1 files changed, 106 insertions, 0 deletions
diff --git a/source/configuration/dyn_stats.rst b/source/configuration/dyn_stats.rst
new file mode 100644
index 0000000..b5d2ad9
--- /dev/null
+++ b/source/configuration/dyn_stats.rst
@@ -0,0 +1,106 @@
+Dynamic Stats
+=============
+
+Rsyslog produces runtime-stats to allow user to study service health, performance, bottlenecks etc. Runtime-stats counters that Rsyslog components publish are statically defined.
+
+**Dynamic Stats** (called dyn-stats henceforth) component allows user to configure stats-namespaces (called stats-buckets) and increment counters within these buckets using Rainerscript function call.
+
+The metric-name in this case can be a message-property or a sub-string extracted from message etc.
+
+Dyn-stats configuration
+^^^^^^^^^^^^^^^^^^^^^^^
+
+Dyn-stats configuration involves a **two part setup**.
+
+dyn_stats(name="<bucket>"...) (object)
+--------------------------------------
+
+**Defines** the bucket(identified by the bucket-name) and allows user to set some properties that control behavior of the bucket.
+
+::
+
+   dyn_stats(name="msg_per_host")
+
+Parameters:
+    **name** <string literal, mandatory> : Name of the bucket.
+
+    **resettable** <on|off, default: on> : Whether or not counters should be reset every time they are reported. This works independent of ``resetCounters`` config parameter in :doc:`modules/impstats`.
+
+    **maxCardinality** <number, default: 2000> : Maximum number of unique counter-names to track.
+
+    **unusedMetricLife** <number, default: 3600> : Interval between full purges (in seconds).  This prevents unused counters from occupying resources forever.
+
+
+A definition setting all the parameters looks like:
+
+::
+
+   dyn_stats(name="msg_per_host" resettable="on" maxCardinality="3000" unusedMetricLife="600")
+
+
+dyn_inc("<bucket>", <expr>) (function)
+--------------------------------------
+
+**Increments** counter identified by value of variable in bucket identified by name.
+
+Parameters:
+    **name** <string literal, mandatory> : Name of the bucket
+    
+    **expr** <expression resulting in a string> : Name of counter (this name will be reported by impstats to identify the counter)
+    
+A ``dyn_inc`` call looks like:
+
+::
+
+   set $.inc = dyn_inc("msg_per_host", $hostname);
+   
+   if ($.inc != 0) then {
+       ....
+   }
+
+``$.inc`` captures the error-code. It has value ``0`` when increment operation is successful and non-zero when it fails. It uses Rsyslog error-codes.
+
+Reporting
+^^^^^^^^^
+
+Legacy format:
+
+::
+
+   ...
+   global: origin=dynstats msg_per_host.ops_overflow=1 msg_per_host.new_metric_add=3 msg_per_host.no_metric=0 msg_per_host.metrics_purged=0 msg_per_host.ops_ignored=0
+   ...
+   msg_per_host: origin=dynstats.bucket foo=2 bar=1 baz=1
+   ...
+
+Json(variants with the same structure are used in other Json based formats such as ``cee`` and ``json-elasticsearch``) format:
+
+::
+
+   ...
+   { "name": "global", "origin": "dynstats", "values": { "msg_per_host.ops_overflow": 1, "msg_per_host.new_metric_add": 3, "msg_per_host.no_metric": 0, "msg_per_host.metrics_purged": 0, "msg_per_host.ops_ignored": 0 } }
+   ...
+   { "name": "msg_per_host", "origin": "dynstats.bucket", "values": { "foo": 2, "bar": 1, "baz": 1 } }
+   ...
+
+In this case counters are encapsulated inside an object hanging off top-level-key ``values``.
+
+Fields
+------
+
+**global: origin=dynstats**:
+    **ops_overflow**: Number of operations ignored because number-of-counters-tracked has hit configured max-cardinality.
+
+    **new_metric_add**: Number of "new" metrics added (new counters created).
+
+    **no_metric**: Counter-name given was invalid (length = 0).
+
+    **metrics_purged**: Number of counters discarded at discard-cycle (controlled by **unusedMetricLife**).
+
+    **ops_ignored**: Number of operations ignored due to potential performance overhead. Dyn-stats subsystem ignores operations to avoid performance-penalty if it can't get access to counter without delay(lock acquiring latency).
+
+    **purge_triggered**: Indicates that a discard was performed (1 implies a discard-cycle run).
+    
+**msg_per_host: origin=dynstats.bucket**:
+    **<metric_name>**: Value of counter identified by <metric-name>.
+