logstash-output-loggly 3.0.5 → 4.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7e0cec0e9971901b8db8203aab5425054757e7aa55419b011168fcae88917930
-  data.tar.gz: f0c58f28c958a39190a380e0e311b2f8267b755084f5ec72f0602b25988e0ebe
+  metadata.gz: 1e15e34b7a8077fdb9c36ebd61ddad7d3e89adf138381cb339849f7dfe55b2ea
+  data.tar.gz: 509a2c487b8faf7821e8e83b32db90096dc46c23af35bfc7757dc8a698643901
 SHA512:
-  metadata.gz: 9eb9897a67cbf461400c899e4674bb1cc4bb8b8230021152c3ec778c570241f466640704ffdf1d1b27c9b683c0eaf7fe8d21350aea793f7bd9283e15c40d05ff
-  data.tar.gz: bbb3ec8a63196e7f2091b2eb03fa16b2717a7b85a771cf742ffeac304ff8d3fca98c8cdf514f9e58c27c177f40c280d39db2f6f9db687debfdcc2715df7552ab
+  metadata.gz: aef1bc454004b3978558d783ae2fc2194f715405cc3e60bc9f06b635fe722eab60a6b9b088c8c0a61fd0ac92cc4c609510e2c17198d9980db006505b66905050
+  data.tar.gz: 36dd4857187cefd3bca6fed7c65badd69b3a0adb8b0f220af085758b99f4d23a82a6a598bab479dee55d3b2179bb74d065e2af0ab5f51e8984e6038f83f2fe91

data/CHANGELOG.md

@@ -1,3 +1,19 @@
+## 4.0.0
+  - The plugin now uses the Loggly bulk API.
+  - If you need to modify event batch sizes and max delay between flushes,
+    please adjust the Logstash settings `pipeline.batch.size` and
+    `pipeline.batch.delay` respectively.
+  - New settings: `max_event_size` and `max_payload_size`.
+    Both are currently set according to Loggly's [published API limits](https://www.loggly.com/docs/http-bulk-endpoint/).
+    They only need to be changed if Loggly changes these limits.
+  - The plugin now skips events bigger than the API limit for single event size.
+    A proper warning is logged when this happens.
+  - When interpolating `key` field, drop messages where interpolation doesn't
+    resolve (meaning we don't have the API key for the event).
+  - When interpolating `tag` field, revert to default of 'logstash' if interpolation doesn't resolve.
+  - Beef up unit tests significantly.
+  - See pull request [#29](https://github.com/logstash-plugins/logstash-output-loggly/pull/29) for all details.
+
 ## 3.0.5
   - [#24](https://github.com/logstash-plugins/logstash-output-loggly/pull/24)
     Get rid of a Ruby warning from using `timeout`.

data/docs/index.asciidoc

@@ -40,6 +40,8 @@ This plugin supports the following configuration options plus the <<plugins-{typ
 | <<plugins-{type}s-{plugin}-can_retry>> |<<boolean,boolean>>|No
 | <<plugins-{type}s-{plugin}-host>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-key>> |<<string,string>>|Yes
+| <<plugins-{type}s-{plugin}-max_event_size>> |<<bytes,bytes>>|Yes
+| <<plugins-{type}s-{plugin}-max_payload_size>> |<<bytes,bytes>>|Yes
 | <<plugins-{type}s-{plugin}-proto>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-proxy_host>> |<<string,string>>|No
 | <<plugins-{type}s-{plugin}-proxy_password>> |<<password,password>>|No
@@ -64,15 +66,15 @@ Can Retry.
 Setting this value true helps user to send multiple retry attempts if the first request fails
 
 [id="plugins-{type}s-{plugin}-host"]
-===== `host` 
+===== `host`
 
   * Value type is <<string,string>>
   * Default value is `"logs-01.loggly.com"`
 
 The hostname to send logs to. This should target the loggly http input
 server which is usually "logs-01.loggly.com" (Gen2 account).
-See Loggly HTTP endpoint documentation at
-https://www.loggly.com/docs/http-endpoint/
+See the https://www.loggly.com/docs/http-endpoint/[Loggly HTTP endpoint documentation].
+
 
 [id="plugins-{type}s-{plugin}-key"]
 ===== `key` 
@@ -88,6 +90,34 @@ You can use `%{foo}` field lookups here if you need to pull the api key from
 the event. This is mainly aimed at multitenant hosting providers who want
 to offer shipping a customer's logs to that customer's loggly account.
 
+[id="plugins-{type}s-{plugin}-max_event_size"]
+===== `max_event_size`
+
+  * This is a required setting.
+  * Value type is <<bytes,bytes>>
+  * Default value is 1 Mib
+
+The Loggly API supports event size up to 1 Mib.
+
+You should only need to change this setting if the
+API limits have changed and you need to override the plugin's behaviour.
+
+See the https://www.loggly.com/docs/http-bulk-endpoint/[Loggly bulk API documentation]
+
+[id="plugins-{type}s-{plugin}-max_payload_size"]
+===== `max_payload_size`
+
+  * This is a required setting.
+  * Value type is <<bytes,bytes>>
+  * Default value is 5 Mib
+
+The Loggly API supports API call payloads up to 5 Mib.
+
+You should only need to change this setting if the
+API limits have changed and you need to override the plugin's behaviour.
+
+See the https://www.loggly.com/docs/http-bulk-endpoint/[Loggly bulk API documentation]
+
 [id="plugins-{type}s-{plugin}-proto"]
 ===== `proto` 
 
@@ -145,14 +175,15 @@ It will try to submit request until retry_count and then halt
   * Value type is <<string,string>>
   * Default value is `"logstash"`
 
-Loggly Tag
-Tag helps you to find your logs in the Loggly dashboard easily
-You can make a search in Loggly using tag as "tag:logstash-contrib"
-or the tag set by you in the config file.
+Loggly Tags help you to find your logs in the Loggly dashboard easily.
+You can search for a tag in Loggly using `"tag:logstash"`.
+
+If you need to specify multiple tags here on your events,
+specify them as outlined in https://www.loggly.com/docs/tags/[the tag documentation].
+E.g. `"tag" => "foo,bar,myApp"`.
 
-You can use %{somefield} to allow for custom tag values.
-Helpful for leveraging Loggly source groups.
-https://www.loggly.com/docs/source-groups/
+You can also use `"tag" => "%{somefield}"` to take your tag value from `somefield` on your event.
+Helpful for leveraging https://www.loggly.com/docs/source-groups/[Loggly source groups].
 
 
 

data/lib/logstash/outputs/loggly.rb

@@ -22,11 +22,12 @@ end
 # Got a loggly account? Use logstash to ship logs to Loggly!
 #
 # This is most useful so you can use logstash to parse and structure
-# your logs and ship structured, json events to your account at Loggly.
+# your logs and ship structured, json events to your Loggly account.
 #
 # To use this, you'll need to use a Loggly input with type 'http'
 # and 'json logging' enabled.
 class LogStash::Outputs::Loggly < LogStash::Outputs::Base
+
   config_name "loggly"
 
   # The hostname to send logs to. This should target the loggly http input
@@ -46,17 +47,20 @@ class LogStash::Outputs::Loggly < LogStash::Outputs::Base
   # Should the log action be sent over https instead of plain http
   config :proto, :validate => :string, :default => "http"
 
-  # Loggly Tag
-  # Tag helps you to find your logs in the Loggly dashboard easily
-  # You can make a search in Loggly using tag as "tag:logstash-contrib"
-  # or the tag set by you in the config file.
+  # Loggly Tags help you to find your logs in the Loggly dashboard easily.
+  # You can search for a tag in Loggly using `"tag:logstash"`.
+  #
+  # If you need to specify multiple tags here on your events,
+  # specify them as outlined in the tag documentation (https://www.loggly.com/docs/tags/).
+  # E.g. `"tag" => "foo,bar,myApp"`.
   #
-  # You can use %{somefield} to allow for custom tag values.
-  # Helpful for leveraging Loggly source groups.
-  # https://www.loggly.com/docs/source-groups/
-  config :tag, :validate => :string, :default => "logstash"
+  # You can also use `"tag" => "%{somefield}"` to take your tag value from `somefield` on your event.
+  # Helpful for leveraging Loggly source groups (https://www.loggly.com/docs/source-groups/).
+
+  DEFAULT_LOGGLY_TAG = 'logstash'
+  config :tag, :validate => :string, :default => DEFAULT_LOGGLY_TAG
 
-  # Retry count. 
+  # Retry count.
   # It may be possible that the request may timeout due to slow Internet connection
   # if such condition appears, retry_count helps in retrying request for multiple times
   # It will try to submit request until retry_count and then halt
@@ -78,6 +82,19 @@ class LogStash::Outputs::Loggly < LogStash::Outputs::Base
   # Proxy Password
   config :proxy_password, :validate => :password, :default => ""
 
+  # The Loggly API supports event size up to 1 Mib.
+  # You should only need to change this setting if the
+  # API limits have changed and you need to override the plugin's behaviour.
+  #
+  # See https://www.loggly.com/docs/http-bulk-endpoint/
+  config :max_event_size, :validate => :bytes, :default => '1 Mib', :required => true
+
+  # The Loggly API supports API call payloads up to 5 Mib.
+  # You should only need to change this setting if the
+  # API limits have changed and you need to override the plugin's behaviour.
+  #
+  # See https://www.loggly.com/docs/http-bulk-endpoint/
+  config :max_payload_size, :validate => :bytes, :default => '5 Mib', :required => true
 
   # HTTP constants
   HTTP_SUCCESS = "200"
@@ -88,31 +105,114 @@ class LogStash::Outputs::Loggly < LogStash::Outputs::Base
 
   public
   def register
-    # nothing to do
   end
 
   public
+  def multi_receive(events)
+    send_batch events.collect { |event| prepare_meta(event) }
+  end
+
   def receive(event)
+    send_batch [prepare_meta(event)]
+  end
+
+  private
+  # Returns one meta event {key: '...', tag: '...', event: event },
+  # or returns nil, if event's key doesn't resolve.
+  def prepare_meta(event)
     key = event.sprintf(@key)
     tag = event.sprintf(@tag)
 
+    if expected_field = key[/%{(.*)}/, 1]
+      @logger.warn "Skipping sending message to Loggly. No key provided (key='#{key}'). Make sure to set field '#{expected_field}'."
+      @logger.debug "Dropped message", :event => event.to_json
+      return nil
+    end
+
     # For those cases where %{somefield} doesn't exist
     # we should ship logs with the default tag value.
-    tag = 'logstash' if /^%{\w+}/.match(tag)
+    tag = DEFAULT_LOGGLY_TAG if /%{\w+}/.match(tag)
 
-    # Send event
-    send_event("#{@proto}://#{@host}/inputs/#{key}/tag/#{tag}", format_message(event))
-  end # def receive
+    meta_event = {  key: key, tag: tag, event: event }
+  end # prepare_meta
 
   public
   def format_message(event)
     event.to_json
   end
 
+  # Takes an array of meta_events or nils. Will split the batch in appropriate
+  # sub-batches per key+tag combination (which need to be posted to different URIs).
+  def send_batch(meta_events)
+    split_batches(meta_events.compact).each_pair do |k, batch|
+      key, tag = *k
+      url = "#{@proto}://#{@host}/bulk/#{key}/tag/#{tag}"
+
+      build_message_bodies(batch) do |body|
+        perform_api_call url, body
+      end
+    end
+  end
+
+  # Gets all API calls to the same URI together in common batches.
+  #
+  # Expects an array of meta_events {key: '...', tag: '...', event: event }
+  # Outputs a hash with event batches split out by key+tag combination.
+  #   { [key1, tag1] => [event1, ...],
+  #     [key2, tag1] => [...],
+  #     [key2, tag2] => [...],
+  #     ... }
+  def split_batches(events)
+    events.reduce( Hash.new { |h,k| h[k] = [] } ) do |acc, meta_event|
+      key = meta_event[:key]
+      tag = meta_event[:tag]
+      acc[ [key, tag] ] << meta_event[:event]
+      acc
+    end
+  end
+
+  # Concatenates JSON events to build an API call body.
+  #
+  # Will yield before going over the body size limit. May yield more than once.
+  #
+  # This is also where we check that each message respects the message size,
+  # and where we skip those if they don't.
+  def build_message_bodies(events)
+    body = ''
+    event_count = 0
+
+    events.each do |event|
+      encoded_event = format_message(event)
+      event_size = encoded_event.bytesize
+
+      if event_size > @max_event_size
+        @logger.warn "Skipping event over max event size",
+          :event_size => encoded_event.bytesize, :max_event_size => @max_event_size
+        @logger.debug "Skipped event", :event => encoded_event
+        next
+      end
+
+      if body.bytesize + 1 + event_size > @max_payload_size
+        @logger.debug "Flushing events to Loggly", count: event_count, bytes: body.bytesize
+        yield body
+        body = ''
+        event_count = 0
+      end
+
+      body << "\n" unless body.bytesize.zero?
+      body << encoded_event
+      event_count += 1
+    end
+
+    if event_count > 0
+      @logger.debug "Flushing events to Loggly", count: event_count, bytes: body.bytesize
+      yield body
+    end
+  end
+
   private
-  def send_event(url, message)
+  def perform_api_call(url, message)
     url = URI.parse(url)
-    @logger.debug("Loggly URL", :url => url)
 
     http = Net::HTTP::Proxy(@proxy_host,
                             @proxy_port,
@@ -139,34 +239,37 @@ class LogStash::Outputs::Loggly < LogStash::Outputs::Base
     @retry_count.times do
       begin
         response = http.request(request)
+        @logger.debug("Loggly response", code: response.code, body: response.body)
+
         case response.code
 
-          # HTTP_SUCCESS :Code 2xx
+        # HTTP_SUCCESS :Code 2xx
         when HTTP_SUCCESS
-          @logger.debug("Event sent to Loggly")
+          @logger.debug("Event batch sent successfully")
 
-          # HTTP_FORBIDDEN :Code 403
+        # HTTP_FORBIDDEN :Code 403
         when HTTP_FORBIDDEN
           @logger.warn("User does not have privileges to execute the action.")
 
-          # HTTP_NOT_FOUND :Code 404
+        # HTTP_NOT_FOUND :Code 404
         when HTTP_NOT_FOUND
-          @logger.warn("Invalid URL. Please check URL should be http://logs-01.loggly.com/inputs/CUSTOMER_TOKEN/tag/logstash")
+          @logger.warn("Invalid URL. Please check URL should be http://logs-01.loggly.com/inputs/CUSTOMER_TOKEN/tag/TAG", :url => url.to_s)
 
-          # HTTP_INTERNAL_SERVER_ERROR :Code 500
+        # HTTP_INTERNAL_SERVER_ERROR :Code 500
         when HTTP_INTERNAL_SERVER_ERROR
           @logger.warn("Internal Server Error")
 
-          # HTTP_GATEWAY_TIMEOUT :Code 504
+        # HTTP_GATEWAY_TIMEOUT :Code 504
         when HTTP_GATEWAY_TIMEOUT
           @logger.warn("Gateway Time Out")
         else
           @logger.error("Unexpected response code", :code => response.code)
         end # case
 
-        if [HTTP_SUCCESS,HTTP_FORBIDDEN,HTTP_NOT_FOUND].include?(response.code)	# break the retries loop for the specified response code
+        if [HTTP_SUCCESS,HTTP_FORBIDDEN,HTTP_NOT_FOUND].include?(response.code)   # break the retries loop for the specified response code
           break
         end
+
       rescue StandardError => e
         @logger.error("An unexpected error occurred", :exception => e.class.name, :error => e.to_s, :backtrace => e.backtrace)
       end # rescue
@@ -179,4 +282,5 @@ class LogStash::Outputs::Loggly < LogStash::Outputs::Base
       totalRetries = totalRetries + 1
     end #loop
   end # def send_event
+
 end # class LogStash::Outputs::Loggly

data/logstash-output-loggly.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name            = 'logstash-output-loggly'
-  s.version         = '3.0.5'
+  s.version         = '4.0.0'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Ships logs to Loggly"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

data/spec/outputs/loggly_spec.rb

@@ -2,12 +2,22 @@
 require 'logstash/devutils/rspec/spec_helper'
 require 'logstash/outputs/loggly'
 
+def logger_for(plugin)
+  plugin.instance_variable_get('@logger')
+end
+
 describe 'outputs/loggly' do
   let(:config) { { 'key' => 'abcdef123456' } }
 
+  let(:output) do
+    LogStash::Outputs::Loggly.new(config).tap do |output|
+      output.register
+    end
+  end
+
   let(:event) do
     LogStash::Event.new(
-      'message' => 'fanastic log entry',
+      'message' => 'fantastic log entry',
       'source' => 'someapp',
       'type' => 'nginx',
       '@timestamp' => LogStash::Timestamp.now)
@@ -21,45 +31,168 @@ describe 'outputs/loggly' do
     end
 
     it 'should have default config values' do
-      insist { subject.proto } == 'http'
-      insist { subject.host } == 'logs-01.loggly.com'
-      insist { subject.tag } == 'logstash'
+      expect(subject.proto).to eq('http')
+      expect(subject.host).to eq('logs-01.loggly.com')
+      expect(subject.tag).to eq('logstash')
+      expect(subject.max_event_size).to eq(1_048_576)
+      expect(subject.max_payload_size).to eq(5_242_880)
     end
   end
 
-  context 'when outputting messages' do
+  context 'when sending events' do
+    it 'should set the default tag to logstash' do
+      expect(output).to receive(:send_batch).with([{event: event, key: 'abcdef123456', tag: 'logstash'}])
+      output.receive(event)
+    end
+
     it 'should support field interpolation on key' do
       # add a custom key value for Loggly config
       event.set('token', 'xxxxxxx1234567')
       config['key'] = '%{token}'
 
-      output = LogStash::Outputs::Loggly.new(config)
-      allow(output).to receive(:send_event).with('http://logs-01.loggly.com/inputs/xxxxxxx1234567/tag/logstash',
-                                                 event.to_json)
-      output.receive(event)
-    end
-
-    it 'should set the default tag to logstash' do
-      output = LogStash::Outputs::Loggly.new(config)
-      allow(output).to receive(:send_event).with('http://logs-01.loggly.com/inputs/abcdef123456/tag/logstash',
-                                                 event.to_json)
+      expect(output).to receive(:send_batch).with([{event: event, key: 'xxxxxxx1234567', tag: 'logstash'}])
       output.receive(event)
     end
 
     it 'should support field interpolation for tag' do
       config['tag'] = '%{source}'
-      output = LogStash::Outputs::Loggly.new(config)
-      allow(output).to receive(:send_event).with('http://logs-01.loggly.com/inputs/abcdef123456/tag/someapp',
-                                                 event.to_json)
+      expect(output).to receive(:send_batch).with([{event: event, key: 'abcdef123456', tag: 'someapp'}])
       output.receive(event)
     end
 
-    it 'should default tag to logstash if interpolated field does not exist' do
+    it 'should default tag to logstash if interpolated field for tag does not exist' do
       config['tag'] = '%{foobar}'
-      output = LogStash::Outputs::Loggly.new(config)
-      allow(output).to receive(:send_event).with('http://logs-01.loggly.com/inputs/abcdef123456/tag/logstash',
-                                                 event.to_json)
+      expect(output).to receive(:send_batch).with([{event: event, key: 'abcdef123456', tag: 'logstash'}])
       output.receive(event)
     end
+
+    it 'should drop messages where interpolated field for key does not exist' do
+      config['key'] = '%{custom_key}'
+      event.set('custom_key', 'a_key')
+      event2 = event.clone
+      event2.remove('custom_key')
+
+      expect(output).to receive(:send_batch).once.with([{event: event, key: 'a_key', tag: 'logstash'}, nil])
+      logger = logger_for(output)
+      expect(logger).to receive(:warn).with(/No key provided/)
+      expect(logger).to receive(:debug).with(/Dropped message/, kind_of(Hash))
+
+      output.multi_receive([event, event2])
+    end
+
+    context 'with different combinations of key and tag' do
+      it 'should perform one http request per batch of common key+tag' do
+        config['key'] = '%{custom_key}'
+        config['tag'] = '%{custom_tag}'
+        event.set('custom_key', 'generally_used_key')
+
+        event1 = event.clone.tap { |e| e.set('message', 'event1') }
+        event2 = event.clone.tap { |e| e.set('message', 'event2') ; e.set('custom_key', 'other_key') }
+        event3 = event.clone.tap { |e| e.set('message', 'event3') ; e.set('custom_tag', 'other_tag') }
+        event4 = event.clone.tap { |e| e.set('message', 'event4') }
+
+        expect(output).to receive(:perform_api_call) { |url, body|
+          expect(body).to match /"event1"/
+          expect(body).to match /"event4"/
+          expect(url).to eq('http://logs-01.loggly.com/bulk/generally_used_key/tag/logstash')
+        }
+        expect(output).to receive(:perform_api_call) { |url, body|
+          expect(body).to match /"event2"/
+          expect(url).to eq('http://logs-01.loggly.com/bulk/other_key/tag/logstash')
+        }
+        expect(output).to receive(:perform_api_call) { |url, body|
+          expect(body).to match /"event3"/
+          expect(url).to eq('http://logs-01.loggly.com/bulk/generally_used_key/tag/other_tag')
+        }
+        expect(output).not_to receive(:perform_api_call) # anymore
+
+        output.multi_receive([event1, event2, event3, event4])
+      end
+    end
+  end
+
+  context 'splitting batches of events' do
+    context 'when they are all with the same key+tag' do
+      it 'should return one batch' do
+        batches = output.split_batches([ {event: :event1, key: 'key1', tag: 'tag1'},
+                                         {event: :event2, key: 'key1', tag: 'tag1'} ])
+        expect(batches.size).to eq(1)
+        expect(batches).to eq({ ['key1', 'tag1'] => [:event1, :event2] })
+      end
+    end
+
+    context 'when messages have different key & tag' do
+      it 'should return one batch for each key+tag combination' do
+        batches = output.split_batches([
+          {event: :event1, key: 'key1', tag: 'tag1'},
+          {event: :event2, key: 'key2', tag: 'tag1'},
+          {event: :event3, key: 'key2', tag: 'tag2'},
+          {event: :event4, key: 'key1', tag: 'tag1'},
+          {event: :event5, key: 'key2', tag: 'tag1'},
+          {event: :event6, key: 'key1', tag: 'tag1'},
+          {event: :event7, key: 'key1', tag: 'tag1'},
+        ])
+        expect(batches.size).to eq(3)
+        expect(batches).to eq(
+          { ['key1', 'tag1'] => [:event1, :event4, :event6, :event7],
+            ['key2', 'tag1'] => [:event2, :event5],
+            ['key2', 'tag2'] => [:event3],
+          })
+      end
+    end
+  end
+
+  context 'when building message bodies' do
+    it 'should send only one payload when everything fits' do
+      yielded_times = 0
+      output.build_message_bodies([event] * 10) do |body|
+        expect(body.lines.count).to eq(10)
+
+        yielded_times += 1
+      end
+      expect(yielded_times).to eq(1)
+    end
+
+    it 'should skip events that are bigger than max_event_size' do
+      config['max_event_size'] = 1024
+      good_event = LogStash::Event.new('message' => 'fantastic log entry',
+                                       'source' => 'someapp',
+                                       'type' => 'nginx',
+                                       '@timestamp' => LogStash::Timestamp.now)
+      big_event = good_event.clone.tap { |e| e.set('filler', 'helloworld' * 100) }
+
+      logger = logger_for output
+      expect(logger).to receive(:warn).once.with(
+        /Skipping event/, hash_including(:event_size => 1134,
+                                         :max_event_size => 1024))
+      expect(logger).to receive(:debug).twice
+
+      yielded_times = 0
+      output.build_message_bodies([good_event, big_event]) do |body|
+        expect(body.lines.count).to eq(1)
+        expect(body).not_to match /helloworld/
+
+        yielded_times += 1
+      end
+      expect(yielded_times).to eq(1)
+    end
+
+    it 'should yield as many times as needed to send appropriately-sized payloads' do
+      config['max_payload_size'] = 1024
+      # Once JSON-encoded, these events are 122 bytes each.
+      # 8 of them fit in a 1024 bytes payload
+      event = LogStash::Event.new('message' => 'fantastic log entry',
+                                  'source' => 'someapp',
+                                  'type' => 'nginx',
+                                  '@timestamp' => LogStash::Timestamp.now)
+
+      payloads = []
+      output.build_message_bodies([event] * 10) do |body|
+        payloads << body
+      end
+      expect(payloads.size).to eq(2)
+      expect(payloads[0].lines.count).to eq(8)
+      expect(payloads[1].lines.count).to eq(2)
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-output-loggly
 version: !ruby/object:Gem::Version
-  version: 3.0.5
+  version: 4.0.0
 platform: ruby
 authors:
 - Elastic
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2018-05-09 00:00:00.000000000 Z
+date: 2018-05-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement