fluent-plugin-splunk-hec-radiant 0.1.0 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +111 -1
- data/lib/fluent/plugin/out_splunk_hec_radiant.rb +1 -1
- data/lib/fluent/plugin/splunk_hec_radiant/version.rb +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: f93916ef9c264695611a3c2fbf75c6ab6d6c3126b7a0c060e2914bb296709c58
|
|
4
|
+
data.tar.gz: 1b3f15a1a3f9460bde0f7651602ebe72024c44e10545b124c9e4911d3bf845c4
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: eb49a28f6c56d7895cbe8eb466cd2caf71d261966981aecd1ff47cd281cc4e86a0bb335cc36bd76fe8d66340e39ad89cc5824f83c20339de6f43eb1e359e802e
|
|
7
|
+
data.tar.gz: afe973e4c520ffd278a3dc2a54ba20a59cd903ad01a41715c8c87331bf688ab6dd8545d9fd498a54346af9edf9569ca4810b6176112a195e8261dbf5e5c0a915
|
data/README.md
CHANGED
|
@@ -1,7 +1,10 @@
|
|
|
1
1
|
# fluent-plugin-splunk-hec-radiant
|
|
2
2
|
|
|
3
|
+
[](https://badge.fury.io/rb/fluent-plugin-splunk-hec-radiant)
|
|
4
|
+
[](https://rubygems.org/gems/fluent-plugin-splunk-hec-radiant)
|
|
3
5
|
[](https://opensource.org/licenses/Apache-2.0)
|
|
4
6
|
[](https://www.ruby-lang.org)
|
|
7
|
+
[](https://github.com/gnanirahulnutakki/fluent-plugin-splunk-hec-radiant/actions/workflows/ci.yml)
|
|
5
8
|
|
|
6
9
|
A **modernized and actively maintained** Fluentd output plugin for sending events and metrics to [Splunk](https://www.splunk.com) via the [HTTP Event Collector (HEC) API](http://dev.splunk.com/view/event-collector/SP-CAAAE7F).
|
|
7
10
|
|
|
@@ -10,9 +13,116 @@ This is a fork of the original [fluent-plugin-splunk-hec](https://github.com/spl
|
|
|
10
13
|
- ✅ **Ruby 3.x support** (requires Ruby 3.0+)
|
|
11
14
|
- ✅ **Modern dependencies** (Fluentd 1.16+, latest gems)
|
|
12
15
|
- ✅ **Better performance** (using `oj` for JSON instead of `multi_json`)
|
|
13
|
-
- ✅ **Enhanced security** (TLS 1.2+ by default)
|
|
16
|
+
- ✅ **Enhanced security** (TLS 1.2+ by default, custom SSL certificates)
|
|
17
|
+
- ✅ **Bug fixes** from original plugin (see [Fixed Issues](#fixed-issues-from-original-plugin))
|
|
14
18
|
- ✅ **Active maintenance** and bug fixes
|
|
15
19
|
- ✅ **Comprehensive test coverage**
|
|
20
|
+
- ✅ **Production-ready examples** for all major use cases
|
|
21
|
+
|
|
22
|
+
## Fixed Issues from Original Plugin
|
|
23
|
+
|
|
24
|
+
This modernized version addresses major issues from the [original plugin's GitHub repository](https://github.com/splunk/fluent-plugin-splunk-hec/issues):
|
|
25
|
+
|
|
26
|
+
### ✅ Issue #278: Dynamic Index Based on Tag
|
|
27
|
+
**Problem**: The `index` parameter didn't accept `${tag}` variables for dynamic routing.
|
|
28
|
+
|
|
29
|
+
**Our Fix**: Full support for dynamic placeholders in index configuration.
|
|
30
|
+
```xml
|
|
31
|
+
<match **>
|
|
32
|
+
@type splunk_hec_radiant
|
|
33
|
+
index ${tag} # Works! Routes based on tag
|
|
34
|
+
<buffer tag>
|
|
35
|
+
@type memory
|
|
36
|
+
</buffer>
|
|
37
|
+
</match>
|
|
38
|
+
```
|
|
39
|
+
**Example**: [`examples/dynamic-index.conf`](examples/dynamic-index.conf)
|
|
40
|
+
|
|
41
|
+
### ✅ Issue #276: Unwanted Time Field in JSON
|
|
42
|
+
**Problem**: Can't exclude the "time" field from JSON output.
|
|
43
|
+
|
|
44
|
+
**Our Fix**: Set `time_key nil` to completely exclude the time field.
|
|
45
|
+
```xml
|
|
46
|
+
<match **>
|
|
47
|
+
@type splunk_hec_radiant
|
|
48
|
+
time_key nil # Excludes time from event JSON
|
|
49
|
+
</match>
|
|
50
|
+
```
|
|
51
|
+
**Example**: [`examples/exclude-time-field.conf`](examples/exclude-time-field.conf)
|
|
52
|
+
|
|
53
|
+
### ✅ Issue #271: SSL Certificate Verification Failures
|
|
54
|
+
**Problem**: "certificate verify failed (EE certificate key too weak)" errors.
|
|
55
|
+
|
|
56
|
+
**Our Fix**:
|
|
57
|
+
- Custom CA certificate support (`ca_file`, `ca_path`)
|
|
58
|
+
- Client certificate authentication (`client_cert`, `client_key`)
|
|
59
|
+
- Better error messages and troubleshooting guidance
|
|
60
|
+
```xml
|
|
61
|
+
<match **>
|
|
62
|
+
@type splunk_hec_radiant
|
|
63
|
+
ca_file /path/to/custom-ca.crt
|
|
64
|
+
client_cert /path/to/client.pem
|
|
65
|
+
client_key /path/to/client-key.pem
|
|
66
|
+
</match>
|
|
67
|
+
```
|
|
68
|
+
**Example**: [`examples/ssl-advanced.conf`](examples/ssl-advanced.conf)
|
|
69
|
+
|
|
70
|
+
### ✅ Issue #260: Nested Records in Fields
|
|
71
|
+
**Problem**: Can't access nested record fields for dimensions/metadata.
|
|
72
|
+
|
|
73
|
+
**Our Fix**: Modern Fluentd 1.16+ supports `$.field.subfield` syntax.
|
|
74
|
+
```xml
|
|
75
|
+
<match kubernetes.**>
|
|
76
|
+
@type splunk_hec_radiant
|
|
77
|
+
source ${$.kubernetes.pod_name}
|
|
78
|
+
<fields>
|
|
79
|
+
namespace ${$.kubernetes.namespace_name}
|
|
80
|
+
</fields>
|
|
81
|
+
<buffer $.kubernetes.namespace_name, $.kubernetes.pod_name>
|
|
82
|
+
@type memory
|
|
83
|
+
</buffer>
|
|
84
|
+
</match>
|
|
85
|
+
```
|
|
86
|
+
**Example**: [`examples/nested-fields-kubernetes.conf`](examples/nested-fields-kubernetes.conf)
|
|
87
|
+
|
|
88
|
+
### ✅ Issue #287: json-jwt Vulnerability (CVE-2023-51774)
|
|
89
|
+
**Problem**: High severity vulnerability in json-jwt dependency.
|
|
90
|
+
|
|
91
|
+
**Our Fix**: **Not applicable** - our plugin doesn't use `json-jwt` at all. No vulnerable dependencies!
|
|
92
|
+
|
|
93
|
+
### ✅ Issue #107: SSL Ciphers Configuration
|
|
94
|
+
**Problem**: No documentation for configuring SSL ciphers.
|
|
95
|
+
|
|
96
|
+
**Our Fix**: Full support with examples for custom cipher suites.
|
|
97
|
+
```xml
|
|
98
|
+
<match **>
|
|
99
|
+
@type splunk_hec_radiant
|
|
100
|
+
ssl_ciphers ["ECDHE-RSA-AES256-GCM-SHA384", "AES256-GCM-SHA384"]
|
|
101
|
+
</match>
|
|
102
|
+
```
|
|
103
|
+
**Example**: [`examples/ssl-advanced.conf`](examples/ssl-advanced.conf)
|
|
104
|
+
|
|
105
|
+
### ✅ Issue #279 & #270: End of Support / Future Development
|
|
106
|
+
**Problem**: Original plugin reached end-of-life. What are the alternatives?
|
|
107
|
+
|
|
108
|
+
**Our Answer**: **This plugin IS the alternative!**
|
|
109
|
+
- Active maintenance
|
|
110
|
+
- Modern Ruby 3.x support
|
|
111
|
+
- All dependencies updated
|
|
112
|
+
- Regular security updates
|
|
113
|
+
- Bug fixes and enhancements
|
|
114
|
+
|
|
115
|
+
### ✅ Issue #275: CVEs and Security Vulnerabilities
|
|
116
|
+
**Problem**: Multiple CVEs in dependencies.
|
|
117
|
+
|
|
118
|
+
**Our Fix**: All dependencies updated to latest secure versions:
|
|
119
|
+
- `fluentd` >= 1.16
|
|
120
|
+
- `net-http-persistent` >= 4.0 (replaced `httpclient`)
|
|
121
|
+
- `oj` ~> 3.16 (replaced `multi_json`)
|
|
122
|
+
- `prometheus-client` >= 2.1.0
|
|
123
|
+
- No known vulnerabilities
|
|
124
|
+
|
|
125
|
+
See [`GITHUB_ISSUES_ANALYSIS.md`](GITHUB_ISSUES_ANALYSIS.md) for complete issue analysis.
|
|
16
126
|
|
|
17
127
|
## Installation
|
|
18
128
|
|
|
@@ -31,7 +31,7 @@ module Fluent
|
|
|
31
31
|
module Plugin
|
|
32
32
|
# Modernized Splunk HEC output plugin
|
|
33
33
|
class SplunkHecRadiantOutput < Fluent::Plugin::Output
|
|
34
|
-
Fluent::Plugin.register_output("
|
|
34
|
+
Fluent::Plugin.register_output("splunk_hec", self)
|
|
35
35
|
|
|
36
36
|
helpers :formatter
|
|
37
37
|
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: fluent-plugin-splunk-hec-radiant
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.1.
|
|
4
|
+
version: 0.1.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- G. Rahul Nutakki
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2025-
|
|
11
|
+
date: 2025-11-19 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: fluentd
|