feat: 新增设备 API 拉取采集及配套处理能力
- 接入 NDRServer 告警和流量日志，支持凭据与任务管理 - 支持分页拉取、窗口拆分、调度优先级及 WAL 持久化后推进断点 - 增加迟到告警规则重放，优化多条泛化规则选择和事件时间处理 - 补充回归测试、数据库升级脚本及部署文档
This commit is contained in:
王绍宏
@@ -139,6 +139,12 @@ normalization.compiled-rule.shadow-timeout-ms=1000
|
||||
normalization.compiled-rule.rule-detail-log-enabled=true
|
||||
normalization.batch-enrichment-cache.enabled=true
|
||||
normalization.message-parse-cache.enabled=true
|
||||
normalization.rule-selection.enabled=true
|
||||
normalization.rule-selection.shadow-enabled=true
|
||||
normalization.rule-selection.ambiguous-fallback=LOWEST_RULE_ID
|
||||
normalization.rule-selection.detail-log-enabled=false
|
||||
normalization.rule-selection.explicit-enabled=true
|
||||
normalization.rule-selection.automatic-fallback-enabled=true
|
||||
normalization.rule-source-cache.local-ttl-seconds=30
|
||||
normalization.rule-source-cache.remote-ttl-seconds=300
|
||||
normalization.rule-source-cache.empty-ttl-seconds=10
|
||||
|
||||
+6
@@ -200,6 +200,12 @@ normalization.compiled-rule.shadow-timeout-ms=1000
|
||||
normalization.compiled-rule.rule-detail-log-enabled=true
|
||||
normalization.batch-enrichment-cache.enabled=true
|
||||
normalization.message-parse-cache.enabled=true
|
||||
normalization.rule-selection.enabled=true
|
||||
normalization.rule-selection.shadow-enabled=true
|
||||
normalization.rule-selection.ambiguous-fallback=LOWEST_RULE_ID
|
||||
normalization.rule-selection.detail-log-enabled=false
|
||||
normalization.rule-selection.explicit-enabled=true
|
||||
normalization.rule-selection.automatic-fallback-enabled=true
|
||||
normalization.rule-source-cache.local-ttl-seconds=30
|
||||
normalization.rule-source-cache.remote-ttl-seconds=300
|
||||
normalization.rule-source-cache.empty-ttl-seconds=10
|
||||
|
||||
+6
@@ -163,6 +163,12 @@ normalization.compiled-rule.shadow-timeout-ms=1000
|
||||
normalization.compiled-rule.rule-detail-log-enabled=true
|
||||
normalization.batch-enrichment-cache.enabled=true
|
||||
normalization.message-parse-cache.enabled=true
|
||||
normalization.rule-selection.enabled=true
|
||||
normalization.rule-selection.shadow-enabled=true
|
||||
normalization.rule-selection.ambiguous-fallback=LOWEST_RULE_ID
|
||||
normalization.rule-selection.detail-log-enabled=false
|
||||
normalization.rule-selection.explicit-enabled=true
|
||||
normalization.rule-selection.automatic-fallback-enabled=true
|
||||
normalization.rule-source-cache.local-ttl-seconds=30
|
||||
normalization.rule-source-cache.remote-ttl-seconds=300
|
||||
normalization.rule-source-cache.empty-ttl-seconds=10
|
||||
|
||||
+6
@@ -142,6 +142,12 @@ normalization.compiled-rule.shadow-timeout-ms=1000
|
||||
normalization.compiled-rule.rule-detail-log-enabled=true
|
||||
normalization.batch-enrichment-cache.enabled=true
|
||||
normalization.message-parse-cache.enabled=true
|
||||
normalization.rule-selection.enabled=true
|
||||
normalization.rule-selection.shadow-enabled=true
|
||||
normalization.rule-selection.ambiguous-fallback=LOWEST_RULE_ID
|
||||
normalization.rule-selection.detail-log-enabled=false
|
||||
normalization.rule-selection.explicit-enabled=true
|
||||
normalization.rule-selection.automatic-fallback-enabled=true
|
||||
normalization.rule-source-cache.local-ttl-seconds=30
|
||||
normalization.rule-source-cache.remote-ttl-seconds=300
|
||||
normalization.rule-source-cache.empty-ttl-seconds=10
|
||||
|
||||
+6
@@ -101,6 +101,12 @@ normalization.compiled-rule.shadow-timeout-ms=1000
|
||||
normalization.compiled-rule.rule-detail-log-enabled=true
|
||||
normalization.batch-enrichment-cache.enabled=true
|
||||
normalization.message-parse-cache.enabled=true
|
||||
normalization.rule-selection.enabled=true
|
||||
normalization.rule-selection.shadow-enabled=true
|
||||
normalization.rule-selection.ambiguous-fallback=LOWEST_RULE_ID
|
||||
normalization.rule-selection.detail-log-enabled=false
|
||||
normalization.rule-selection.explicit-enabled=true
|
||||
normalization.rule-selection.automatic-fallback-enabled=true
|
||||
normalization.rule-source-cache.local-ttl-seconds=30
|
||||
normalization.rule-source-cache.remote-ttl-seconds=300
|
||||
normalization.rule-source-cache.empty-ttl-seconds=10
|
||||
|
||||
@@ -27,9 +27,9 @@ influxdb.retry.attempts=3
|
||||
influxdb.retry.delay=1000
|
||||
# 原始 Syslog V2 分阶段开关。兼容部署先保持 V1/V1_ONLY，切换时统一写 V2。
|
||||
influxdb.raw.write-schema=${INFLUXDB_RAW_WRITE_SCHEMA:V2}
|
||||
influxdb.raw.read-mode=${INFLUXDB_RAW_READ_MODE:V2_ONLY}
|
||||
influxdb.raw.read-mode=${INFLUXDB_RAW_READ_MODE:V1_V2}
|
||||
influxdb.raw.v1-bucket=${INFLUXDB_RAW_V1_BUCKET:${influxdb.bucket}}
|
||||
influxdb.raw.v2-bucket=${INFLUXDB_RAW_V2_BUCKET:yelangbucket}
|
||||
influxdb.raw.v2-bucket=${INFLUXDB_RAW_V2_BUCKET:yelangbucket_v2}
|
||||
influxdb.raw.uuid-bucket-count=${INFLUXDB_RAW_UUID_BUCKET_COUNT:4096}
|
||||
influxdb.raw.legacy-point-time-fallback-enabled=${INFLUXDB_RAW_LEGACY_POINT_TIME_FALLBACK_ENABLED:true}
|
||||
influxdb.raw.query-max-rows=${INFLUXDB_RAW_QUERY_MAX_ROWS:10000}
|
||||
@@ -103,6 +103,9 @@ spring.kafka.listener.type=batch
|
||||
# 定时任务配置
|
||||
spring.task.scheduling.pool.size=10
|
||||
|
||||
# 标准化告警事实与迟到重放通知使用同一个达梦事务。
|
||||
analysis.late-replay.outbox-enabled=${ANALYSIS_LATE_REPLAY_OUTBOX_ENABLED:true}
|
||||
|
||||
# 日志配置
|
||||
logging.level.com.common.schedule=INFO
|
||||
logging.level.com.common.service=INFO
|
||||
@@ -204,6 +207,18 @@ normalization.compiled-rule.shadow-timeout-ms=1000
|
||||
normalization.compiled-rule.rule-detail-log-enabled=true
|
||||
normalization.batch-enrichment-cache.enabled=true
|
||||
normalization.message-parse-cache.enabled=true
|
||||
# 同设备多规则唯一归属：默认开启，最终只允许一条胜出规则进入映射和入库。
|
||||
normalization.rule-selection.enabled=true
|
||||
# 仅在 enabled=false 时用于后台观察新选择结果，不改变旧路径的实际输出。
|
||||
normalization.rule-selection.shadow-enabled=true
|
||||
# 并列策略：LOWEST_RULE_ID=稳定选择最小规则ID；STRICT=业务结果冲突时转为一条非标记录。
|
||||
normalization.rule-selection.ambiguous-fallback=LOWEST_RULE_ID
|
||||
# 只记录 event hash、候选规则ID和分数等脱敏详情，不记录原始日志。
|
||||
normalization.rule-selection.detail-log-enabled=false
|
||||
# 优先使用 rule_content.match_params 中的显式格式条件。
|
||||
normalization.rule-selection.explicit-enabled=true
|
||||
# 没有显式命中时，允许未配置 match_params 的历史规则按自动字段指纹选优。
|
||||
normalization.rule-selection.automatic-fallback-enabled=true
|
||||
normalization.rule-source-cache.local-ttl-seconds=30
|
||||
normalization.rule-source-cache.remote-ttl-seconds=300
|
||||
normalization.rule-source-cache.empty-ttl-seconds=10
|
||||
|
||||
Reference in New Issue
Block a user