diff --git a/docs/edge_processor.md b/docs/edge_processor.md index c911da8907..cefd317771 100644 --- a/docs/edge_processor.md +++ b/docs/edge_processor.md @@ -4,18 +4,33 @@ `Edge Processor` can be used on that usecases: +* Enrich log message extra data (for example add some field or override index) using `SPL2` +* Filter log message using `SPL2` * Send log messages to alternative destanations (like `AWS S3`, `Apache Kafka`, etc.) -* Enrich log message extra data (for example add some field or override index) or filter log messages using `SPL2` ## How it's working ```mermaid -graph LR - A[Your device] --> |Syslog protocol| B[SC4S]; - B -->|HEC protocol| C[Edge Processor]; - C --> D[Splunk]; - C --> E[AWS S3]; - C --> F[Another dest]; +stateDiagram + direction LR + + SC4S: SC4S + EP: Edge Processor + Dest: Another destination + Device: Your device + S3: AWS S3 + Instance: Instance + Pipeline: Pipeline with SPL2 + + Device --> SC4S: Syslog protocol + SC4S --> EP: HEC + state EP { + direction LR + Instance --> Pipeline + } + EP --> Splunk + EP --> S3 + EP --> Dest ``` ## Basic Setup