By default, all the logs from the tracing package (such as com.couchbase.tracing][OverThresholdRequestsRecordedEvent) are JSON documents such as
{
"kv": {
"top_requests": [
{
"operation_name": "get",
"last_dispatch_duration_us": 113274,
"last_remote_socket": "xxx:11210",
"last_local_id": "78C03F4700000001/000000008AA7BA2A",
"last_local_socket": "xxx:49908",
"total_dispatch_duration_us": 113274,
"total_server_duration_us": 19,
"operation_id": "0x152f3",
"timeout_ms": 250,
"last_server_duration_us": 19,
"total_duration_us": 113388
}
],
"total_count": 1
}
}
As I use Splunk to process my logs, It is highly preferred to have the logs with the format field=value
I am aware that Splunk can format JSON documents at runtime, but that adds a great overhead to our processing time. We also need separate parsing queries per tracing event
Is there any recommended approach to do this?
As an initial approach, I was thinking to subscribe to the Couchbase Event bus and format it there. But I am not sure if that’s the best approach
clusterEnvironment.eventBus().subscribe(e-> {
if (e instanceof OverThresholdRequestsRecordedEvent){
// format
}
});