有个人长的像洋葱,走着走着就哭了…….

packetbeat中transactions问题(结合elasticsearch使用)

Beats | 作者 Jay | 发布于2016年06月14日 | 阅读数:4317

在packetbeat中扩展sip协议后,elasticsearch head后台查找不到sip类型。对于不是请求-应答一对一模式的协议,transactions如何设置?
官方文档中说明如下:
Correlationedit

Most protocols that Packetbeat supports today are request-response oriented. Packetbeat indexes into Elasticsearch a document for each request-response pair (called a transaction). This way we can have data from the request and the response in the same document and measure the response time.

But this can be different for your protocol. For example for an asynchronous protocol like AMPQ, it makes more sense to index a document for every message, and then no correlation is necessary. On the other hand, for a session-based protocol like SIP, it might make sense to index a document for a SIP transaction or for a full SIP dialog, which can have more than two messages.
已邀请:

billzy - Make it easy

赞同来自:

阅读http的源码可以发现,
对于非1求1答的协议,packetbeat可以支持,或者说其实它支持非常灵活的transaction行为定义,1对多,多对1,多对多(还有啥,好像没了吧)。
具体的控制方法,可以参考http_parser.go中的parse方法的两个返回值。
因为我对SIP协议不是很了解,如果需要可以继续探讨。

medcl - 今晚打老虎。

赞同来自:

SIP协议我记得是有id进行关联的,在parse消息的时候,你就可以按照id进行关联,当一个transaction的消息结束之后,一般有挂断事件,你就可以组装成一个完整的消息publish出去了。

要回复问题请先登录注册