bro/bro — pull request #9 by Mraoul (2014-05-19 14:08:43+00:00)
Title: New Logging Writers based on librabbitmq

This is a resubmit of pull request 8 -- I was unable to find the option in the tracker (tracker.bro.org) to create a new issue/ticket so I'm re-issuing a pull request.

Added some new writers that leverage rabbitmq for some flexibility and added reliability. First one is 'ElasticSearchRabbit'. Very similar to the ElasticSearch writer but facilitates the usage of a 'river' in ES allowing ES to pull from a RabbitMQ queue. Second, probably more important writer, is a generic RabbitMQ 'AMQP' writer that writes out log messages to rabbitmq (currently assuming topic exchange). This allows you to route log data to where you want them to go based on enterprise needs. An example usage of the AMQP writer is you can have a queue that accepts 'bro.http' data only if it only cares about http log information and another one that accepts 'bro.*' if it wants all logging data.