Why would you use Http instead of TCP or UDP?

[jeffgoo]

Not really an issue so much as a question. What value does HTTP give you? TCP can be load balanced just as well as HTTP. And for logging, HTTP just adds the complexity and perf hit of another packet protocol layer on top of TCP without providing any value that I can see (at least when it comes to the logging domain). For TCP there's another project Pliner/EasyGelf (for nlog or log4net). There's also seymen/Gelf4NLog that uses UDP.

[dustinchilson]

I chose to use the http input because it was easy. The Gelf input was simple to setup and the hardest part was figuring out the required parameters and that Expect (100) Continue breaks graylog. We also send logs from Angular so TCP/UDP was not going to work.

At the time neither Pliner/EasyGelf or seymen/Gelf4NLog supported the Advanced Properties pieces which was my main motivation for creating the library.

I agree the TCP/UDP protocols would likely be faster. We're running about 30K messages per hour into graylog via this target and the NLog Async target we don't see any performance issues.

Longer term I believe we might be better served by logging locally to the event log or syslog and batching the pushes to graylog via nxlog or something.

[jeffgoo]

Thanks for the detailed reply. This was helpful.

On Wed, Jun 22, 2016 at 10:58 AM, Dustin Chilson [email protected]
wrote:

I chose to use the http input because it was easy. The Gelf input was
simple to setup and the hardest part was figuring out the required
parameters and that Expect (100) Continue breaks graylog. We also send logs
from Angular so TCP/UDP was not going to work.

At the time neither Pliner/EasyGelf or seymen/Gelf4NLog supported the
Advanced Properties pieces which was my main motivation for creating the
library.

I agree the TCP/UDP protocols would likely be faster. We're running about
30K messages per hour into graylog via this target and the NLog Async
target we don't see any performance issues.

Longer term I believe we might be better served by logging locally to the
event log or syslog and batching the pushes to graylog via nxlog or
something.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
#4 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/AAsrv3QW4zOEAEpptcTybSVLF51wum56ks5qOXfTgaJpZM4I7-f0
.

[dustinchilson]

Thanks for checking the library out.