Daniel Cross07/08/2022, 1:30 AM
eg with Fleet, I have observed that the query results do not log to the
location, these are only within their own comms path. Is that correct? Any way to have the queries logged locally also?
Daniel Cross07/08/2022, 3:56 AM
config plugin? Where the live queries are the distributed plugin. That’s how I think it works. The scheduling isn’t done within fleet.
Which then means we’re handing over config to fleet, I wonder if there’s a way to honour filesystem config as preferred except for fleet’s scheduled queries in that case.
the scheduled queries defined in fleet would then log to the local logger?Yes, that's right. Which could be
(filesystem on the local host), or
(logging to Fleet, where it is typically forwarded on to some logging pipeline). It can actually be both if you want.
Note that config is either/or, you can't have both
for config plugin.