I have deployed a syslog plugin that has a set of filters that help me tag each message to the vendor or device type based on regex patterns.
I am trying to avoid doing it per message, so I am thinking of something like hash table in memory, that will save an IP/hostname and the relevant tag. This case, each time a message received, I will first check the hash table and only if it not there, then I will have to go over the whole list of regex. Once it found, I will update the hash so next message from the same IP, will be easy to resolve this info using hash.
Does anyone knows if it’s possible and how?