fluent-plugin-splunkhec 1.0.1 → 1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 84f47b38dbe7edabca5db1614024cf2bc6ca8ffe
-  data.tar.gz: 1dd1c110988370ad9bbdd7c51f7fe2cbb640f1eb
+  metadata.gz: b095141e9e4ae6cecb11bfc80c7fe26503858909
+  data.tar.gz: e080ff03c7f54382761dfac6957807be0b278106
 SHA512:
-  metadata.gz: c5c4693e79dcf825ecbeb879c72f18cedb9f094f8f86821a238337c8da0f96f86c4552ee36ddd464d0ebc7b9bc92e4dbd1810ac5e0f4516285aa9e876c21faa9
-  data.tar.gz: c01a52a0c4f6875916437f2ca7111bada70c3372394004eca0fa03d00834ce34787b58f3f14e4d22b5b1a282ab58b00879103beba03fb84ea4747d57dc7c0676
+  metadata.gz: 1cbaa497638b467481b56f0472eb6eb20067784e88d6213baa8b74729194baa9fcfb5941f9e14fff3937d4d29ceed282dc36254810dc619d508cc599fe1eb54c
+  data.tar.gz: 8f5046116bd7fa08500b7b7b6ff0814cb46dd8b4b8ce269879cc6acc75f29ead9f64531972e1b5abad2c4a05d113e634d75fc74701529e087b7bbe2fe2c8fd22

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 1.1
+
+- Added send_event_as_json parameter to sent real json
+- Added usejson parameter to have the option to sent raw data with time included
+- Removed required from parameter definition
+
 ## 1.0.1
 
 Fixed config parameters used in Splunk URI.

data/README.md

@@ -21,6 +21,8 @@ The Splunk HEC is running on a Heavy Forwarder or single instance. More info abo
     event_host fluentdhost #optional
     source fluentd #optional
     sourcetype data:type #optional
+    usejson true #optional defaults to true
+    send_event_as_json true #optional
 </source>
 ```
 
@@ -57,6 +59,14 @@ Specify the source-field for the event data in Splunk. If you don't specify this
 
 Specify the sourcetype-field for the event data in Splunk. If you don't specify this the plug-in will use the tag from the FluentD input plug-in.
 
+## config: send_event_as_json
+
+Specify if an event should be sent as json rather than as a string. Can be 'true' or 'false'. If you don't specify then this will be 'false'.
+
+## config: usejson
+
+Specify the event type as JSON (true|default) or raw (false) for sending Log4J messages so Splunk so it can parse the time field it self based on the format 'time' regex match found in the source, uses millisecond precision.
+
 ## Contributing
 
 1. Fork it

data/fluent-plugin-splunkhec.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |gem|
   gem.name          = "fluent-plugin-splunkhec"
-  gem.version       = "1.0.1"
+  gem.version       = "1.1"
   gem.authors       = "Coen Meerbeek"
   gem.email         = "cmeerbeek@gmail.com"
   gem.description   = %q{Output plugin for the Splunk HTTP Event Collector.}

data/lib/fluent/plugin/out_splunkhec.rb

@@ -7,16 +7,18 @@ module Fluent
     Fluent::Plugin.register_output('splunkhec', self)
 
     # Primary Splunk HEC configuration parameters
-    config_param :host,     :string, :default => 'localhost', :required => true
-    config_param :protocol, :string, :default => 'http', :required => true
-    config_param :port,     :string, :default => '8088', :required => true
-    config_param :token,    :string, :default => nil, :required => true
+    config_param :host,     :string, :default => 'localhost'
+    config_param :protocol, :string, :default => 'http'
+    config_param :port,     :string, :default => '8088'
+    config_param :token,    :string, :default => nil
 
     # Splunk event parameters
     config_param :index,      :string, :default => "main"
     config_param :event_host, :string, :default => nil
     config_param :source,     :string, :default => "fluentd"
     config_param :sourcetype, :string, :default => nil
+    config_param :send_event_as_json, :string, :default => "false"
+    config_param :usejson,    :string, :default => "true"
 
     # This method is called before starting.
     # Here we construct the Splunk HEC URL to POST data to
@@ -44,7 +46,13 @@ module Fluent
       else
         @event_sourcetype = conf['sourcetype']
       end
-      
+
+      if conf['send_event_as_json'] == 'true'
+        @event_send_as_json = true
+      else
+        @event_send_as_json = false
+      end
+
       @event_index = @index
       @event_source = @source
     end
@@ -72,7 +80,11 @@ module Fluent
           when Fixnum
             event = record.to_s
           when Hash
-            event = record.to_json.gsub("\"", %q(\\\"))
+            if @event_send_as_json
+              event = record.to_json
+            else
+              event = record.to_json.gsub("\"", %q(\\\"))
+            end
           else
             event = record
           end
@@ -82,7 +94,14 @@ module Fluent
           end
 
           # Build body for the POST request
-          body = '{"time" :' + time.to_s + ', "event" :"' + event + '", "sourcetype" :"' + @event_sourcetype + '", "source" :"' + @event_source + '", "index" :"' + @event_index + '", "host" : "' + @event_host + '"}'
+          if @usejson == 'false'
+            event = record["time"]+ " " + record["message"].to_json.gsub(/^"|"$/,"")
+            body = '{"time":"'+ DateTime.parse(record["time"]).strftime("%Q") +'", "event":"' + event + '", "sourcetype" :"' + @event_sourcetype + '", "source" :"' + @event_source + '", "index" :"' + @event_index + '", "host" : "' + @event_host + '"}'
+          elsif @event_send_as_json
+            body = '{"time" :' + time.to_s + ', "event" :' + event + ', "sourcetype" :"' + @event_sourcetype + '", "source" :"' + @event_source + '", "index" :"' + @event_index + '", "host" : "' + @event_host + '"}'
+          else
+            body = '{"time" :' + time.to_s + ', "event" :"' + event + '", "sourcetype" :"' + @event_sourcetype + '", "source" :"' + @event_source + '", "index" :"' + @event_index + '", "host" : "' + @event_host + '"}'
+          end
           log.debug "splunkhec: " + body + "\n"
           
           uri = URI(@splunk_url)

data/test/helper.rb

@@ -24,7 +24,7 @@ unless ENV.has_key?("VERBOSE")
   $log = nulllogger
 end
 
-require "fluent/plugin/in_splunkhec"
+require "fluent/plugin/out_splunkhec"
 
 class Test::Unit::TestCase
 end

data/test/plugin/test_out_splunkhec.rb

@@ -13,7 +13,7 @@ class SplunkHECOutputTest < Test::Unit::TestCase
     token BAB747F3-744E-41BA
   ]
 
-  def create_driver_ga(conf = CONFIG_SPLUNKHEC)
+  def create_driver_splunkhec(conf = CONFIG_SPLUNKHEC)
     Fluent::Test::InputTestDriver.new(Fluent::SplunkHECOutput).configure(conf)
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-splunkhec
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: '1.1'
 platform: ruby
 authors:
 - Coen Meerbeek
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-02-16 00:00:00.000000000 Z
+date: 2017-08-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fluentd