature that I think would be awesome to have, performance wise :)