{"action":"closed","number":5,"pull_request":{"url":"https://api.github.com/repos/HASecuritySolutions/Logstash/pulls/5","id":162258257,"html_url":"https://github.com/HASecuritySolutions/Logstash/pull/5","diff_url":"https://github.com/HASecuritySolutions/Logstash/pull/5.diff","patch_url":"https://github.com/HASecuritySolutions/Logstash/pull/5.patch","issue_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/issues/5","number":5,"state":"closed","locked":false,"title":"potential sizing assistance","user":{"login":"tbennett6421","id":6843296,"avatar_url":"https://avatars2.githubusercontent.com/u/6843296?v=4","gravatar_id":"","url":"https://api.github.com/users/tbennett6421","html_url":"https://github.com/tbennett6421","followers_url":"https://api.github.com/users/tbennett6421/followers","following_url":"https://api.github.com/users/tbennett6421/following{/other_user}","gists_url":"https://api.github.com/users/tbennett6421/gists{/gist_id}","starred_url":"https://api.github.com/users/tbennett6421/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tbennett6421/subscriptions","organizations_url":"https://api.github.com/users/tbennett6421/orgs","repos_url":"https://api.github.com/users/tbennett6421/repos","events_url":"https://api.github.com/users/tbennett6421/events{/privacy}","received_events_url":"https://api.github.com/users/tbennett6421/received_events","type":"User","site_admin":false},"body":"In the course of our POC we were indexing 70+ GB's in bro alone, and we used the following modifications to get a better sense of how this data was being partitioned. Splitting the index's up as allowed use to use different retention for the various bro types.\r\n\r\n`index => \"logstash-%{type}-%{+YYYY.MM.dd}\"`\r\n\r\nWe were going to go with `logstash-bro-%{type}` but then we got `logstash-bro-bro` so we used the above setting. The only inconsistency we found was the bro_dns field as it was being replaced in 8006.\r\n\r\nIn our environment we have dns tagged already and I think the performance of a boolean check should be negligible compared to the now removed replace{} plugin.","created_at":"2018-01-10T23:34:58Z","updated_at":"2018-03-19T18:23:36Z","closed_at":"2018-03-19T18:23:36Z","merged_at":null,"merge_commit_sha":"a6ee56eab245af17464ede7189a6328fc0a49337","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/pulls/5/commits","review_comments_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/pulls/5/comments","review_comment_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/pulls/comments{/number}","comments_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/issues/5/comments","statuses_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/statuses/8cd628d7d404be87c84bba070e3705824336fc79","head":{"label":"tbennett6421:master","ref":"master","sha":"8cd628d7d404be87c84bba070e3705824336fc79","user":{"login":"tbennett6421","id":6843296,"avatar_url":"https://avatars2.githubusercontent.com/u/6843296?v=4","gravatar_id":"","url":"https://api.github.com/users/tbennett6421","html_url":"https://github.com/tbennett6421","followers_url":"https://api.github.com/users/tbennett6421/followers","following_url":"https://api.github.com/users/tbennett6421/following{/other_user}","gists_url":"https://api.github.com/users/tbennett6421/gists{/gist_id}","starred_url":"https://api.github.com/users/tbennett6421/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tbennett6421/subscriptions","organizations_url":"https://api.github.com/users/tbennett6421/orgs","repos_url":"https://api.github.com/users/tbennett6421/repos","events_url":"https://api.github.com/users/tbennett6421/events{/privacy}","received_events_url":"https://api.github.com/users/tbennett6421/received_events","type":"User","site_admin":false},"repo":{"id":115751760,"name":"Logstash","full_name":"tbennett6421/Logstash","owner":{"login":"tbennett6421","id":6843296,"avatar_url":"https://avatars2.githubusercontent.com/u/6843296?v=4","gravatar_id":"","url":"https://api.github.com/users/tbennett6421","html_url":"https://github.com/tbennett6421","followers_url":"https://api.github.com/users/tbennett6421/followers","following_url":"https://api.github.com/users/tbennett6421/following{/other_user}","gists_url":"https://api.github.com/users/tbennett6421/gists{/gist_id}","starred_url":"https://api.github.com/users/tbennett6421/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tbennett6421/subscriptions","organizations_url":"https://api.github.com/users/tbennett6421/orgs","repos_url":"https://api.github.com/users/tbennett6421/repos","events_url":"https://api.github.com/users/tbennett6421/events{/privacy}","received_events_url":"https://api.github.com/users/tbennett6421/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/tbennett6421/Logstash","description":"Contains Logstash related content including tons of Logstash configurations","fork":true,"url":"https://api.github.com/repos/tbennett6421/Logstash","forks_url":"https://api.github.com/repos/tbennett6421/Logstash/forks","keys_url":"https://api.github.com/repos/tbennett6421/Logstash/keys{/key_id}","collaborators_url":"https://api.github.com/repos/tbennett6421/Logstash/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/tbennett6421/Logstash/teams","hooks_url":"https://api.github.com/repos/tbennett6421/Logstash/hooks","issue_events_url":"https://api.github.com/repos/tbennett6421/Logstash/issues/events{/number}","events_url":"https://api.github.com/repos/tbennett6421/Logstash/events","assignees_url":"https://api.github.com/repos/tbennett6421/Logstash/assignees{/user}","branches_url":"https://api.github.com/repos/tbennett6421/Logstash/branches{/branch}","tags_url":"https://api.github.com/repos/tbennett6421/Logstash/tags","blobs_url":"https://api.github.com/repos/tbennett6421/Logstash/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/tbennett6421/Logstash/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/tbennett6421/Logstash/git/refs{/sha}","trees_url":"https://api.github.com/repos/tbennett6421/Logstash/git/trees{/sha}","statuses_url":"https://api.github.com/repos/tbennett6421/Logstash/statuses/{sha}","languages_url":"https://api.github.com/repos/tbennett6421/Logstash/languages","stargazers_url":"https://api.github.com/repos/tbennett6421/Logstash/stargazers","contributors_url":"https://api.github.com/repos/tbennett6421/Logstash/contributors","subscribers_url":"https://api.github.com/repos/tbennett6421/Logstash/subscribers","subscription_url":"https://api.github.com/repos/tbennett6421/Logstash/subscription","commits_url":"https://api.github.com/repos/tbennett6421/Logstash/commits{/sha}","git_commits_url":"https://api.github.com/repos/tbennett6421/Logstash/git/commits{/sha}","comments_url":"https://api.github.com/repos/tbennett6421/Logstash/comments{/number}","issue_comment_url":"https://api.github.com/repos/tbennett6421/Logstash/issues/comments{/number}","contents_url":"https://api.github.com/repos/tbennett6421/Logstash/contents/{+path}","compare_url":"https://api.github.com/repos/tbennett6421/Logstash/compare/{base}...{head}","merges_url":"https://api.github.com/repos/tbennett6421/Logstash/merges","archive_url":"https://api.github.com/repos/tbennett6421/Logstash/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/tbennett6421/Logstash/downloads","issues_url":"https://api.github.com/repos/tbennett6421/Logstash/issues{/number}","pulls_url":"https://api.github.com/repos/tbennett6421/Logstash/pulls{/number}","milestones_url":"https://api.github.com/repos/tbennett6421/Logstash/milestones{/number}","notifications_url":"https://api.github.com/repos/tbennett6421/Logstash/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/tbennett6421/Logstash/labels{/name}","releases_url":"https://api.github.com/repos/tbennett6421/Logstash/releases{/id}","deployments_url":"https://api.github.com/repos/tbennett6421/Logstash/deployments","created_at":"2017-12-29T20:23:58Z","updated_at":"2018-03-19T18:22:38Z","pushed_at":"2018-03-19T18:22:36Z","git_url":"git://github.com/tbennett6421/Logstash.git","ssh_url":"git@github.com:tbennett6421/Logstash.git","clone_url":"https://github.com/tbennett6421/Logstash.git","svn_url":"https://github.com/tbennett6421/Logstash","homepage":"","size":188,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"HASecuritySolutions:master","ref":"master","sha":"77e74577b2fb2b5de969eea60cf37d75d15cc8dd","user":{"login":"HASecuritySolutions","id":31078807,"avatar_url":"https://avatars3.githubusercontent.com/u/31078807?v=4","gravatar_id":"","url":"https://api.github.com/users/HASecuritySolutions","html_url":"https://github.com/HASecuritySolutions","followers_url":"https://api.github.com/users/HASecuritySolutions/followers","following_url":"https://api.github.com/users/HASecuritySolutions/following{/other_user}","gists_url":"https://api.github.com/users/HASecuritySolutions/gists{/gist_id}","starred_url":"https://api.github.com/users/HASecuritySolutions/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HASecuritySolutions/subscriptions","organizations_url":"https://api.github.com/users/HASecuritySolutions/orgs","repos_url":"https://api.github.com/users/HASecuritySolutions/repos","events_url":"https://api.github.com/users/HASecuritySolutions/events{/privacy}","received_events_url":"https://api.github.com/users/HASecuritySolutions/received_events","type":"Organization","site_admin":false},"repo":{"id":100525000,"name":"Logstash","full_name":"HASecuritySolutions/Logstash","owner":{"login":"HASecuritySolutions","id":31078807,"avatar_url":"https://avatars3.githubusercontent.com/u/31078807?v=4","gravatar_id":"","url":"https://api.github.com/users/HASecuritySolutions","html_url":"https://github.com/HASecuritySolutions","followers_url":"https://api.github.com/users/HASecuritySolutions/followers","following_url":"https://api.github.com/users/HASecuritySolutions/following{/other_user}","gists_url":"https://api.github.com/users/HASecuritySolutions/gists{/gist_id}","starred_url":"https://api.github.com/users/HASecuritySolutions/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HASecuritySolutions/subscriptions","organizations_url":"https://api.github.com/users/HASecuritySolutions/orgs","repos_url":"https://api.github.com/users/HASecuritySolutions/repos","events_url":"https://api.github.com/users/HASecuritySolutions/events{/privacy}","received_events_url":"https://api.github.com/users/HASecuritySolutions/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/HASecuritySolutions/Logstash","description":"Contains Logstash related content including tons of Logstash configurations","fork":false,"url":"https://api.github.com/repos/HASecuritySolutions/Logstash","forks_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/forks","keys_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/keys{/key_id}","collaborators_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/teams","hooks_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/hooks","issue_events_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/issues/events{/number}","events_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/events","assignees_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/assignees{/user}","branches_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/branches{/branch}","tags_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/tags","blobs_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/git/refs{/sha}","trees_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/git/trees{/sha}","statuses_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/statuses/{sha}","languages_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/languages","stargazers_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/stargazers","contributors_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/contributors","subscribers_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/subscribers","subscription_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/subscription","commits_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/commits{/sha}","git_commits_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/git/commits{/sha}","comments_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/comments{/number}","issue_comment_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/issues/comments{/number}","contents_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/contents/{+path}","compare_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/compare/{base}...{head}","merges_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/merges","archive_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/downloads","issues_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/issues{/number}","pulls_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/pulls{/number}","milestones_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/milestones{/number}","notifications_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/labels{/name}","releases_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/releases{/id}","deployments_url":"https://api.github.com/repos/HASecuritySolutions/Logstash/deployments","created_at":"2017-08-16T19:26:28Z","updated_at":"2018-03-18T17:58:36Z","pushed_at":"2018-03-19T18:22:38Z","git_url":"git://github.com/HASecuritySolutions/Logstash.git","ssh_url":"git@github.com:HASecuritySolutions/Logstash.git","clone_url":"https://github.com/HASecuritySolutions/Logstash.git","svn_url":"https://github.com/HASecuritySolutions/Logstash","homepage":"","size":199,"stargazers_count":47,"watchers_count":47,"language":"Python","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":11,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"gpl-3.0","name":"GNU General Public License v3.0","spdx_id":"GPL-3.0","url":"https://api.github.com/licenses/gpl-3.0"},"forks":11,"open_issues":0,"watchers":47,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/HASecuritySolutions/Logstash/pulls/5"},"html":{"href":"https://github.com/HASecuritySolutions/Logstash/pull/5"},"issue":{"href":"https://api.github.com/repos/HASecuritySolutions/Logstash/issues/5"},"comments":{"href":"https://api.github.com/repos/HASecuritySolutions/Logstash/issues/5/comments"},"review_comments":{"href":"https://api.github.com/repos/HASecuritySolutions/Logstash/pulls/5/comments"},"review_comment":{"href":"https://api.github.com/repos/HASecuritySolutions/Logstash/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/HASecuritySolutions/Logstash/pulls/5/commits"},"statuses":{"href":"https://api.github.com/repos/HASecuritySolutions/Logstash/statuses/8cd628d7d404be87c84bba070e3705824336fc79"}},"author_association":"CONTRIBUTOR","merged":false,"mergeable":true,"rebaseable":true,"mergeable_state":"clean","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":false,"commits":5,"additions":196,"deletions":16,"changed_files":5}}
{"actor":{"display_login":"tbennett6421"}}