Log Insight has featured event forwarding since version 2.5. One thing missing was the ability to apply tags (i.e. metadata) to events forwarded over the syslog protocol. In version 3.6, this capability has been added. Read on to learn more!
For event forwarding, Log Insight has always supported two protocols:
- CFAPI (default)
- Syslog
When using the CFAPI, you had the option of including tags in the event you were forwarding:
This tag capability was just like the tag capability the Log Insight agent features. If you switched to the syslog protocol for event forwarding, in order to support forwarding logs to a third-party destination, then the tags option was not available. Well, now two types of tags have been made available for the syslog protocol:
- Tags — same as CFAPI
- Complimentary tags
Since the new tags capability for syslog is the same is the existing tags capability for CFAPI I think it is safe to skip a deeper dive. Instead, let me answer what complimentary tags are. If you select the question mark next to the checkbox, you are presented with the following message:
Denotes whether the forwarder should forward complementary tags (tags added by the cluster itself, such as ‘vc_username’ or ‘vc_vmname’) alongside with the tags coming directly from sources. Complementary tags are always forwarded when Ingestion API is used.
So in short, complimentary fields are metadata automatically added by LI.
© 2016, Steve Flanders. All rights reserved.
