crabby icon indicating copy to clipboard operation
crabby copied to clipboard

Allow setting TTL in Riemann storage

Open sanel opened this issue 2 years ago • 0 comments

By default, Crabby will set TTL to 0, when Riemann storage is used. This won't work properly if scan interval is larger than TTL (which is), because events would be expired and removed from Riemann index.

See the following from http://riemann.io/howto.html:

If you're indexing events, but they don't appear in queries, they may have expired from the index.
Try (expired #(warn "expired" %)) to warn about expired events. They may be expiring because their
TTL is shorter than the interval between events.

To address this, Riemann storage should have a custom ttl key with something larger than 0. Usual (default) value is 5 or 10.

sanel avatar Sep 14 '21 22:09 sanel