Ignore chatty applications

[hanswurscht]

Hi,

since #114 was closed, there is this new issue to clarify the situation.

What is the proper solution to temporary ignore chatty applications?
Is it possible to just ignore logs from stdout/stderr but keep the container metrics?

Should i use F2S_DISABLE_LOGGING=true or should i use the index routing feature for it?
What exactly do i have to set as target index if i want to ignore the apps stdout/stderr?

Thanks!

[luckyj5]

Hi @hanswurscht
Are you looking to just collect container metrics and not application logs? If thats the case, please select event types you are interested in when configuring the tile or nozzle manifest.

If you are looking to discard logging for few applications, then you can use F2S_DISABLE_LOGGING=true.
Index routing feature is not used to discard the logs, its used to re-route individual applications data to different indexes in Splunk.
Thanks!

[hanswurscht]

Hi,

this doesn't seem to work in our environment.

We have set F2S_DISABLE_LOGGING = true as a environment variable in our application. Nevertheless logs (cf:logmessage) from that application are transmitted.
Are we missing something?

Have there been improvements in the latest release?

• Lorenz

[luckyj5]

@hanswurscht Which PCF/ Tanzu version are you using?

[hanswurscht]

@luckyj5 We are on 2.9 currently.

[luckyj5]

Please use latest release (v1.2.2) which includes the fix for this issue. Thanks!

[christianerbsmehl]

Same issue here. We would like to disable the cf:logmessage events (not needed because we use custom logging via Serilog/HttpEventCollector) but still want to receive cf:containermetric events etc.

F2S_DISABLE_LOGGING=true is not a solution as it disables all cf:* events. Configuring the tile or nozzle manifest is also not possible for us, because this is done by our platform administrators and all events are enabled by default globally.

It would be nice to have a way to disable certain events on application level, e.g. by setting different environment variables.

[luckyj5]

@christianerbsmehl Please use Event-type configuration to disable cf:logmessage (i.e, do not configure LogMessage event type when configuring nozzle either thru the Tile, manifest or env variables)
https://docs.pivotal.io/partners/splunk/installing.html#configure

EVENTS: A comma separated list of events to include. It is a required field. Possible values: ValueMetric,CounterEvent,Error,LogMessage,HttpStartStop,ContainerMetric.

[hanswurscht]

To my knowledge this only works on a global scope and not individual per application.

[christianerbsmehl]

Yes, that's what I said. In our organization we have thousands of apps and for most of them, sending all events (including cf:logmessage) is fine. But for some, which are heavily used and/or have custom logging implemented, it would be nice to turn off cf:logmessage events on application level. Like you can turn off everything with F2S_DISABLE_LOGGING=true.