Daniel Cross
07/08/2022, 1:30 AMdistributed_plugin
eg with Fleet, I have observed that the query results do not log to the logger_plugin
location, these are only within their own comms path. Is that correct? Any way to have the queries logged locally also?zwass
07/08/2022, 1:53 AMDaniel Cross
07/08/2022, 3:56 AMtls
config plugin? Where the live queries are the distributed plugin. That’s how I think it works. The scheduling isn’t done within fleet.
Which then means we’re handing over config to fleet, I wonder if there’s a way to honour filesystem config as preferred except for fleet’s scheduled queries in that case.zwass
07/08/2022, 7:08 PMthe scheduled queries defined in fleet would then log to the local logger?Yes, that's right. Which could be
filesystem
(filesystem on the local host), or tls
(logging to Fleet, where it is typically forwarded on to some logging pipeline). It can actually be both if you want.
Note that config is either/or, you can't have both filesystem
and tls
for config plugin.