Hi there
I want to merge our host Asset tracking data into our graylog data - so that internal IP addresses can be mapped to their current hostname/OS/username details. As such I would dump out our Asset database every five minutes (into whatever format required) and load it into graylog via a data adapter.
I’ve got it working for “ip -> hostname” via a CSV file, but it seems inefficient that I also need separate data adapters for “ip -> OS”, “ip -> username/owner”. I’d rather have one data adapter with all those columns - less RAM, simpler, etc.
The only way of getting a multi-value array seems to be via JSON - but that’s over HTTP - which would be extremely inefficient at the several thousand per second rate we are pushing into graylog - even with caching. A JSON file (or multi-column CSV of course) would be much better
Is that an option/idea?
Thanks
Jason