From a9949d869e7b85ff6fb517ff35ae290d72415bb7 Mon Sep 17 00:00:00 2001 From: Katheryn Satterlee Date: Wed, 19 Jan 2022 11:59:56 -0600 Subject: [PATCH] Issue 2873 kafka docs improvement (#3771) * Updating Upgrade docs * making changes to database section of upgrade docs * Corrected anchor tags, ready to merge * Adding section for Kafka to Osquery-logs Co-authored-by: Katheryn Satterlee --- docs/01-Using-Fleet/05-Osquery-logs.md | 12 ++++++++++++ docs/02-Deploying/06-Upgrading-Fleet.md | 4 ---- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/docs/01-Using-Fleet/05-Osquery-logs.md b/docs/01-Using-Fleet/05-Osquery-logs.md index 2e4c6521f0..1e239ab210 100644 --- a/docs/01-Using-Fleet/05-Osquery-logs.md +++ b/docs/01-Using-Fleet/05-Osquery-logs.md @@ -10,6 +10,7 @@ To configure each log destination, you must set the correct osquery logging conf - [Kinesis](#kinesis) - [Lambda](#lambda) - [PubSub](#pubsub) +- [Kafka REST Proxy](#kafka) - [Stdout](#stdout) - [Filesystem](#filesystem) @@ -93,6 +94,17 @@ With the PubSub plugin, osquery result and/or status logs are written to [PubSub Note that messages over 10MB will be dropped, with a notification sent to the fleet logs, as these can never be processed by PubSub. +### Kafka + +Logs are written to Apache Kafka topics. + +- Plugin name: `kafkarest` +- Flag namespace: [kafka](../02-Deploying/03-Configuration.md#kafka) + +With the Kafka REST plugin, osquery result and/or status logs are written to [Kafka](https://kafka.apache.org/) topics using the [Kafka REST proxy](https://github.com/confluentinc/kafka-rest). + +Note that the REST proxy must be in place in order to send osquery logs to Kafka topics. + ### Stdout Logs are written to stdout. diff --git a/docs/02-Deploying/06-Upgrading-Fleet.md b/docs/02-Deploying/06-Upgrading-Fleet.md index 221a3c1291..c86b0835c2 100644 --- a/docs/02-Deploying/06-Upgrading-Fleet.md +++ b/docs/02-Deploying/06-Upgrading-Fleet.md @@ -51,11 +51,7 @@ fleet prepare db ## Serve the new version -<<<<<<< HEAD Once Fleet has been replaced with the newest version and the database migrations have completed, serve the newly upgraded Fleet instance: -======= -Once Fleet has been replaced with the latest version and the database migrations have been completed, serve the newly upgraded Fleet instance: ->>>>>>> b6404417f6964ec2ea0f2448f129725bf7bbdacb ``` fleet serve