fluent-plugin-splunk-hec 1.0.1 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a5e33a0b115b4d515ce94f1bf904bddf192994ff1b54fb624f5ea9d470bb4cd
-  data.tar.gz: 306d2647c27a63e98d3f530eacf2abd0fd16cd5f7f23213291ff061a11d4fb92
+  metadata.gz: 4460c822fc2a85e65234099aca29574dcdc17e4403c3fbc1da7c48d4a5fd9608
+  data.tar.gz: 9950c15e61273b9dcd597c8fc3ff83dad5be0f7f741bb67a5b296ccd98c1a366
 SHA512:
-  metadata.gz: a813d1d0ef4e157c95c49a0f75641e51af2a18d56c02020ec702a06a4d48fad02cb7e60f044637adfc261d8ec6fce21775ef38aa6215e8dea5cdb850c2faa74c
-  data.tar.gz: 584ffa55837e358d705780cdd01f86bcd3245fe3ebcc4f3f0f999ae03fa5634443db531cb1a51ac806402399cac7d1f6d9ed43f612b4c331de445a9df6376172
+  metadata.gz: 39fcf467dea44451264c3a56e0ab1442b196ab7c424112969e997567174ba9b4e0ce1def62535bb72a5a5af88d45ac16f53273cc590c2c9636d57e927e7b6b2e
+  data.tar.gz: d50f4a1df76c1d2661d387cfdedb0e47d4621526b7e94b73a0e06c3965b38c9b53ca87a83f48df60f64da553ec62c1bd9bbae1301b9677f0c7dbd316bbf1fa2f

data/Gemfile

@@ -1,6 +1,10 @@
-source "https://rubygems.org"
+source 'https://rubygems.org'
 
-git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
+group :test do
+  gem 'simplecov', require: false
+end
+
+git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 
 # Specify your gem's dependencies in fluent-plugin-splunk_hec_output.gemspec
 gemspec

data/Gemfile.lock

@@ -1,22 +1,23 @@
 PATH
   remote: .
   specs:
-    fluent-plugin-splunk-hec (1.0.0)
-      fluentd (~> 1.0)
+    fluent-plugin-splunk-hec (1.1.0)
+      fluentd (~> 1.4)
       multi_json (~> 1.13)
       net-http-persistent (~> 3.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.5.2)
+    addressable (2.6.0)
       public_suffix (>= 2.0.2, < 4.0)
-    connection_pool (2.2.1)
+    connection_pool (2.2.2)
     cool.io (1.5.3)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
     dig_rb (1.0.1)
-    fluentd (1.1.0)
+    docile (1.3.1)
+    fluentd (1.4.0)
       cool.io (>= 1.4.5, < 2.0.0)
       dig_rb (~> 1.0.0)
       http_parser.rb (>= 0.5.1, < 0.7.0)
@@ -27,44 +28,51 @@ GEM
       tzinfo (~> 1.0)
       tzinfo-data (~> 1.0)
       yajl-ruby (~> 1.0)
-    hashdiff (0.3.7)
+    hashdiff (0.3.8)
     http_parser.rb (0.6.0)
+    json (2.1.0)
     minitest (5.11.3)
-    msgpack (1.2.2)
+    msgpack (1.2.7)
     multi_json (1.13.1)
     net-http-persistent (3.0.0)
       connection_pool (~> 2.2)
-    power_assert (1.1.1)
-    public_suffix (3.0.2)
-    rake (10.5.0)
+    power_assert (1.1.3)
+    public_suffix (3.0.3)
+    rake (12.3.2)
     safe_yaml (1.0.4)
-    serverengine (2.0.6)
+    serverengine (2.1.0)
       sigdump (~> 0.2.2)
     sigdump (0.2.4)
+    simplecov (0.16.1)
+      docile (~> 1.1)
+      json (>= 1.8, < 3)
+      simplecov-html (~> 0.10.0)
+    simplecov-html (0.10.2)
     strptime (0.2.3)
-    test-unit (3.2.7)
+    test-unit (3.3.0)
       power_assert
     thread_safe (0.3.6)
     tzinfo (1.2.5)
       thread_safe (~> 0.1)
-    tzinfo-data (1.2018.3)
+    tzinfo-data (1.2018.9)
       tzinfo (>= 1.0.0)
-    webmock (3.3.0)
+    webmock (3.5.1)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)
       hashdiff
-    yajl-ruby (1.3.1)
+    yajl-ruby (1.4.1)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
-  bundler (~> 1.16)
+  bundler (~> 2.0)
   fluent-plugin-splunk-hec!
   minitest (~> 5.0)
-  rake (~> 10.0)
+  rake (~> 12.0)
+  simplecov
   test-unit (~> 3.0)
-  webmock (~> 3.2)
+  webmock (~> 3.5.0)
 
 BUNDLED WITH
-   1.16.1
+   2.0.1

data/README.md

@@ -1,4 +1,4 @@
-[ ![Codeship Status for splunk/fluent-plugin-splunk-hec](https://app.codeship.com/projects/7905e540-105f-0136-dde3-2adac7655f3e/status?branch=master)](https://app.codeship.com/projects/282733)
+[![CircleCI](https://circleci.com/gh/git-lfs/git-lfs.svg?style=shield&circle-token=856152c2b02bfd236f54d21e1f581f3e4ebf47ad)](https://circleci.com/gh/splunk/fluent-plugin-splunk-hec)
 # fluent-plugin-splunk-hec
 
 [Fluentd](https://fluentd.org/) output plugin to send events and metrics to [Splunk](https://www.splunk.com) over the HEC (HTTP Event Collector) API.
@@ -6,11 +6,9 @@
 ## Installation
 
 ### RubyGems
-
-```
+``` 
 $ gem install fluent-plugin-splunk-hec
 ```
-
 ### Bundler
 
 Add following line to your Gemfile:
@@ -334,6 +332,22 @@ If you want to use a different default formatter, you can add a `<format **>` (o
 
 Defines which formatter to use.
 
+### Net::HTTP::Persistent parameters (optional)
+
+The following parameters can be used for tuning HTTP connections
+
+#### idle_timeout (integer)
+
+The default is 5 seconds. If a connection has not been used for this number of seconds it will automatically be reset upon the next use to avoid attempting to send to a closed connection; nil means no timeout. 
+
+#### read_timeout (integer)
+
+The default is nil. The amount of time allowed between reading two chunks from the socket.
+
+#### open_timeout (integer)
+
+The default is nil. The amount of time to wait for a connection to be opened.
+
 ### SSL parameters
 
 There are quite some parameters you can use to configure SSL (for HTTPS protocol).
@@ -372,10 +386,10 @@ It batches all events in a chunk in one request. So you need to configure the `<
 Here are some hints:
 
 * Read through the [fluentd buffer document](https://docs.fluentd.org/v1.0/articles/buffer-section) to understand the buffer configurations.
-* Use `chunk_limit_size` and/or `chunk_limit_records` to define how big a chunk can be. And remeber that all events in a chunk will be sent in one request.
+* Use `chunk_limit_size` and/or `chunk_limit_records` to define how big a chunk can be. And remember that all events in a chunk will be sent in one request.
 * Splunk has a limit on how big the payload of a HEC request can be. And it's defined with `max_content_length` in [the `[http_input]` section of `limits.conf`](https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Bhttp_input.5D). In Splunk of version 6.5.0+, the default value is 800MiB, while in versions before 6.5.0, it's just 1MB. Make sure your chunk size won't exceed this limit, or you should change the limit on your Splunk deployment.
-* Sending requests to HEC takes time, so if you flush your fluentd buffer too fast (for example, with a very small `flush_interval`), it's possible that the plugin cannot catch up with the buffer flushing. There are two ways you can handle this situdation, one is to increase the `flush_interval` or use multiple flush threads by setting `flush_thread_count` to a number bigger than 1.
+* Sending requests to HEC takes time, so if you flush your fluentd buffer too fast (for example, with a very small `flush_interval`), it's possible that the plugin cannot catch up with the buffer flushing. There are two ways you can handle this situation, one is to increase the `flush_interval` or use multiple flush threads by setting `flush_thread_count` to a number bigger than 1.
 
 ## License
 
-Please see [LICENSE](LICENSE).
+Please see [LICENSE](LICENSE). 

data/Rakefile

@@ -1,10 +1,12 @@
-require "bundler/gem_tasks"
-require "rake/testtask"
+require 'bundler/gem_tasks'
+require 'rake/testtask'
 
 Rake::TestTask.new(:test) do |t|
-  t.libs << "test"
-  t.libs << "lib"
-  t.test_files = FileList["test/**/*_test.rb"]
+  t.libs << 'test'
+  t.libs << 'lib'
+  t.test_files = FileList['test/**/*_test.rb']
+  t.verbose = false
+  t.warning = false
 end
 
 task :default => :test

data/VERSION

@@ -1 +1 @@
-1.0.1
+1.1.0

data/fluent-plugin-splunk-hec.gemspec

@@ -1,16 +1,18 @@
 Gem::Specification.new do |spec|
-  spec.name          = "fluent-plugin-splunk-hec"
-  spec.version       = File.read("VERSION")
-  spec.authors       = ["Zhimin (Gimi) Liang"]
-  spec.email         = ["zliang@splunk.com"]
+  spec.name          = 'fluent-plugin-splunk-hec'
+  spec.version       = File.read('VERSION')
+  spec.authors       = ['Splunk Inc.']
+  spec.email         = ['DataEdge@splunk.com']
 
-  spec.summary       = %q{Fluentd plugin for Splunk HEC.}
-  spec.description   = %q{A fluentd output plugin created by Splunk that writes events to splunk indexers over HTTP Event Collector API.}
-  spec.homepage      = "https://github.com/splunk/fluent-plugin-splunk-hec"
-  spec.license       = "Apache-2.0"
+  spec.summary       = 'Fluentd plugin for Splunk HEC.'
+  spec.description   = 'A fluentd output plugin created by Splunk
+  that writes events to splunk indexers over HTTP Event Collector API.'
+  spec.homepage      = 'https://github.com/splunk/fluent-plugin-splunk-hec'
+  spec.license       = 'Apache-2.0'
 
-  # Prevent pushing this gem to RubyGems.org. To allow pushes either set the 'allowed_push_host'
-  # to allow pushing to a single host or delete this section to allow pushing to any host.
+  # Prevent pushing this gem to RubyGems.org.
+  # To allow pushes either set the 'allowed_push_host' to allow
+  # pushing to a single host or delete this section to allow pushing to any host.
   # if spec.respond_to?(:metadata)
   #   spec.metadata["allowed_push_host"] = "TODO: Set to 'http://mygemserver.com'"
   # else
@@ -18,7 +20,7 @@ Gem::Specification.new do |spec|
   #     "public gem pushes."
   # end
 
-  spec.require_paths = ["lib"]
+  spec.require_paths = ['lib']
   spec.test_files    = Dir.glob('test/**/**.rb')
   spec.files         = %w[
     CODE_OF_CONDUCT.md README.md LICENSE
@@ -27,15 +29,17 @@ Gem::Specification.new do |spec|
     Rakefile VERSION
   ] + Dir.glob('lib/**/**').reject(&File.method(:directory?))
 
-  spec.required_ruby_version = '>= 2.4.0'
+  spec.required_ruby_version = '>= 2.3.0'
 
-  spec.add_runtime_dependency "fluentd", "~> 1.0"
-  spec.add_runtime_dependency "multi_json", "~> 1.13"
-  spec.add_runtime_dependency "net-http-persistent", "~> 3.0"
+  spec.add_runtime_dependency 'fluentd', '~> 1.4'
+  spec.add_runtime_dependency 'multi_json', '~> 1.13'
+  spec.add_runtime_dependency 'net-http-persistent', '~> 3.0'
 
-  spec.add_development_dependency "bundler", "~> 1.16"
-  spec.add_development_dependency "rake", "~> 10.0"
-  spec.add_development_dependency "test-unit", "~> 3.0" # required by fluent/test.rb
-  spec.add_development_dependency "minitest", "~> 5.0"
-  spec.add_development_dependency "webmock", "~> 3.2"
+  spec.add_development_dependency 'bundler', '~> 2.0'
+  spec.add_development_dependency 'rake', '~> 12.0'
+  # required by fluent/test.rb
+  spec.add_development_dependency 'test-unit', '~> 3.0'
+  spec.add_development_dependency 'minitest', '~> 5.0'
+  spec.add_development_dependency 'webmock', '~> 3.5.0'
+  spec.add_development_dependency 'simplecov', '~> 0.16.1'
 end

data/lib/fluent/plugin/out_splunk_hec.rb

@@ -16,7 +16,7 @@ module Fluent::Plugin
     autoload :VERSION, "fluent/plugin/out_splunk_hec/version"
     autoload :MatchFormatter, "fluent/plugin/out_splunk_hec/match_formatter"
 
-    KEY_FIELDS = %w[index host source sourcetype metric_name metric_value].freeze
+    KEY_FIELDS = %w[index time host source sourcetype metric_name metric_value].freeze
     TAG_PLACEHOLDER = '${tag}'.freeze
 
     MISSING_FIELD = Hash.new { |h, k|
@@ -36,6 +36,15 @@ module Fluent::Plugin
     desc 'The HEC token.'
     config_param :hec_token, :string
 
+    desc 'If a connection has not been used for this number of seconds it will automatically be reset upon the next use to avoid attempting to send to a closed connection. nil means no timeout.'
+    config_param :idle_timeout, :integer, default: 5
+
+    desc 'The amount of time allowed between reading two chunks from the socket.'
+    config_param :read_timeout, :integer, default: nil
+
+    desc 'The amount of time to wait for a connection to be opened.'
+    config_param :open_timeout, :integer, default: nil
+
     desc 'The path to a file containing a PEM-format CA certificate for this client.'
     config_param :client_cert, :string, default: nil
 
@@ -60,6 +69,9 @@ module Fluent::Plugin
     desc 'The Splunk index to index events. When not set, will be decided by HEC. This is exclusive with `index_key`'
     config_param :index, :string, default: nil
 
+    desc 'Field name to contain Splunk event time. By default will use fluentd\'d time'
+    config_param :time_key, :string, default: nil
+
     desc 'Field name to contain Splunk index name. This is exclusive with `index`.'
     config_param :index_key, :string, default: nil
 
@@ -113,7 +125,7 @@ module Fluent::Plugin
     config_param :coerce_to_utf8, :bool, :default => true
 
     desc <<~DESC
-    If `coerce_to_utf8` is set to true, any non-UTF-8 character would be
+    If `coerce_to_utf8` is set to true, any not-UTF-8 char's would be
     replaced by the string specified here.
     DESC
     config_param :non_utf8_replacement_string, :string, :default => ' '
@@ -237,9 +249,18 @@ module Fluent::Plugin
 	# From the API reference
 	# http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTinput#services.2Fcollector
 	# `time` should be a string or unsigned integer.
-	# That's why we use `to_s` here.
+	# That's why we use the to_string function here.
 	time: time.to_f.to_s
       }.tap { |payload|
+
+        if @time
+          time_value = @time.(tag, record)
+          # if no value is found don't override and use fluentd's time
+          if !time_value.nil?
+            payload[:time] = time_value
+          end
+        end
+
 	payload[:index] = @index.(tag, record) if @index
 	payload[:source] = @source.(tag, record) if @source
 	payload[:sourcetype] = @sourcetype.(tag, record) if @sourcetype
@@ -248,8 +269,8 @@ module Fluent::Plugin
 	%i[host index source sourcetype].each { |f| payload.delete f if payload[f].nil? }
 
 	if @extra_fields
-	  payload[:fields] = @extra_fields.map { |name, field| [name, record[field]] }.to_h
-	  payload[:fields].compact!
+    payload[:fields] = @extra_fields.map { |name, field| [name, record[field]] }.to_h
+    payload[:fields].delete_if { |_k,v| v.nil? }
 	  # if a field is already in indexed fields, then remove it from the original event
 	  @extra_fields.values.each { |field| record.delete field }
 	end
@@ -286,7 +307,7 @@ module Fluent::Plugin
 	  fields.update record
 	end
 
-	fields.compact!
+  fields.delete_if { |_k,v| v.nil? }
 
 	payload[:fields] = convert_to_utf8 fields
 
@@ -315,6 +336,9 @@ module Fluent::Plugin
         c.ca_file = @ca_file
         c.ca_path = @ca_path
         c.ciphers = @ssl_ciphers
+        c.idle_timeout = @idle_timeout
+        c.read_timeout = @read_timeout
+        c.open_timeout = @open_timeout
 
         c.override_headers['Content-Type'] = 'application/json'
         c.override_headers['User-Agent'] = "fluent-plugin-splunk_hec_out/#{VERSION}"
@@ -375,7 +399,7 @@ module Fluent::Plugin
 		     'replace them with spaces, please set "coerce_to_utf8" ' \
 		     'to true.' }
 	  raise
-	end
+  end
       end
     end
   end

data/lib/fluent/plugin/out_splunk_hec/match_formatter.rb

@@ -2,13 +2,16 @@ require 'fluent/match'
 
 class Fluent::Plugin::SplunkHecOutput::MatchFormatter
   def initialize(pattern, formatter)
-    # stolen from fluentd/lib/fluent/event_router.rb
-    patterns = pattern.split(/\s+/).map { |str| Fluent::MatchPattern.create(str) }
-    @pattern = if patterns.length == 1
-		 patterns[0]
-	       else
-		 Fluent::OrMatchPattern.new(patterns)
-	       end
+    # based on fluentd/lib/fluent/event_router.rb
+    patterns = pattern.split(/\s+/).map { |str|
+      Fluent::MatchPattern.create(str)
+    }
+    @pattern =
+      if patterns.length == 1
+        patterns[0]
+      else
+        Fluent::OrMatchPattern.new(patterns)
+      end
     @formatter = formatter
   end
 

data/lib/fluent/plugin/out_splunk_hec/version.rb

@@ -1 +1,3 @@
-Fluent::Plugin::SplunkHecOutput::VERSION = File.read(File.expand_path('../../../../VERSION', File.dirname(__FILE__))).chomp.strip
+Fluent::Plugin::SplunkHecOutput::VERSION = File.read(
+  File.expand_path('../../../../VERSION', File.dirname(__FILE__))
+).chomp.strip

data/test/fluent/plugin/out_splunk_hec_test.rb

@@ -8,10 +8,59 @@ describe Fluent::Plugin::SplunkHecOutput do
     
   it { expect(::Fluent::Plugin::SplunkHecOutput::VERSION).wont_be_nil }
 
+  describe "config param tests" do
+      it "should require https protocol" do
+        expect(create_output_driver('hec_host protocol').instance.protocol).must_equal :https
+      end
+      it "should require hec_host" do
+        expect(create_output_driver('hec_host hec_host').instance.hec_host).must_equal "hec_host"
+      end
+      it "should require hec_port" do
+        expect(create_output_driver('hec_host hec_port').instance.hec_port).must_equal 8088
+      end
+      it "should require hec_token" do
+        expect(create_output_driver('hec_host hec_token').instance.hec_token).must_equal "some-token"
+      end
+      it "should define client_cert as nil initially" do
+        assert_nil(create_output_driver('hec_host hec_token').instance.client_cert)
+      end
+      it "should define client_key as nil (string) initially" do
+        assert_nil(create_output_driver('hec_host hec_token').instance.client_key)
+        expect(create_output_driver('hec_host hec_token').instance.client_key).is_a? String
+      end
+      it "should define ca_file as nil (string) initially" do
+        assert_nil(create_output_driver('hec_host hec_token').instance.ca_file)
+        expect(create_output_driver('hec_host hec_token').instance.ca_file).is_a? String
+      end
+      it "should define ca_path as nil (string) initially" do
+        assert_nil(create_output_driver('hec_host hec_token').instance.ca_path)
+        expect(create_output_driver('hec_host hec_token').instance.ca_path).is_a? String
+      end
+      it "should define ssl_ciphers as nil (array) initially" do
+        assert_nil(create_output_driver('hec_host hec_token').instance.ssl_ciphers)
+        expect(create_output_driver('hec_host hec_token').instance.ssl_ciphers).is_a? Array
+      end
+      it "should not allow an insecure ssl connection" do
+        expect(create_output_driver('hec_host hec_token').instance.insecure_ssl).must_equal false
+      end
+      it "should allow both event (default) and metric to be sent to splunk" do
+        expect(create_output_driver('hec_host hec_token').instance.data_type).must_equal :event
+        expect(create_output_driver('hec_host hec_token').instance.data_type = :metric).must_equal :metric
+      end
+      it "should define Splunk index to index (string) as nil initially" do
+        assert_nil(create_output_driver('hec_host hec_token').instance.index)
+        expect(create_output_driver('hec_host hec_token').instance.index).is_a? String
+      end
+      it "should define field names to include Splunk index_key as nil (string) initially" do
+        assert_nil(create_output_driver('hec_host hec_token').instance.index_key)
+        expect(create_output_driver('hec_host hec_token').instance.index_key).is_a? String
+      end
+  end
+
   describe "hec_host validation" do
     describe "invalid host" do
       it "should require hec_host" do
-	expect{ create_output_driver }.must_raise Fluent::ConfigError
+	      expect{ create_output_driver }.must_raise Fluent::ConfigError
       end
 
       it { expect{ create_output_driver('hec_host %bad-host%') }.must_raise Fluent::ConfigError }
@@ -19,7 +68,7 @@ describe Fluent::Plugin::SplunkHecOutput do
 
     describe "good host" do
       it {
-	expect(create_output_driver('hec_host splunk.com').instance.hec_host).must_equal "splunk.com"
+	      expect(create_output_driver('hec_host splunk.com').instance.hec_host).must_equal "splunk.com"
       }
     end
   end
@@ -34,16 +83,25 @@ describe Fluent::Plugin::SplunkHecOutput do
   it "should use string for event time, and the value of the string should be a float" do
     verify_sent_events { |batch|
       batch.each do |item|
-	expect(item['time']).must_be_instance_of String
-	expect(item['time']).must_match /^\d+\.\d+$/
+        expect(item['time']).must_be_instance_of String
+        expect(item['time']).must_match /^\d+\.\d+$/
       end
     }
   end
 
+  # it "should contain splunk event time field via fluentd, as nil" do
+  #   expect(create_output_driver('hec_host splunk.com').instance.time_key).must_equal nil
+  # end
+  #
+  it "should contain splunk event time field via fluentd, as nil" do
+        test_driver = create_output_driver('hec_host splunk.com')
+        assert_nil(test_driver.instance.time_key)
+  end
+
   it "should use host machine's hostname for event host by default" do
     verify_sent_events { |batch|
       batch.each do |item|
-	expect(item['host']).must_equal Socket.gethostname
+	      expect(item['host']).must_equal Socket.gethostname
       end
     }
   end
@@ -51,9 +109,9 @@ describe Fluent::Plugin::SplunkHecOutput do
   %w[index source sourcetype].each do |field|
     it "should not set #{field} by default" do
       verify_sent_events { |batch|
-	batch.each do |item|
-	  expect(item).wont_include field
-	end
+	    batch.each do |item|
+        expect(item).wont_include field
+	    end
       }
     end
   end
@@ -66,9 +124,9 @@ describe Fluent::Plugin::SplunkHecOutput do
     sourcetype ${tag}
     CONF
       batch.each do |item|
-	%w[index host source sourcetype].each { |field|
-	  expect(%w[tag.event1 tag.event2]).must_include item[field]
-	}
+	    %w[index host source sourcetype].each { |field|
+	      expect(%w[tag.event1 tag.event2]).must_include item[field]
+	    }
       end
     }
   end
@@ -81,10 +139,10 @@ describe Fluent::Plugin::SplunkHecOutput do
       sourcetype_key agent.name
     CONF
       batch.each { |item|
-	expect(item['index']).must_equal 'info'
-	expect(item['host']).must_equal 'my_machine'
-	expect(item['source']).must_equal 'cool.log'
-	expect(item['sourcetype']).must_equal 'test'
+        expect(item['index']).must_equal 'info'
+        expect(item['host']).must_equal 'my_machine'
+        expect(item['source']).must_equal 'cool.log'
+        expect(item['sourcetype']).must_equal 'test'
 
 	JSON.load(item['event']).tap do |event|
 	  %w[level from file].each { |field| expect(event).wont_include field }
@@ -94,7 +152,7 @@ describe Fluent::Plugin::SplunkHecOutput do
     }
   end
 
-  it "should remove nil fileds." do
+  it "should remove nil fields." do
     verify_sent_events(<<~CONF) { |batch|
       index_key      nonexist
       host_key       nonexist
@@ -111,7 +169,7 @@ describe Fluent::Plugin::SplunkHecOutput do
   end
 
   describe 'formatter' do
-    it "should support replace the default json formater" do
+    it "should support replace the default json formatter" do
       verify_sent_events(<<~CONF) { |batch|
 	<format>
 	  @type single_value
@@ -163,86 +221,107 @@ describe Fluent::Plugin::SplunkHecOutput do
   describe 'metric'do
     it 'should check related configs' do
       expect(
-	create_output_driver('hec_host somehost', 'data_type metric')
+	      create_output_driver('hec_host somehost', 'data_type metric')
       ).wont_be_nil
 
       expect{
-	create_output_driver('hec_host somehost', 'data_type metric', 'metrics_from_event false')
+	      create_output_driver('hec_host somehost', 'data_type metric', 'metrics_from_event false')
       }.must_raise Fluent::ConfigError
 
       expect{
-	create_output_driver('hec_host somehost', 'data_type metric', 'metric_name_key x')
+	      create_output_driver('hec_host somehost', 'data_type metric', 'metric_name_key x')
       }.must_raise Fluent::ConfigError
 
       expect(
-	create_output_driver('hec_host somehost', 'data_type metric', 'metric_name_key x', 'metric_value_key y')
+	      create_output_driver('hec_host somehost', 'data_type metric', 'metric_name_key x', 'metric_value_key y')
       ).wont_be_nil
     end
 
     it 'should have "metric" as event, and have proper fields' do
       verify_sent_events(<<~CONF) { |batch|
-	data_type metric
-	metric_name_key from
-	metric_value_key value
+      data_type metric
+      metric_name_key from
+      metric_value_key value
       CONF
-        batch.each do |item|
-	  expect(item['event']).must_equal 'metric'
-	  expect(item['fields']['metric_name']).must_equal 'my_machine'
-	  expect(item['fields']['_value']).must_equal 100
-	  expect(item['fields']['log']).must_equal 'everything is good'
-	  expect(item['fields']['level']).must_equal 'info'
-	  expect(item['fields']['file']).must_equal 'cool.log'
-	end
+      batch.each do |item|
+        expect(item['event']).must_equal 'metric'
+        expect(item['fields']['metric_name']).must_equal 'my_machine'
+        expect(item['fields']['_value']).must_equal 100
+        expect(item['fields']['log']).must_equal 'everything is good'
+        expect(item['fields']['level']).must_equal 'info'
+        expect(item['fields']['file']).must_equal 'cool.log'
+	    end
       }
     end
 
     it 'should handle empty fields' do
       verify_sent_events(<<~CONF) { |batch|
-	data_type metric
-	metric_name_key from
-	metric_value_key value
-	<fields>
-	</fields>
+      data_type metric
+      metric_name_key from
+      metric_value_key value
+      <fields>
+      </fields>
       CONF
-        batch.each do |item|
+      batch.each do |item|
 	  # only "metric_name" and "_value"
-	  expect(item['fields'].keys.size).must_equal 2
-	end
+	      expect(item['fields'].keys.size).must_equal 2
+	    end
       }
     end
 
     it 'should handle custom fields' do
       verify_sent_events(<<~CONF) { |batch|
-	data_type metric
-	metric_name_key from
-	metric_value_key value
-	<fields>
-	  level
-	  filePath file
-	  username
-	</fields>
+      data_type metric
+      metric_name_key from
+      metric_value_key value
+      <fields>
+        level
+        filePath file
+        username
+      </fields>
       CONF
-        batch.each do |item|
-	  expect(item['fields'].keys.size).must_equal 4
-	  expect(item['fields']['level']).must_equal 'info'
-	  expect(item['fields']['filePath']).must_equal 'cool.log'
-	  # null fields should be removed
-	  expect(item['fields']).wont_be :has_key?, 'username'
-	end
+      batch.each do |item|
+        expect(item['fields'].keys.size).must_equal 4
+        expect(item['fields']['level']).must_equal 'info'
+        expect(item['fields']['filePath']).must_equal 'cool.log'
+        # null fields should be removed
+        expect(item['fields']).wont_be :has_key?, 'username'
+	    end
       }
     end
 
     it 'should treat each key-value in event as a metric' do
       metrics = [
-	['tag', event_time, {'cup': 0.5, 'memory': 100}],
-	['tag', event_time, {'cup': 0.6, 'memory': 200}]
+        ['tag', event_time, {'cup': 0.5, 'memory': 100}],
+        ['tag', event_time, {'cup': 0.6, 'memory': 200}]
       ]
       with_stub_hec(events: metrics, conf: 'data_type metric') { |batch|
-	expect(batch.size).must_equal 4
+	      expect(batch.size).must_equal 4
       }
     end
   end
 
+  describe 'timeout params' do
+      it 'should reset unused connection after 5 seconds' do
+        expect(create_output_driver('hec_host splunk.com', 'idle_timeout 5').instance.idle_timeout).must_equal 5
+      end
+
+      it 'should allow custom setting between reading chunks from the socket' do
+        expect(create_output_driver('hec_host splunk.com', 'read_timeout 5').instance.read_timeout).must_equal 5
+      end
+
+      it 'should allow custom setting a connection to be opened' do
+        expect(create_output_driver('hec_host splunk.com',  'open_timeout 5').instance.open_timeout).must_equal 5
+      end
+
+      it 'should check default values are created correctly for timeout params' do
+        test_driver = create_output_driver('hec_host splunk.com')
+        expect(test_driver.instance.idle_timeout).must_equal 5
+        assert_nil(test_driver.instance.read_timeout)
+        assert_nil(test_driver.instance.open_timeout)
+      end
+    end
+
   def with_stub_hec(events:, conf: '', &blk)
     host = "hec.splunk.com"
     @driver = create_output_driver("hec_host #{host}", conf)
@@ -266,8 +345,8 @@ describe Fluent::Plugin::SplunkHecOutput do
       "file"  => "cool.log",
       "value" => 100,
       "agent" => {
-	"name"    => "test",
-	"version" => "1.0.0"
+	      "name"    => "test",
+	      "version" => "1.1.0"
       }
     }
     events = [

data/test/test_helper.rb

@@ -1,13 +1,15 @@
-$LOAD_PATH.unshift File.expand_path("../../lib", __FILE__)
-$LOAD_PATH.unshift File.expand_path("../lib", __FILE__)
-require "fluent/plugin/out_splunk_hec"
+require 'simplecov'
+SimpleCov.start
 
-require "fluent/test"
-require "fluent/test/driver/output"
-require "fluent/test/helpers"
-require "minitest/autorun"
-require "webmock/minitest"
+$LOAD_PATH.unshift File.expand_path('../../lib', __FILE__)
+$LOAD_PATH.unshift File.expand_path('../lib', __FILE__)
+require 'fluent/plugin/out_splunk_hec'
 
+require 'fluent/test'
+require 'fluent/test/driver/output'
+require 'fluent/test/helpers'
+require 'minitest/autorun'
+require 'webmock/minitest'
 
 # make assertions from webmock available in minitest/spec
 module Minitest::Expectations
@@ -15,7 +17,7 @@ module Minitest::Expectations
   infect_an_assertion :assert_not_requested, :wont_be_requested, :reverse
 end
 
-TEST_HEC_TOKEN = "some-token".freeze
+TEST_HEC_TOKEN = 'some-token'.freeze
 
 module PluginTestHelper
   def fluentd_conf_for(*lines)
@@ -32,8 +34,9 @@ module PluginTestHelper
   end
 
   def stub_hec_request(endpoint)
-    stub_request(:post, "#{endpoint}/services/collector").
-      with(headers: {"Authorization" => "Splunk #{TEST_HEC_TOKEN}", "User-Agent" => "fluent-plugin-splunk_hec_out/#{Fluent::Plugin::SplunkHecOutput::VERSION}"}).
-      to_return(body: '{"text":"Success","code":0}')
+    stub_request(:post, "#{endpoint}/services/collector")
+      .with(headers: { 'Authorization' => "Splunk #{TEST_HEC_TOKEN}",
+                         'User-Agent' => "fluent-plugin-splunk_hec_out/#{Fluent::Plugin::SplunkHecOutput::VERSION}" })
+      .to_return(body: '{"text":"Success","code":0}')
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-splunk-hec
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors:
-- Zhimin (Gimi) Liang
+- Splunk Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-27 00:00:00.000000000 Z
+date: 2019-03-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fluentd
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1.4'
 - !ruby/object:Gem::Dependency
   name: multi_json
   requirement: !ruby/object:Gem::Requirement
@@ -58,28 +58,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.16'
+        version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.16'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '12.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '12.0'
 - !ruby/object:Gem::Dependency
   name: test-unit
   requirement: !ruby/object:Gem::Requirement
@@ -114,18 +114,33 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.2'
+        version: 3.5.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.2'
-description: A fluentd output plugin created by Splunk that writes events to splunk
-  indexers over HTTP Event Collector API.
+        version: 3.5.0
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.16.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.16.1
+description: |-
+  A fluentd output plugin created by Splunk
+    that writes events to splunk indexers over HTTP Event Collector API.
 email:
-- zliang@splunk.com
+- DataEdge@splunk.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -163,26 +178,25 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.4.0
+      version: 2.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Fluentd plugin for Splunk HEC.
 test_files:
-- test/fluent/plugin/out_splunk_hec_test.rb
-- test/lib/webmock/http_lib_adapters/patron_adapter.rb
-- test/lib/webmock/http_lib_adapters/manticore_adapter.rb
 - test/lib/webmock/http_lib_adapters/em_http_request_adapter.rb
 - test/lib/webmock/http_lib_adapters/typhoeus_hydra_adapter.rb
-- test/lib/webmock/http_lib_adapters/curb_adapter.rb
 - test/lib/webmock/http_lib_adapters/httpclient_adapter.rb
-- test/lib/webmock/http_lib_adapters/http_rb_adapter.rb
 - test/lib/webmock/http_lib_adapters/excon_adapter.rb
+- test/lib/webmock/http_lib_adapters/patron_adapter.rb
+- test/lib/webmock/http_lib_adapters/manticore_adapter.rb
+- test/lib/webmock/http_lib_adapters/curb_adapter.rb
+- test/lib/webmock/http_lib_adapters/http_rb_adapter.rb
 - test/test_helper.rb
+- test/fluent/plugin/out_splunk_hec_test.rb