- Enabled compilation of kmsg, the kernel’s new structured logging
system modile, mmaudit the message modification module supporting
Linux audit format and mmjsonparse providing the cee-enhanced
syslog format support message modification module.
- Update to 7.2.0 (v7-stable) a full structured-logging/CEE enabled
version which provides following features compared to v5-stable:
* greatly improved configuration language – the new language is
much more intuitive than the legacy format. It will also prevent
some typical mistakes simply be not permitting these invalid
constructs. Note that legacy format is still fully supported
(and you can of course do the same mistakes if you use legacy
format).
* greatly improved execution engine – with nested if/then/else
constructs as well as the capability to modify variables during
processing.
* full support for structured logging and project lumberjack/CEE.
this includes everything from being able to create, interpret
and handle JSON-based structured log messages, including the
ability to normalize legacy text log messages.
* more plugins – like support for MongoDB, HDFS, and ElasticSearch
as well as for the kernel’s new structured logging system.
* higher performance – many optimizations all over the code, like
5 to 10 times faster execution time for script-based filters,
enhanced multithreaded TCP input plugin, DNS cache and many more.