mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-06-14 22:28:43 +02:00
Use JSONB for Telegraf fields/tags to avoid 1600-column limit
High-cardinality inputs (docker, procstat, kafka) trigger ALTER TABLE ADD COLUMN on every new field name, and with all minions writing into a shared 'telegraf' schema the metric tables hit Postgres's 1600-column per-table ceiling quickly. Setting fields_as_jsonb and tags_as_jsonb on the postgresql output keeps metric tables fixed at (time, tag_id, fields jsonb) and tag tables at (tag_id, tags jsonb). - so-stats-show rewritten to use JSONB accessors ((fields->>'x')::numeric, tags->>'host', etc.) and cast memory/disk sizes to bigint so pg_size_pretty works - Drop regex/regexFailureMessage from telegraf_output SOC UI entry to match the convention upstream used when removing them from mdengine/pcapengine/pipeline; options: list drives validation
This commit is contained in:
@@ -98,10 +98,15 @@
|
||||
# options='-c role=so_telegraf' makes every connection SET ROLE to the shared
|
||||
# group role so tables created on first write are owned by so_telegraf, and
|
||||
# all per-minion members can INSERT/SELECT them via role inheritance.
|
||||
# fields_as_jsonb/tags_as_jsonb keep metric tables at a fixed column count so
|
||||
# high-cardinality inputs (docker, procstat, kafka) don't blow past the
|
||||
# Postgres 1600-column-per-table limit.
|
||||
[[outputs.postgresql]]
|
||||
connection = "host={{ PG_HOST }} port=5432 user={{ PG_USER }} password={{ PG_PASS }} dbname=so_telegraf sslmode=verify-full sslrootcert=/etc/telegraf/ca.crt options='-c role=so_telegraf'"
|
||||
schema = "telegraf"
|
||||
tags_as_foreign_keys = true
|
||||
tags_as_jsonb = true
|
||||
fields_as_jsonb = true
|
||||
{%- endif %}
|
||||
|
||||
###############################################################################
|
||||
|
||||
Reference in New Issue
Block a user