=head1 NAME

Message::Passing::Manual::Cookbook - Common recipies

=head1 Aggregating logs

=head2 Logging from an application.

You can use L<Log::Dispatch>, or any log system which will output into L<Log::Dispatch>.

    use Log::Dispatch;
    use Log::Dispatch::Message::Passing;
    use Message::Passing::DSL;

    my $log = Log::Dispatch->new;

    $log->add(Log::Dispatch::Message::Passing->new(
        name      => 'myapp_aggregate_log',
        min_level => 'debug',
        output    => log_chain {
            output zmq => (
                class => 'ZeroMQ',
                connect => 'tcp://192.168.0.1:5558',
            );
        },
    ));

    $log->warn($_) for qw/ foo bar baz /;

=head2 Aggregating this log

As simple as using the command line interface:

    logstash --input ZeroMQ --input_options '{"socket_bind":"tcp://192.168.0.1:5558"}' \
        --output File --output_options '{"filename":"/tmp/mylog"}'

And you've now got a multi-host log aggregation system for your application!

=head1 Aggregating syslog

Assuming that you've got a regular syslogd setup and working, then you probably want to keep that.
Having B<some of> the log files on individual hosts can be very useful. Also, we'd like to avoid
logstash being a privileged user (which would be needed to get the standard port).

Therefore, we'll run a syslog listener on a high port (5140), and get the regular syslogd to ship
messages to it. The listener will then forward from each host to a central aggregate logger
(which is setup as above).

=head2 On host collector

    logstash --input Syslog --output ZeroMQ --output_options '{"connect":"tcp://192.168.0.1:5558"}' 

=head2 Configuring your syslogd

This should be easy, here's an example of what to add to rsyslogd.conf to get the syslog resent.


    *.* =192.168.0.1:5140

=head1 Aggregating everything

If you have hosts with both applications and syslog that you want to aggregate, then you can easily
do both at once. This also means that your apps ship logs to a local buffer process rather than
directly across the network - which is more resilient to short network outages.

This

=cut