I am sending osquery results directly to firehose ...
# fleetv
Vinny
05/08/2024, 4:57 PMI am sending osquery results directly to firehose and they get dumped into S3. The endpoint sends a file containing a batch of log results and status. I want to have each single event saved to S3 separate as a single object.
1. Is it possible by changing any agent configuration in Fleet UI Agent options? If yes, which config do I need to set?
2. Is this something that will skyrocket the cost of S3?
g
Grant Bilstad
05/08/2024, 7:31 PMGreetings @Vinny,
For #1 there is this previous thread that goes through some options to configure the logs.
For #2, it's hard to say since going for smaller chunks but a similar size of data being stored. There might be more requests/work you need to do with your flow to read the data out but I think an additional 1 million requests in s3 is like $0.50usd.
v
Vinny
05/08/2024, 7:36 PMThanks, Grant. Really appreciate your help
Vinny
05/09/2024, 1:13 PMHey @Grant Bilstad, thanks for your help again. I was able to make the snapshot results to output as single events on their separate lines. However, looking at Differential results now, the output seems to be incorrect, and bulking the results as a list of objects within the
removedadded--logger_snapshot_event_type=true3 Views