Seshu
01/26/2021, 3:46 AMmap<string, Object>
where Object
is a union
should work in thrift AFAIK. Overhead for serialization/de-serialization via domain sockets should be negligible compared to JSON.
We have been pushing events in near real-time for ~4 years. OSS PR https://github.com/osquery/osquery/pull/3482 and others didn't go anywhere. Our Osquery at most have a latency of 4 seconds on events. Here is a customer from 2020 @scale conference who measured events -> alerts in ~1.7 seconds The more I explore extensions, these limitations are biting me. Happy to contribute, if there is consensus.zwass
Seshu
01/26/2021, 4:37 PMtheopolis
seph