fluent-plugin-splunk-enterprise 0.9.2 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: c09f7e1073b95b11fd6905187df61e58012970cf
-  data.tar.gz: 920cd3d7009b73a5c8a1adda7e1fd9c8db81c353
+SHA256:
+  metadata.gz: '0886391d8c5ddfbb4ef05d609f65e9ab617cd6750c551915bf2d93c32f54c202'
+  data.tar.gz: aa6bb4b4b3e009952bc5419dfe79f8e8a9532b9a5af12081ad596b0d33705261
 SHA512:
-  metadata.gz: e82c40cf853cb22ed0df8a35179376ee084dcc31e40693ce9a099e3c9344806e662c582648888dea3945eed7a5fd21e52d3bdc66a2bd4c49df1bed561c0df10e
-  data.tar.gz: 0a313b9456ce8fcdea30de949ffd81101877a59097a151b822b924cdaec9d30942632dfac0355417bd18f39b269bfd5efadd570aaf5c0c3667d0bb5a301689d5
+  metadata.gz: fc6d04e3c6f06c1dd1efb9f8ce64cde333da4fe34ab14e26f83c852e98c8f01fb66fe83eb820f28d2d5d79eb9bf7226c201e737202d6ca3f7b9b1aebc9a2cf42
+  data.tar.gz: e966dd045eb323d19c6bca91bd64ccd4866665f06d5f8b6a20b68974602d61d1f7743a718d7670158167455264dabc2396eec664cba66630a2a725f41165056c

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+# Release v0.9.3 - 2019/06/06
+
+* out_splunk_hec: Improve sourcetype usage by adding `default_sourcetype`, `sourcetype_key` and `remove_sourcetype_key`
+
 # Release v0.9.2 - 2019/03/14
 
 ## Enhancements

data/README.hec.md

@@ -14,7 +14,10 @@
    * [source_key](#source_key)
    * [default_index](#default_index)
    * [index_key](#index_key)
+   * [default_sourcetype](#default_sourcetype)
    * [sourcetype](#sourcetype)
+   * [sourcetype_key](#sourcetype_key)
+   * [remove_sourcetype_key](#remove_sourcetype_key)
    * [use_fluentd_time](#use_fluentd_time)
    * [use_ack](#use_ack)
    * [channel](#channel)
@@ -110,9 +113,21 @@ If you set this, the value associated with this key in each record is used as in
 
 If you set this, the field specified by the `index_key` will be removed
 
+### default_sourcetype
+
+If you set this, the value is set as sourcetype metadata if `sourcetype_key` is not set or not found in the record.
+
 ### sourcetype
 
-If you set this, the value is set as sourcetype metadata.
+Deprecated. Same as `default_sourcetype`, kept for backwards compability.
+
+### sourcetype_key
+
+If you set this, the value associated with this key in each record is used as sourcetype metadata. When the key is missing, `default_sourcetype` is used.
+
+### remove_sourcetype_key
+
+If you set this, the field specified by the `sourcetype_key` will be removed
 
 ### use_fluentd_time
 

data/fluent-plugin-splunk-enterprise.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = "fluent-plugin-splunk-enterprise"
-  spec.version       = "0.9.2"
+  spec.version       = "0.9.3"
   spec.authors       = ["Yuki Ito", "Masahiro Nakagawa"]
   spec.email         = ["yito@treasure-data.com", "repeatedly@gmail.com"]
 

data/lib/fluent/plugin/out_splunk_hec.rb

@@ -22,7 +22,10 @@ module Fluent
     config_param :default_index, :string, default: nil
     config_param :index_key, :string, default: nil
     config_param :remove_index_key, :bool, default: false
-    config_param :sourcetype, :string, default: nil
+    config_param :sourcetype, :string, default: nil, deprecated: "Use default_sourcetype instead"
+    config_param :default_sourcetype, :string, default: nil
+    config_param :sourcetype_key, :string, default: nil
+    config_param :remove_sourcetype_key, :bool, default: false
     config_param :use_fluentd_time, :bool, default: true    
 
     # for Indexer acknowledgement
@@ -52,6 +55,8 @@ module Fluent
       raise ConfigError, "'ack_interval' parameter must be a non negative integer" if @use_ack && @ack_interval < 0
       raise ConfigError, "'event_key' parameter is required when 'raw' is true" if @raw && !@event_key
       raise ConfigError, "'channel' parameter is required when 'raw' is true" if @raw && !@channel
+      
+      @default_sourcetype = @sourcetype if @sourcetype && !@default_sourcetype
 
       # build hash for query string
       if @raw
@@ -59,7 +64,7 @@ module Fluent
         @query['host'] = @default_host if @default_host
         @query['source'] = @default_source if @default_source
         @query['index'] = @default_index if @default_index
-        @query['sourcetype'] = @sourcetype if @sourcetype
+        @query['sourcetype'] = @default_sourcetype if @default_sourcetype
       end
     end
 
@@ -103,7 +108,11 @@ module Fluent
       msg['time'] = time if @use_fluentd_time
 
       # metadata
-      msg['sourcetype'] = @sourcetype if @sourcetype
+      if record[@sourcetype_key]
+        msg['sourcetype'] = @remove_sourcetype_key ? record.delete(@sourcetype_key) : record[@sourcetype_key]
+      elsif @default_sourcetype
+        msg['sourcetype'] = @default_sourcetype
+      end
 
       if record[@host_key]
         msg['host'] = @remove_host_key ? record.delete(@host_key) : record[@host_key]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-splunk-enterprise
 version: !ruby/object:Gem::Version
-  version: 0.9.2
+  version: 0.9.3
 platform: ruby
 authors:
 - Yuki Ito
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-03-15 00:00:00.000000000 Z
+date: 2019-06-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fluentd
@@ -135,8 +135,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.14.1
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Splunk output plugin for Fluentd