fluent-plugin-splunk-hec 1.2.8 → 1.2.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3404443a78707ec84c807cc959de100eefec4c7144f76b4587fa4c02580d300d
-  data.tar.gz: '098eb708f6093e40c59aa597c7f185403f9fb195c03758a726ebd8bcc2fc4468'
+  metadata.gz: 277de2e282c7dfee68431d0b4ca144b8215d68f7210814fff1caadc452527955
+  data.tar.gz: 99bd20f106656d0be1ab6d70c3d1afd4516fbd19995e3edc8c6357f123f18e12
 SHA512:
-  metadata.gz: b7dc521fe94e36ae9e4df51f5a32c936615228a164f76ec9391bd72033aa06d35e8292d8cc95b6025cf880943e56f48c2bebbbc5a9e606e219972528a464c9a3
-  data.tar.gz: 4d6ae8221544453debf6e0dbf1ecbdb9a0774f36ae3d1e4715781ca078a2c0d3ebd2870455ffcd75bdb292d1634a8e71d6034f620c69638d51372f010cac4d46
+  metadata.gz: e8b91a7bfc42ce39100754bd79730a7fad4b27337e9cd70e13ccbc836f05aa98e123714cf268cd8f76bb351b8e409191050d8a9b4856bc088334a7a10f174000
+  data.tar.gz: 8874436fb7b143529994256d7f8d99d0f57c113e40ff1b3907af0a08c802a65372b7550c70d7db35af75c4de9e826385d0f7a663f82f8941062a2f302c46087a

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    fluent-plugin-splunk-hec (1.2.8)
+    fluent-plugin-splunk-hec (1.2.11)
       fluentd (>= 1.4)
       multi_json (~> 1.13)
       net-http-persistent (~> 3.1)
@@ -11,14 +11,13 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activemodel (6.1.4.1)
-      activesupport (= 6.1.4.1)
-    activesupport (6.1.4.1)
+    activemodel (7.0.1)
+      activesupport (= 7.0.1)
+    activesupport (7.0.1)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
-      zeitwerk (~> 2.3)
     addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
     aes_key_wrap (1.1.0)
@@ -30,10 +29,10 @@ GEM
     crack (0.4.5)
       rexml
     docile (1.4.0)
-    fluentd (1.14.2)
+    fluentd (1.14.4)
       bundler
       cool.io (>= 1.4.5, < 2.0.0)
-      http_parser.rb (>= 0.5.1, < 0.8.0)
+      http_parser.rb (>= 0.5.1, < 0.9.0)
       msgpack (>= 1.3.1, < 2.0.0)
       serverengine (>= 2.2.2, < 3.0.0)
       sigdump (~> 0.2.2)
@@ -43,9 +42,9 @@ GEM
       webrick (>= 1.4.2, < 1.8.0)
       yajl-ruby (~> 1.0)
     hashdiff (1.0.1)
-    http_parser.rb (0.7.0)
+    http_parser.rb (0.8.0)
     httpclient (2.8.3)
-    i18n (1.8.11)
+    i18n (1.9.1)
       concurrent-ruby (~> 1.0)
     json-jwt (1.13.0)
       activesupport (>= 4.2)
@@ -54,8 +53,8 @@ GEM
     mail (2.7.1)
       mini_mime (>= 0.1.1)
     mini_mime (1.1.2)
-    minitest (5.14.4)
-    msgpack (1.4.2)
+    minitest (5.15.0)
+    msgpack (1.4.4)
     multi_json (1.15.0)
     net-http-persistent (3.1.0)
       connection_pool (~> 2.2)
@@ -81,7 +80,7 @@ GEM
       rack (>= 2.1.0)
     rake (13.0.6)
     rexml (3.2.5)
-    serverengine (2.2.4)
+    serverengine (2.2.5)
       sigdump (~> 0.2.2)
     sigdump (0.2.4)
     simplecov (0.21.2)
@@ -95,7 +94,7 @@ GEM
       activesupport (>= 3)
       attr_required (>= 0.0.5)
       httpclient (>= 2.4)
-    test-unit (3.5.0)
+    test-unit (3.5.3)
       power_assert
     tzinfo (2.0.4)
       concurrent-ruby (~> 1.0)
@@ -116,7 +115,6 @@ GEM
       hashdiff
     webrick (1.7.0)
     yajl-ruby (1.4.1)
-    zeitwerk (2.5.1)
 
 PLATFORMS
   ruby
@@ -131,4 +129,4 @@ DEPENDENCIES
   webmock (~> 3.5.0)
 
 BUNDLED WITH
-   2.2.30
+   2.3.9

data/VERSION

@@ -1 +1 @@
-1.2.8
+1.2.11

data/lib/fluent/plugin/out_splunk.rb

@@ -1,13 +1,12 @@
 # frozen_string_literal: true
 
-require 'fluent/output'
 require 'fluent/plugin/output'
 require 'fluent/plugin/formatter'
 require 'prometheus/client'
 require 'benchmark'
 
 module Fluent::Plugin
-  class SplunkOutput < Fluent::BufferedOutput
+  class SplunkOutput < Fluent::Plugin::Output
     helpers :formatter
 
     autoload :VERSION, 'fluent/plugin/out_splunk/version'
@@ -100,9 +99,9 @@ module Fluent::Plugin
         write_to_splunk(chunk)
       end
 
-      @metrics[:record_counter].increment(labels: metric_labels, by: chunk.size_of_events)
+      @metrics[:record_counter].increment(labels: metric_labels, by: chunk.size)
       @metrics[:bytes_counter].increment(labels: metric_labels, by: chunk.bytesize)
-      @metrics[:write_records_histogram].observe(chunk.size_of_events, labels: metric_labels)
+      @metrics[:write_records_histogram].observe(chunk.size, labels: metric_labels)
       @metrics[:write_bytes_histogram].observe(chunk.bytesize, labels: metric_labels, )
       @metrics[:write_latency_histogram].observe(t, labels: metric_labels, )
     end
@@ -193,8 +192,8 @@ module Fluent::Plugin
           v = instance_variable_get "@#{f}"
           next unless v
 
-          if v == TAG_PLACEHOLDER
-            instance_variable_set "@#{f}", ->(tag, _) { tag }
+          if v.include? TAG_PLACEHOLDER
+            instance_variable_set "@#{f}", ->(tag, _) { v.gsub(TAG_PLACEHOLDER, tag) }
           else
             instance_variable_set "@#{f}", ->(_, _) { v }
           end

data/lib/fluent/plugin/out_splunk_hec.rb

@@ -31,13 +31,16 @@ module Fluent::Plugin
     config_param :protocol, :enum, list: %i[http https], default: :https
 
     desc 'The hostname/IP to HEC, or HEC load balancer.'
-    config_param :hec_host, :string
+    config_param :hec_host, :string, default: ''
 
     desc 'The port number to HEC, or HEC load balancer.'
     config_param :hec_port, :integer, default: 8088
 
+    desc 'Full url to connect tosplunk. Example: https://mydomain.com:8088/apps/splunk'
+    config_param :full_url, :string, default: ''
+
     desc 'The HEC token.'
-    config_param :hec_token, :string
+    config_param :hec_token, :string, secret: true
 
     desc 'If a connection has not been used for this number of seconds it will automatically be reset upon the next use to avoid attempting to send to a closed connection. nil means no timeout.'
     config_param :idle_timeout, :integer, default: 5
@@ -132,11 +135,15 @@ module Fluent::Plugin
 
     def configure(conf)
       super
-
+      raise Fluent::ConfigError, 'One of `hec_host` or `full_url` is required.' if @hec_host.empty? && @full_url.empty?
       check_metric_configs
       pick_custom_format_method
     end
 
+    def write(chunk)
+      super
+    end
+
     def start
       super
       @conn = Net::HTTP::Persistent.new.tap do |c|
@@ -279,9 +286,17 @@ module Fluent::Plugin
     end
 
     def construct_api
-      URI("#{@protocol}://#{@hec_host}:#{@hec_port}/services/collector")
+      if @full_url.empty?
+        URI("#{@protocol}://#{@hec_host}:#{@hec_port}/services/collector")
+      else
+        URI("#{@full_url.delete_suffix("/")}/services/collector")
+      end
     rescue StandardError
-      raise Fluent::ConfigError, "hec_host (#{@hec_host}) and/or hec_port (#{@hec_port}) are invalid."
+      if @full_url.empty?
+        raise Fluent::ConfigError, "hec_host (#{@hec_host}) and/or hec_port (#{@hec_port}) are invalid."
+      else
+        raise Fluent::ConfigError, "full_url (#{@full_url}) is invalid."
+      end
     end
 
     def new_connection
@@ -312,10 +327,13 @@ module Fluent::Plugin
       post.body = chunk.read
       log.debug { "[Sending] Chunk: #{dump_unique_id_hex(chunk.unique_id)}(#{post.body.bytesize}B)." }
       log.trace { "POST #{@api} body=#{post.body}" }
-
-      t1 = Time.now
-      response = @conn.request @api, post
-      t2 = Time.now
+      begin
+        t1 = Time.now
+        response = @conn.request @api, post
+        t2 = Time.now
+      rescue Net::HTTP::Persistent::Error => e
+        raise e.cause
+      end
 
       raise_err = response.code.to_s.start_with?('5') || (!@consume_chunk_on_4xx_errors && response.code.to_s.start_with?('4'))
 

data/lib/fluent/plugin/out_splunk_ingest_api.rb

@@ -41,6 +41,10 @@ module Fluent::Plugin
       super
     end
 
+    def write(chunk)
+      super
+    end
+
     def construct_api
       uri = "https://#{@ingest_api_host}/#{@ingest_api_tenant}#{@ingest_api_events_endpoint}"
       URI(uri)
@@ -101,7 +105,7 @@ module Fluent::Plugin
     end
 
     def write_to_splunk(chunk)
-      log.trace "#{self.class}: In write() with #{chunk.size_of_events} records and #{chunk.bytesize} bytes "
+      log.trace "#{self.class}: In write() with #{chunk.size} records and #{chunk.bytesize} bytes "
       # ingest API is an array of json objects
       body = "[#{chunk.read.chomp(',')}]"
       @conn ||= new_connection

data/test/fluent/plugin/out_splunk_hec_test.rb

@@ -64,7 +64,7 @@ describe Fluent::Plugin::SplunkHecOutput do
 
   describe 'hec_host validation' do
     describe 'invalid host' do
-      it 'should require hec_host' do
+      it 'should require hec_host or full_url' do
         expect { create_hec_output_driver }.must_raise Fluent::ConfigError
       end
 
@@ -78,6 +78,17 @@ describe Fluent::Plugin::SplunkHecOutput do
     end
   end
 
+  describe 'full_url validation' do
+    describe 'invalid full_url' do
+      it { expect { create_hec_output_driver(full_url: '%bad-host%.com') }.must_raise Fluent::ConfigError }
+    end
+    describe 'good full_url' do
+      it { 
+        expect(create_hec_output_driver('full_url https://splunk.com').instance.full_url).must_equal 'https://splunk.com'
+      }
+    end
+  end
+
   it 'should send request to Splunk' do
     req = verify_sent_events do |batch|
       expect(batch.size).must_equal 2

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-splunk-hec
 version: !ruby/object:Gem::Version
-  version: 1.2.8
+  version: 1.2.11
 platform: ruby
 authors:
 - Splunk Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-11-04 00:00:00.000000000 Z
+date: 2022-03-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fluentd
@@ -221,13 +221,13 @@ signing_key:
 specification_version: 4
 summary: Fluentd plugin for Splunk HEC.
 test_files:
-- test/test_helper.rb
-- test/fluent/plugin/out_splunk_hec_test.rb
 - test/fluent/plugin/out_splunk_ingest_api_test.rb
-- test/lib/webmock/http_lib_adapters/curb_adapter.rb
+- test/fluent/plugin/out_splunk_hec_test.rb
+- test/test_helper.rb
+- test/lib/webmock/http_lib_adapters/excon_adapter.rb
 - test/lib/webmock/http_lib_adapters/em_http_request_adapter.rb
-- test/lib/webmock/http_lib_adapters/http_rb_adapter.rb
 - test/lib/webmock/http_lib_adapters/typhoeus_hydra_adapter.rb
 - test/lib/webmock/http_lib_adapters/manticore_adapter.rb
-- test/lib/webmock/http_lib_adapters/excon_adapter.rb
+- test/lib/webmock/http_lib_adapters/curb_adapter.rb
 - test/lib/webmock/http_lib_adapters/patron_adapter.rb
+- test/lib/webmock/http_lib_adapters/http_rb_adapter.rb