AdguardTeam / AdguardTeam/AdGuardHome

Support for querylog collection by disk based log collectors

Đang mở
#8,035 1 bình luận 0 reaction 0 người được giao Xem trên GitHub
feature request
Ngôn ngữ chính
TypeScript
Star
36.9k
Fork
2.5k
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

### Prerequisites

- [x] I have checked the [Wiki](https://github.com/AdguardTeam/AdGuardHome/wiki) and [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions) and found no answer

- [x] I have searched other issues and found no duplicates

- [x] I want to request a feature or enhancement and not ask a question

### The problem

To allow for log aggregation systems (e.g. Elasticsearch) to more easily ingest the querylog output, the Answer section of the querlog.json events need to be decoded and stored on disk.

I previously posted #6664 and I understand the reasons for closing. I was able to get elastic-agent working to collect the logs running as a separate container, however, the dns answer is not easily ingestible. I think this should be handled on the adguard side instead of everyone writing their own decoding scheme.

### Proposed solution

I'm guessing the reason the Answer section is encoded is for log size reduction. Since this would be to support external analysis, the logs can roll more quickly by selecting an application from the UI and either have an option to decode the answer or just make it the default.

It looks like [this PR](https://github.com/AdguardTeam/AdGuardHome/pull/5099/files#diff-7fc2b81b5fc0a6d4539316c7c51c339f57e764b15366d331f68d702d3104d99aR123) addresses the problem.

I can take a stab at addressing the conflicts from the original PR, or making it simpler to modify the Answer section of the querylog json output if it would get merged in.

### Alternatives considered and additional information

#6664

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.