fluent-plugin-splunk-hec 1.2.13 → 1.3.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Gemfile +1 -0
- data/Gemfile.lock +26 -15
- data/VERSION +1 -1
- data/fluent-plugin-splunk-hec.gemspec +1 -1
- data/lib/fluent/plugin/out_splunk_hec.rb +13 -2
- data/test/fluent/plugin/out_splunk_hec_test.rb +30 -0
- data/test/test_helper.rb +11 -0
- metadata +9 -9
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 23746f631e5a9217fca76160c200155878aecdc2402dcaa0dec2b7447f7f5986
|
4
|
+
data.tar.gz: 43e704a9048113bbc9070972a809ab2d689e05ba63c2a1739d35abad1ea7ba08
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 531cb324fcfdbdd81b89abca06d39ec324776dd973c23118eda9df697160980f87f43dd1beded8adec71103f9ed1bcf43ced51b60b30f6ebce032516524c3424
|
7
|
+
data.tar.gz: 27cdfef7e22314183999e93651275da29ca4c473b44d68c8873c458f9fcbf1d7213b1632690d4dd7b923699822cf7b57fd4fdea0b6a48b7dc51767d9785a1176
|
data/Gemfile
CHANGED
data/Gemfile.lock
CHANGED
@@ -1,8 +1,8 @@
|
|
1
1
|
PATH
|
2
2
|
remote: .
|
3
3
|
specs:
|
4
|
-
fluent-plugin-splunk-hec (1.
|
5
|
-
fluentd (>= 1.
|
4
|
+
fluent-plugin-splunk-hec (1.3.0)
|
5
|
+
fluentd (>= 1.5)
|
6
6
|
multi_json (~> 1.13)
|
7
7
|
net-http-persistent (~> 4.0)
|
8
8
|
openid_connect (~> 1.1.8)
|
@@ -11,9 +11,9 @@ PATH
|
|
11
11
|
GEM
|
12
12
|
remote: https://rubygems.org/
|
13
13
|
specs:
|
14
|
-
activemodel (7.0.
|
15
|
-
activesupport (= 7.0.
|
16
|
-
activesupport (7.0.
|
14
|
+
activemodel (7.0.3)
|
15
|
+
activesupport (= 7.0.3)
|
16
|
+
activesupport (7.0.3)
|
17
17
|
concurrent-ruby (~> 1.0, >= 1.0.2)
|
18
18
|
i18n (>= 1.6, < 2)
|
19
19
|
minitest (>= 5.1)
|
@@ -28,13 +28,14 @@ GEM
|
|
28
28
|
cool.io (1.7.1)
|
29
29
|
crack (0.4.5)
|
30
30
|
rexml
|
31
|
+
digest (3.1.0)
|
31
32
|
docile (1.4.0)
|
32
|
-
fluentd (1.
|
33
|
+
fluentd (1.15.1)
|
33
34
|
bundler
|
34
35
|
cool.io (>= 1.4.5, < 2.0.0)
|
35
36
|
http_parser.rb (>= 0.5.1, < 0.9.0)
|
36
37
|
msgpack (>= 1.3.1, < 2.0.0)
|
37
|
-
serverengine (>= 2.
|
38
|
+
serverengine (>= 2.3.0, < 3.0.0)
|
38
39
|
sigdump (~> 0.2.2)
|
39
40
|
strptime (>= 0.2.4, < 1.0.0)
|
40
41
|
tzinfo (>= 1.0, < 3.0)
|
@@ -46,6 +47,7 @@ GEM
|
|
46
47
|
httpclient (2.8.3)
|
47
48
|
i18n (1.10.0)
|
48
49
|
concurrent-ruby (~> 1.0)
|
50
|
+
io-wait (0.2.1)
|
49
51
|
json-jwt (1.13.0)
|
50
52
|
activesupport (>= 4.2)
|
51
53
|
aes_key_wrap
|
@@ -54,10 +56,17 @@ GEM
|
|
54
56
|
mini_mime (>= 0.1.1)
|
55
57
|
mini_mime (1.1.2)
|
56
58
|
minitest (5.15.0)
|
57
|
-
msgpack (1.5.
|
59
|
+
msgpack (1.5.4)
|
58
60
|
multi_json (1.15.0)
|
59
61
|
net-http-persistent (4.0.1)
|
60
62
|
connection_pool (~> 2.2)
|
63
|
+
net-protocol (0.1.2)
|
64
|
+
io-wait
|
65
|
+
timeout
|
66
|
+
net-smtp (0.3.1)
|
67
|
+
digest
|
68
|
+
net-protocol
|
69
|
+
timeout
|
61
70
|
openid_connect (1.1.8)
|
62
71
|
activemodel
|
63
72
|
attr_required (>= 1.0.0)
|
@@ -71,7 +80,7 @@ GEM
|
|
71
80
|
power_assert (2.0.1)
|
72
81
|
prometheus-client (4.0.0)
|
73
82
|
public_suffix (4.0.6)
|
74
|
-
rack (2.2.3)
|
83
|
+
rack (2.2.3.1)
|
75
84
|
rack-oauth2 (1.19.0)
|
76
85
|
activesupport
|
77
86
|
attr_required
|
@@ -80,7 +89,7 @@ GEM
|
|
80
89
|
rack (>= 2.1.0)
|
81
90
|
rake (13.0.6)
|
82
91
|
rexml (3.2.5)
|
83
|
-
serverengine (2.
|
92
|
+
serverengine (2.3.0)
|
84
93
|
sigdump (~> 0.2.2)
|
85
94
|
sigdump (0.2.4)
|
86
95
|
simplecov (0.21.2)
|
@@ -96,14 +105,15 @@ GEM
|
|
96
105
|
httpclient (>= 2.4)
|
97
106
|
test-unit (3.5.3)
|
98
107
|
power_assert
|
99
|
-
|
108
|
+
timeout (0.2.0)
|
109
|
+
tzinfo (2.0.5)
|
100
110
|
concurrent-ruby (~> 1.0)
|
101
|
-
tzinfo-data (1.2022.
|
111
|
+
tzinfo-data (1.2022.2)
|
102
112
|
tzinfo (>= 1.0.0)
|
103
113
|
validate_email (0.1.6)
|
104
114
|
activemodel (>= 3.0)
|
105
115
|
mail (>= 2.2.5)
|
106
|
-
validate_url (1.0.
|
116
|
+
validate_url (1.0.15)
|
107
117
|
activemodel (>= 3.0.0)
|
108
118
|
public_suffix
|
109
119
|
webfinger (1.2.0)
|
@@ -114,7 +124,7 @@ GEM
|
|
114
124
|
crack (>= 0.3.2)
|
115
125
|
hashdiff
|
116
126
|
webrick (1.7.0)
|
117
|
-
yajl-ruby (1.4.
|
127
|
+
yajl-ruby (1.4.3)
|
118
128
|
|
119
129
|
PLATFORMS
|
120
130
|
ruby
|
@@ -123,10 +133,11 @@ DEPENDENCIES
|
|
123
133
|
bundler (~> 2.0)
|
124
134
|
fluent-plugin-splunk-hec!
|
125
135
|
minitest (~> 5.0)
|
136
|
+
net-smtp
|
126
137
|
rake (>= 12.0)
|
127
138
|
simplecov
|
128
139
|
test-unit (~> 3.0)
|
129
140
|
webmock (~> 3.5.0)
|
130
141
|
|
131
142
|
BUNDLED WITH
|
132
|
-
2.3.
|
143
|
+
2.3.20
|
data/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
1.
|
1
|
+
1.3.0
|
@@ -33,7 +33,7 @@ Gem::Specification.new do |spec|
|
|
33
33
|
|
34
34
|
spec.required_ruby_version = '>= 2.3.0'
|
35
35
|
|
36
|
-
spec.add_runtime_dependency 'fluentd', '>= 1.
|
36
|
+
spec.add_runtime_dependency 'fluentd', '>= 1.5'
|
37
37
|
spec.add_runtime_dependency 'multi_json', '~> 1.13'
|
38
38
|
spec.add_runtime_dependency 'net-http-persistent', '~> 4.0'
|
39
39
|
spec.add_runtime_dependency 'openid_connect', '~> 1.1.8'
|
@@ -9,6 +9,7 @@ require 'fluent/plugin/out_splunk'
|
|
9
9
|
require 'openssl'
|
10
10
|
require 'multi_json'
|
11
11
|
require 'net/http/persistent'
|
12
|
+
require 'zlib'
|
12
13
|
|
13
14
|
module Fluent::Plugin
|
14
15
|
class SplunkHecOutput < SplunkOutput
|
@@ -96,6 +97,9 @@ module Fluent::Plugin
|
|
96
97
|
desc 'When set to true, all fields defined in `index_key`, `host_key`, `source_key`, `sourcetype_key`, `metric_name_key`, `metric_value_key` will not be removed from the original event.'
|
97
98
|
config_param :keep_keys, :bool, default: false
|
98
99
|
|
100
|
+
desc 'Indicates if GZIP Compression is enabled.'
|
101
|
+
config_param :gzip_compression, :bool, default: false
|
102
|
+
|
99
103
|
desc 'App name'
|
100
104
|
config_param :app_name, :string, default: "hec_plugin_gem"
|
101
105
|
|
@@ -321,13 +325,20 @@ module Fluent::Plugin
|
|
321
325
|
c.override_headers['Authorization'] = "Splunk #{@hec_token}"
|
322
326
|
c.override_headers['__splunk_app_name'] = "#{@app_name}"
|
323
327
|
c.override_headers['__splunk_app_version'] = "#{@app_version}"
|
324
|
-
|
325
328
|
end
|
326
329
|
end
|
327
330
|
|
328
331
|
def write_to_splunk(chunk)
|
329
332
|
post = Net::HTTP::Post.new @api.request_uri
|
330
|
-
|
333
|
+
if @gzip_compression
|
334
|
+
post.add_field("Content-Encoding", "gzip")
|
335
|
+
gzip_stream = Zlib::GzipWriter.new StringIO.new
|
336
|
+
gzip_stream << chunk.read
|
337
|
+
post.body = gzip_stream.close.string
|
338
|
+
else
|
339
|
+
post.body = chunk.read
|
340
|
+
end
|
341
|
+
|
331
342
|
log.debug { "[Sending] Chunk: #{dump_unique_id_hex(chunk.unique_id)}(#{post.body.bytesize}B)." }
|
332
343
|
log.trace { "POST #{@api} body=#{post.body}" }
|
333
344
|
begin
|
@@ -60,6 +60,12 @@ describe Fluent::Plugin::SplunkHecOutput do
|
|
60
60
|
it 'should consume chunks on 4xx errors' do
|
61
61
|
expect(create_hec_output_driver('hec_host hec_token').instance.consume_chunk_on_4xx_errors).must_equal true
|
62
62
|
end
|
63
|
+
it 'should default gzip off' do
|
64
|
+
expect(create_hec_output_driver('hec_host hec_token').instance.gzip_compression).must_equal false
|
65
|
+
end
|
66
|
+
it 'should support enabling gzip' do
|
67
|
+
expect(create_hec_output_driver('hec_host hec_token', 'gzip_compression true').instance.gzip_compression).must_equal true
|
68
|
+
end
|
63
69
|
end
|
64
70
|
|
65
71
|
describe 'hec_host validation' do
|
@@ -357,6 +363,15 @@ describe Fluent::Plugin::SplunkHecOutput do
|
|
357
363
|
end
|
358
364
|
end
|
359
365
|
|
366
|
+
describe 'gzip encoding' do
|
367
|
+
it 'should include gzip header when enabled' do
|
368
|
+
metrics = [
|
369
|
+
['tag', event_time, { 'cup': 0.5, 'memory': 100 }]
|
370
|
+
]
|
371
|
+
with_stub_hec_gzip(events: metrics, conf: 'data_type metric')
|
372
|
+
end
|
373
|
+
end
|
374
|
+
|
360
375
|
def with_stub_hec(events:, conf: '')
|
361
376
|
host = 'hec.splunk.com'
|
362
377
|
@driver = create_hec_output_driver("hec_host #{host}", conf)
|
@@ -372,6 +387,21 @@ describe Fluent::Plugin::SplunkHecOutput do
|
|
372
387
|
hec_req
|
373
388
|
end
|
374
389
|
|
390
|
+
def with_stub_hec_gzip(events:, conf: '')
|
391
|
+
host = 'hec.splunk.com'
|
392
|
+
@driver = create_hec_output_driver("hec_host #{host}", 'gzip_compression true', conf)
|
393
|
+
|
394
|
+
hec_req = stub_hec_gzip_request("https://#{host}:8088").with do |r|
|
395
|
+
yield r.body.split(/(?={)\s*(?<=})/).map { |item| JSON.load item }
|
396
|
+
end
|
397
|
+
|
398
|
+
@driver.run do
|
399
|
+
events.each { |evt| @driver.feed *evt }
|
400
|
+
end
|
401
|
+
|
402
|
+
hec_req
|
403
|
+
end
|
404
|
+
|
375
405
|
def verify_sent_events(conf = '', &blk)
|
376
406
|
event = {
|
377
407
|
'log' => 'everything is good',
|
data/test/test_helper.rb
CHANGED
@@ -42,4 +42,15 @@ module PluginTestHelper
|
|
42
42
|
'User-Agent' => "fluent-plugin-splunk_hec_out/#{Fluent::Plugin::SplunkHecOutput::VERSION}" })
|
43
43
|
.to_return(body: '{"text":"Success","code":0}')
|
44
44
|
end
|
45
|
+
|
46
|
+
def stub_hec_gzip_request(endpoint)
|
47
|
+
stub_request(:post, "#{endpoint}/services/collector")
|
48
|
+
.with(headers: {
|
49
|
+
'Authorization' => "Splunk #{TEST_HEC_TOKEN}",
|
50
|
+
'User-Agent' => "fluent-plugin-splunk_hec_out/#{Fluent::Plugin::SplunkHecOutput::VERSION}",
|
51
|
+
'Content-Encoding' => "gzip"
|
52
|
+
},
|
53
|
+
)
|
54
|
+
.to_return(body: '{"text":"GzipSuccess","code":0}')
|
55
|
+
end
|
45
56
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fluent-plugin-splunk-hec
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.
|
4
|
+
version: 1.3.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Splunk Inc.
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2022-
|
11
|
+
date: 2022-08-16 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: fluentd
|
@@ -16,14 +16,14 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - ">="
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: '1.
|
19
|
+
version: '1.5'
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - ">="
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: '1.
|
26
|
+
version: '1.5'
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: multi_json
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
@@ -221,13 +221,13 @@ signing_key:
|
|
221
221
|
specification_version: 4
|
222
222
|
summary: Fluentd plugin for Splunk HEC.
|
223
223
|
test_files:
|
224
|
-
- test/
|
225
|
-
- test/lib/webmock/http_lib_adapters/patron_adapter.rb
|
224
|
+
- test/test_helper.rb
|
226
225
|
- test/lib/webmock/http_lib_adapters/excon_adapter.rb
|
227
|
-
- test/lib/webmock/http_lib_adapters/em_http_request_adapter.rb
|
228
226
|
- test/lib/webmock/http_lib_adapters/typhoeus_hydra_adapter.rb
|
229
|
-
- test/lib/webmock/http_lib_adapters/
|
227
|
+
- test/lib/webmock/http_lib_adapters/manticore_adapter.rb
|
230
228
|
- test/lib/webmock/http_lib_adapters/curb_adapter.rb
|
231
|
-
- test/
|
229
|
+
- test/lib/webmock/http_lib_adapters/http_rb_adapter.rb
|
230
|
+
- test/lib/webmock/http_lib_adapters/em_http_request_adapter.rb
|
231
|
+
- test/lib/webmock/http_lib_adapters/patron_adapter.rb
|
232
232
|
- test/fluent/plugin/out_splunk_hec_test.rb
|
233
233
|
- test/fluent/plugin/out_splunk_ingest_api_test.rb
|