[08:38:36] <jayme>	 tappof: good morning o/ - thanks for taking a stab at the rsyslog approach! Reading cwhite's comment on phab leads me to believe he is in favour of having the parsing done in logstash - or is that old news?
[08:40:22] <jayme>	 your rsyslog solution seems simple enough but ofc. its mangling the log into a format we're about to abandon...so teaching logstash how to handle the log seems like the "more correct" approach - although I've no idea how much (more) work that is
[10:09:04] <tappof>	 hey jayme Good morning to you too! I was working on my test while cwhite was updating the task, so it's not old news... we were just overlapping :) I'm going to discuss the better solution with the team this afternoon. We'll let you know. ;)
[10:09:06] <tappof>	 Modifying the format on the rsyslog side could be more scalable, but it might be frustrating in the future if we talk about an rsyslog replacement. On the other hand, parsing the containerd format on the rsyslog side with grok or something similar could be more resource-intensive, and I think we might need a new Logstash input with a different codec (though I could be wrong,
[10:09:08] <tappof>	 especially about the last part).
[10:14:52] <tappof>	 I'm pretty sure I'm wrong about the last part
[10:22:01] <jayme>	 :D
[10:22:41] <jayme>	 thanks for taking care of it. lmk if I can be of help more than just asking dumb questions :)