logstash-output-scalyr 0.1.26.beta → 0.2.0.beta

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5593e93dedad0ddb545f8911e7f1cd8cabde4043a6a76b8c5b78d99c0c4d12a5
-  data.tar.gz: 6c821768c3d780529d00bc1f58c4ec8841ecba2758a46c71ecf17201fb8ba3d1
+  metadata.gz: d2f63d5c51030c7bbb033edc0d7f8b8d3affff48f94f0bb2134fdfb75af36a76
+  data.tar.gz: 5787605f828a4a4f7d992003ed8a27e1f67439c49fab37d91c5077aa08d50428
 SHA512:
-  metadata.gz: 57901dc94f49aa844130f4b2a7ac084c95d473c1a948902b699cbaba8d63049d1e960b69b49b20cf8ffa8b2c1f5f68a53ad9687b72867799f113a384f490e01d
-  data.tar.gz: 329f985e8121d49bab836381861ca878c229f2b316e160792263461900a8fc4cf7f46bdc2aba889174a0f35b0c67f567b0e5a09d429f888948b788707ab3c0b7
+  metadata.gz: ba560b44dd9ad73f56b2f105007a37bedd5b7821f7776c8d58c44ec7bb0fa544e80bd287756f8bb6ca76d53eedd3a1f36131cc60f2e7cf26ef9937af21c0a5a9
+  data.tar.gz: 4c8e3d4528ab613bd506e8b87e014ddfbd9725a088171396d483826348e8e7467ca75b1164dadb082b3d0732b37bfe4d4d1985b86cfb4ca389f592294055d2a3

data/CHANGELOG.md

@@ -1,9 +1,24 @@
 # Beta
 
+## 0.2.0.beta
+
+- Fix a bug and correctly handle ``serverHost`` event level attribute. Now if an event contains
+``serverHost`` attribute, this attribute will be correctly set on the event level and available for
+ "Sources" filtering in the UI.
+- Plugin doesn't set ``serverHost`` attribute with a fixed value of ``Logstash`` on each event
+level anymore. If you still want this behavior, you can achieve that with logstash mutate filter.
+ - Session level ``serverHost`` value now defaults to logstash aggregator node hostname
+ (``use_hostname_for_serverhost`` config option now defaults to true).
+- ``host`` attribute is not removed by default from all the events. By default, logstash adds
+  ``host`` attribute which contains logstash aggregator host to each event. This is now redundant
+  and unncessary with the fixed and improved serverHost behavior (host and serverHost would contain
+  the same value by default). If you want to change this behavior and and still include ``host``
+  attribute on each event you can do that by setting ``remove_host_attribute_from_events`` config
+  option to false.
+
 ## 0.1.26.beta
 - Add support for new ``json_library`` config option. Valid values are ``stdlib`` (default) are ``jrjackson``. The later may offer 2-4x faster JSON serialization.
 
-
 ## 0.1.23.beta
 - Add testing support for disabling estimation of serialized event size for each event in the batch.
 

data/README.md

@@ -9,7 +9,7 @@ You can view documentation for this plugin [on the Scalyr website](https://app.s
 # Quick start
 
 1. Build the gem, run `gem build logstash-output-scalyr.gemspec` 
-2. Install the gem into a Logstash installation, run `/usr/share/logstash/bin/logstash-plugin install logstash-output-scalyr-0.1.25.beta.gem` or follow the latest official instructions on working with plugins from Logstash.
+2. Install the gem into a Logstash installation, run `/usr/share/logstash/bin/logstash-plugin install logstash-output-scalyr-0.2.0.beta.gem` or follow the latest official instructions on working with plugins from Logstash.
 3. Configure the output plugin (e.g. add it to a pipeline .conf)
 4. Restart Logstash 
 
@@ -39,6 +39,51 @@ output {
 
 In the above example, the Logstash pipeline defines a file input that reads from `/var/log/messages`.  Log events from this source have the `host` and `path` fields.  The pipeline then outputs to the scalyr plugin, which in this example is configured to remap `host`->`serverHost` and `path`->`logfile`, thus facilitating filtering in the Scalyr UI.
 
+## Notes on serverHost attribute handling
+
+> Some of this functionality has been fixed and changed in the v0.2.0beta release. In previous
+  versions, plugin added ``serverHost`` attribute with a value of ``Logstash`` to each event and
+  this attribute was not handled correctly - it was treated as a regular event level attribute
+  and not a special attribute which can be used for Source functionality and filtering.
+
+By default this plugin will set ``serverHost`` for all the events in a batch to match hostname of
+the logstash node where the output plugin is running.
+
+You can change that either by setting ``serverHost`` attribute in the ``server_attributes`` config
+option hash or by setting ``serverHost`` attribute on the event level via logstash record attribute.
+
+In both scenarios, you will be able to utilize this value for "Sources" functionality and filterin
+in the Scalyr UI.
+
+For example:
+
+1. Define static value for all the events handled by specific plugin instance
+
+```
+output {
+ scalyr {
+   api_write_token => 'SCALYR_API_KEY'
+   server_attributes => {'serverHost' => 'my-host-1'}
+ }
+}
+```
+
+2. Define static value on the event level which is set via logstash filter
+
+```
+  mutate {
+    add_field => { "serverHost" => "my hostname" }
+  }
+```
+
+3. Define dynamic value on the event level which is set via logstash filter
+
+```
+  mutate {
+    add_field => { "serverHost" => "%{[host][name]}" }
+  }
+```
+
 ## Options
 
 - The Scalyr API write token, these are available at https://www.scalyr.com/keys.  This is the only compulsory configuration field required for proper upload
@@ -71,7 +116,7 @@ In the above example, the Logstash pipeline defines a file input that reads from
 - Related to the server_attributes dictionary above, if you do not define the 'serverHost' key in server_attributes,
  the plugin will automatically set it, using the aggregator hostname as value, if this value is true.
  
-`config :use_hostname_for_serverhost, :validate => :boolean, :default => false`
+`config :use_hostname_for_serverhost, :validate => :boolean, :default => true`
 
 ---
 
@@ -394,3 +439,65 @@ bundle exec rake publish_gem
 
 `RUBY_USER` and `RUBY_PASSWORD` should be replaced with the username and password to the RubyGems.org account you wish to release to,
  these credentials should be found in Keeper.
+
+# Testing Plugin Changes
+
+This section describes how to test the plugin and changes using docker compose setup from
+lostash-config-tester repo available at https://github.com/Kami/logstash-config-tester.
+
+This repo has been forked and already contains some changes which make testing the plugin
+easier.
+
+The logstash configuration in that repo is set up to receive records encoded as JSON via
+standard input, decode the JSON into the event object and print it to stdout + send it
+to the Scalyr output.
+
+```bash
+# 0. Clone the tester repo
+git clone https://github.com/Kami/logstash-config-tester ~/
+
+# 1. Build the plugin
+gem build logstash-output-scalyr.gemspec
+
+# 2. Copy it to the config test repo
+cp logstash-output-scalyr-0.2.0.beta.gem ~/logstash-config-test/logstash-output-scalyr.gem
+
+# 3. Build docker image with the latest dev version of the plugin (may take a while)
+docker-compose build
+
+# 4. Configure API key in docker-compose.yml and make any changes to plugin config in
+# pipeline/scalyr_output.conf.j2, if necessary
+vim docker-compose.yml
+
+vim pipeline/scalyr_output.conf.j2
+
+# 4. Run logstash with the stdin input and stdout + scalyr output
+docker-compose run logstash
+```
+
+A couple of things to keep in mind:
+
+1. Logstash log level is set to debug which is quite verbose, but it makes troubleshooting and
+  testing easier.
+2. Plugin accepts records (events) as JSON via standard input. This means to inject the mock
+   event you can simply copy the JSON event representation string to stdin and press enter. If you
+   want to submit multiples events to be handled as a single batch, paste each event one at a time
+   and press enter at the end. Logstash pipeline has been configured to wait up to 5 seconds before
+   handling the batch which should give you enough time to test batches with multiple events (this
+   setting can be adjusted in ``config/logstash.yml`` - ``pipeline.batch.delay``, if needed)
+
+Example values you can enter into stdin:
+
+1. Single event batch
+
+```javascript
+{"foo": "bar", "message": "test logstash"}
+```
+
+2. Batch with 3 events
+
+```javascript
+{"serverHost": "host-1", "bar": "baz", "message": "test logstash 1"}
+{"serverHost": "host-2", "bar": "baz", "message": "test logstash 2"}
+{"bar": "baz", "message": "test logstash 3"}
+```

data/lib/logstash/outputs/scalyr.rb

@@ -43,7 +43,7 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
 
   # Related to the server_attributes dictionary above, if you do not define the 'serverHost' key in server_attributes,
   # the plugin will automatically set it, using the aggregator hostname as value, if this value is true.
-  config :use_hostname_for_serverhost, :validate => :boolean, :default => false
+  config :use_hostname_for_serverhost, :validate => :boolean, :default => true
 
   # Field that represents the origin of the log event.
   # (Warning: events with an existing 'serverHost' field, it will be overwritten)
@@ -66,6 +66,23 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
   # value with have fields moved.
   config :log_constants, :validate => :array, :default => nil
 
+  # When this option is true and session level server host is defined (either via
+  # server_attributes config option or via node hostname) and some events in a batch contain
+  # "serverHost" attributes, other nodes in a batch which don't contain it will have serverHost
+  # set to the session level value.
+  # This is needed because session level attribute has priority over event level which means
+  # that in case we specify serverHost on some events, other events won't have any value set
+  # for serverHost.
+  # Since this option adds some overhead and requires additional processing time, it's
+  # disabled by default.
+  config :set_session_level_serverhost_on_events, validate: :boolean, default: false
+
+  # By default, logstash will add "host" attribute which includes logstash aggregator server
+  # host to each event. This is not really needed and desired anymore with the fixed and improved
+  # serverHost attribute handling (serverHost now contains logstash aggregator hostname by
+  # default).
+  config :remove_host_attribute_from_events, validate: :boolean, default: true
+
   # If true, nested values will be flattened (which changes keys to delimiter-separated concatenation of all
   # nested keys).
   config :flatten_nested_values, :validate => :boolean, :default => false
@@ -241,12 +258,13 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
       @server_attributes = new_attributes
     end
 
-    # See if we should use the hostname as the server_attributes.serverHost
-    if @use_hostname_for_serverhost
-      if @server_attributes.nil?
+    # See if we should use the hostname as the server_attributes.serverHost (aka if fixed serverHost is not
+    # defined as part of server_attributes config option)
+    if @server_attributes.nil?
         @server_attributes = {}
-      end
+    end
 
+    if @use_hostname_for_serverhost
       # only set serverHost if it doesn't currently exist in server_attributes
       # Note: Use strings rather than symbols for the key, because keys coming
       # from the config file will be strings
@@ -258,6 +276,15 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
     # Add monitor server attribute to identify this as coming from a plugin
     @server_attributes['monitor'] = 'pluginLogstash'
 
+    # We create a fixed copy without host here so we can reference this later if needed to avoid
+    # some of the copy + manipulate overhead per batch
+    @server_attributes_without_serverhost = @server_attributes.clone
+    if @server_attributes_without_serverhost.key? "serverHost"
+      @server_attributes_without_serverhost.delete "serverHost"
+    end
+
+    @session_server_host = @server_attributes["serverHost"]
+
     @scalyr_server << '/' unless @scalyr_server.end_with?('/')
 
     @add_events_uri = URI(@scalyr_server) + "addEvents"
@@ -290,7 +317,8 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
         @http_connect_timeout, @http_socket_timeout, @http_request_timeout, @http_pool_max, @http_pool_max_per_route
     )
 
-    @logger.info(sprintf("Started Scalyr output plugin (%s)." % [PLUGIN_VERSION]), :class => self.class.name)
+    @logger.info(sprintf("Started Scalyr LogStash output plugin %s (compression_type=%s,compression_level=%s,json_library=%s)." %
+                         [PLUGIN_VERSION, @compression_type, @compression_type, @json_library]), :class => self.class.name)
 
     # Finally, send a status line to Scalyr
     # We use a special separate short lived client session for sending the initial client status.
@@ -505,7 +533,7 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
         @dlq_writer.write(l_event, "#{exc_data[:message]}")
       }
     else
-      @logger.warn("Deal letter queue not configured, dropping #{multi_event_request[:logstash_events].length} events after #{exc_retries} tries.", :sample_events => sample_events)
+      @logger.warn("Dead letter queue not configured, dropping #{multi_event_request[:logstash_events].length} events after #{exc_retries} tries.", :sample_events => sample_events)
     end
   end
 
@@ -549,6 +577,8 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
     logs_ids = Hash.new
     next_log_id = 1
 
+    batch_has_event_level_server_host = false
+
     logstash_events.each {|l_event|
 
       record = l_event.to_hash
@@ -604,6 +634,11 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
       # Rename user-specified logfile field -> 'logfile'
       rename.call(@logfile_field, 'logfile')
 
+      # Remove "host" attribute
+      if @remove_host_attribute_from_events and record.key? "host"
+        record.delete("host")
+      end
+
       # Set a default parser is none is present in the event
       if record['parser'].to_s.empty?
         record['parser'] = "logstashParser"
@@ -614,26 +649,31 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
         record['logfile'] = "/logstash/#{serverHost}"
       end
 
-      # Set a default if no serverHost value is present.
-      if serverHost.nil?
-        record['serverHost'] = "Logstash"
+      # Rename serverHost (if exists) to __origServerHost so sources filtering works correctly
+      # It's important that this happens at the very end of the event processing in this function.
+      record_has_server_host_attribute = record.key? 'serverHost'
+      batch_has_event_level_server_host |= record_has_server_host_attribute
+
+      if record_has_server_host_attribute
+        record[EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME] = record['serverHost']
+        record.delete('serverHost')
       end
 
+      # To reduce duplication of common event-level attributes, we "fold" them into top-level "logs" attribute
+      # and reference log entry inside the event
       log_identifier = nil
       add_log = false
       if serverHost
        log_identifier = serverHost + record['logfile']
       end
+
       if log_identifier and not logs.key? log_identifier
         add_log = true
         logs[log_identifier] = {
           'id' => next_log_id,
           'attrs' => Hash.new
         }
-        if not record['serverHost'].to_s.empty?
-          logs[log_identifier]['attrs']['serverHost'] = record['serverHost']
-          record.delete('serverHost')
-        end
+
         if not record['logfile'].to_s.empty?
           logs[log_identifier]['attrs']['logfile'] = record['logfile']
           record.delete('logfile')
@@ -646,10 +686,21 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
             end
           }
         end
+
         logs_ids[log_identifier] = next_log_id
         next_log_id += 1
       end
 
+      # If we already contain "logs" entry for this record, we remove duplicated serverHost from
+      # the event attributes since it's already part of the log level attributes which are
+      # referenced by the event.
+      if log_identifier and logs.key? log_identifier
+        if not record[EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME].to_s.empty?
+          logs[log_identifier]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME] = record[EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]
+          record.delete(EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME)
+        end
+      end
+
       # Delete unwanted fields from record
       record.delete('@version')
       record.delete('@timestamp')
@@ -695,7 +746,7 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
         :attrs => record
       }
 
-      # optionally set thread
+      # optionally set thread and referenced log file
       if serverHost
         scalyr_event[:thread] = thread_id.to_s
         scalyr_event[:log] = logs_ids[log_identifier]
@@ -756,7 +807,8 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
             append_event = false
           end
 
-          multi_event_request = self.create_multi_event_request(scalyr_events, l_events, current_threads, logs)
+          Scalyr::Common::Util.set_session_level_serverhost_on_events(@session_server_host, scalyr_events, logs, batch_has_event_level_server_host)
+          multi_event_request = self.create_multi_event_request(scalyr_events, l_events, current_threads, logs, batch_has_event_level_server_host)
           multi_event_request_array << multi_event_request
 
           total_bytes = 0
@@ -765,6 +817,7 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
           logs_ids = Hash.new
           scalyr_events = Array.new
           l_events = Array.new
+          batch_has_event_level_server_host = false
         end
       else
         # If size estimation is disabled we simply append the event and handle splitting later on (if needed)
@@ -784,14 +837,14 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
 
     # create a final request with any left over events (and make sure there is at least one event)
     if scalyr_events.size >= 1
-      multi_event_request = self.create_multi_event_request(scalyr_events, l_events, current_threads, logs)
+      Scalyr::Common::Util.set_session_level_serverhost_on_events(@session_server_host, scalyr_events, logs, batch_has_event_level_server_host)
+      multi_event_request = self.create_multi_event_request(scalyr_events, l_events, current_threads, logs, batch_has_event_level_server_host)
       multi_event_request_array << multi_event_request
     end
 
     multi_event_request_array
   end
 
-
   # Helper method that adds a client_timestamp to a batch addEvents request body
   def add_client_timestamp_to_body(body)
     current_time_millis = DateTime.now.strftime('%Q').to_i
@@ -804,7 +857,7 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
   # A request comprises multiple Scalyr Events.  This function creates a request hash for
   # final upload to Scalyr (from an array of events, and an optional hash of current threads)
   # Note: The request body field will be json-encoded.
-  def create_multi_event_request(scalyr_events, logstash_events, current_threads, current_logs)
+  def create_multi_event_request(scalyr_events, logstash_events, current_threads, current_logs, batch_has_event_level_server_host = false)
 
     body = {
       :session => @session_id + Thread.current.object_id.to_s,
@@ -833,7 +886,13 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
     end
 
     # add serverAttributes
-    body[:sessionInfo] = @server_attributes if @server_attributes
+    # If serverHost is defined on any of the events, we don't send it via sessionInfo since
+    # sesionInfo has the higest priority and would always overwritte the event level one
+    if batch_has_event_level_server_host
+      body[:sessionInfo] = @server_attributes_without_serverhost if @server_attributes_without_serverhost
+    else
+      body[:sessionInfo] = @server_attributes if @server_attributes
+    end
 
     # We time serialization to get some insight on how long it takes to serialize the request body
     start_time = Time.now.to_f
@@ -926,8 +985,9 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
     }
     @send_stats.synchronize do
       if !@last_status_transmit_time
-        status_event[:attrs]['message'] = sprintf("Started Scalyr LogStash output plugin (%s)." % [PLUGIN_VERSION])
-        status_event[:attrs]['serverHost'] = @node_hostname
+        status_event[:attrs]['message'] = sprintf("Started Scalyr LogStash output plugin %s (compression_type=%s,compression_level=%s,json_library=%s)." %
+                                                  [PLUGIN_VERSION, @compression_type, @compression_type, @json_library])
+        status_event[:attrs][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME] = @node_hostname
       else
         cur_time = Time.now()
         return if (cur_time.to_i - @last_status_transmit_time.to_i) < @status_report_interval
@@ -949,7 +1009,7 @@ class LogStash::Outputs::Scalyr < LogStash::Outputs::Base
           cnt += 1
         end
         status_event[:attrs]['message'] = msg
-        status_event[:attrs]['serverHost'] = @node_hostname
+        status_event[:attrs][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME] = @node_hostname
         status_event[:attrs]['parser'] = @status_parser
       end
       multi_event_request = create_multi_event_request([status_event], nil, nil, nil)

data/lib/scalyr/common/client.rb

@@ -1,4 +1,5 @@
 require "scalyr/constants"
+require "logstash-core"
 
 module Scalyr; module Common; module Client
 
@@ -298,7 +299,7 @@ class ClientSession
     version = sprintf('output-logstash-scalyr %s' % [PLUGIN_VERSION])
     post_headers = {
       'Content-Type': 'application/json',
-      'User-Agent': version + ';' + RUBY_VERSION + ';' + RUBY_PLATFORM
+      'User-Agent': version + ';' + RUBY_VERSION + ';' + RUBY_PLATFORM + ';' + LOGSTASH_VERSION
     }
 
     post_body = nil

data/lib/scalyr/common/util.rb

@@ -124,5 +124,32 @@ def self.convert_bignums(obj)
   end
 end
 
-end; end; end;
 
+# Function which sets special serverHost attribute on the events without this special attribute
+# to session level serverHost value
+# NOTE: This method mutates scalyr_events in place.
+def self.set_session_level_serverhost_on_events(session_server_host, scalyr_events, logs, batch_has_event_level_server_host = false)
+  # Maps log id (number) to logfile attributes for more efficient lookups later on
+  logs_ids_to_attrs = Hash.new
+
+  logs.each {|_, log|
+    logs_ids_to_attrs[log["id"]] = log["attrs"]
+  }
+
+  if batch_has_event_level_server_host
+    scalyr_events.each {|s_event|
+      log_id = s_event[:log]
+      logfile_attrs = logs_ids_to_attrs[log_id]
+
+      if logfile_attrs.nil?
+        logfile_attrs = Hash.new
+      end
+
+      if s_event[:attrs][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME].nil? and logfile_attrs[EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME].nil?
+        s_event[:attrs][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME] = session_server_host
+      end
+    }
+  end
+end
+
+end; end; end;

data/lib/scalyr/constants.rb

@@ -1,2 +1,5 @@
 # encoding: utf-8
-PLUGIN_VERSION = "v0.1.26.beta"
+PLUGIN_VERSION = "v0.2.0.beta"
+
+# Special event level attribute name which can be used for setting event level serverHost attribute
+EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME = '__origServerHost'

data/logstash-output-scalyr.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name = 'logstash-output-scalyr'
-  s.version         = '0.1.26.beta'
+  s.version         = '0.2.0.beta'
   s.licenses = ['Apache-2.0']
   s.summary = "Scalyr output plugin for Logstash"
   s.description     = "Sends log data collected by Logstash to Scalyr (https://www.scalyr.com)"

data/spec/benchmarks/bignum_fixing.rb

@@ -2,15 +2,12 @@ require 'benchmark'
 require 'quantile'
 
 require_relative '../../lib/scalyr/common/util'
+require_relative './util'
 
 # Micro benchmark which measures how long it takes to find all the Bignums in a record and convert them to strings
 
 ITERATIONS = 500
 
-def rand_str(len)
-  return (0...len).map { (65 + rand(26)).chr }.join
-end
-
 def rand_bignum()
   return 200004000020304050300 + rand(999999)
 end
@@ -43,7 +40,7 @@ def run_benchmark_and_print_results(data, run_benchmark_func)
 
   result = []
   ITERATIONS.times do |i|
-    result << Benchmark.measure { run_benchmark_func.(data[0]) }
+    result << Benchmark.measure { run_benchmark_func.(data[i]) }
   end
 
   sum = result.inject(nil) { |sum, t| sum.nil? ? sum = t : sum += t }

data/spec/benchmarks/flattening_and_serialization.rb

@@ -17,7 +17,7 @@ def run_benchmark_and_print_results(data, run_benchmark_func)
 
   result = []
   ITERATIONS.times do |i|
-    result << Benchmark.measure { run_benchmark_func.(data[0]) }
+    result << Benchmark.measure { run_benchmark_func.(data[i]) }
   end
 
   sum = result.inject(nil) { |sum, t| sum.nil? ? sum = t : sum += t }

data/spec/benchmarks/json_serialization.rb

@@ -31,7 +31,7 @@ def run_benchmark_and_print_results(data, run_benchmark_func)
 
   result = []
   ITERATIONS.times do |i|
-    result << Benchmark.measure { run_benchmark_func.(data[0]) }
+    result << Benchmark.measure { run_benchmark_func.(data[i]) }
   end
 
   sum = result.inject(nil) { |sum, t| sum.nil? ? sum = t : sum += t }

data/spec/benchmarks/set_session_level_serverhost_on_events.rb

@@ -0,0 +1,109 @@
+require 'benchmark'
+require 'quantile'
+
+require_relative '../../lib/scalyr/constants'
+require_relative '../../lib/scalyr/common/util'
+require_relative './util'
+
+# Micro benchmark which measures how long "set_session_level_serverhost_on_events" takes
+
+ITERATIONS = 100
+
+def run_benchmark_and_print_results(data, run_benchmark_func)
+  puts ""
+  puts "Using %s total events in a batch" % [data[0].size]
+  puts ""
+
+  result = []
+  ITERATIONS.times do |i|
+    result << Benchmark.measure { run_benchmark_func.(data[i]) }
+  end
+
+  sum = result.inject(nil) { |sum, t| sum.nil? ? sum = t : sum += t }
+  avg = sum / result.size
+
+  Benchmark.bm(7, "sum:", "avg:") do |b|
+    [sum, avg]
+  end
+  puts ""
+end
+
+# Generate random event with only single event having special server host attribute set which
+# represents a worst case scenario since we need to backfill rest of the events.
+def generate_events(count)
+  result = []
+
+  ITERATIONS.times do |iteration|
+    events = []
+
+    count.times do |index|
+      event = generate_hash([2])
+      event[:attrs] = Hash.new
+      event[:log] = 1
+
+      if index == count - 1
+        event[:attrs][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME] = format("test-host-%s", index)
+      end
+
+      events << event
+    end
+
+    raise "Assertion failed" unless events.size == count
+
+    result << events
+  end
+
+  raise "Assertion failed" unless result.size == ITERATIONS
+  result
+end
+
+def run_func(events)
+  # NOTE: This function manipulates events in place
+  events.each_with_index do |event, index|
+    if index < events.size - 1
+      # Last event will have _origServerHost set, but others won't
+      raise "Assertion failed" unless event[:attrs][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME].nil?
+    end
+  end
+
+  Scalyr::Common::Util.set_session_level_serverhost_on_events("session-server-host-dummy", events, {}, true)
+
+  events.each do |event|
+    raise "Assertion failed" unless event[:attrs][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME].nil? == false
+  end
+end
+
+
+puts "Using %s iterations" % [ITERATIONS]
+puts ""
+
+@value = Quantile::Estimator.new
+
+puts "Util.set_session_level_serverhost_on_events()"
+puts "==============================="
+
+# 100 events in a batch
+data = generate_events(100)
+run_benchmark_and_print_results(data, method(:run_func))
+
+
+# 500 events in a batch
+data = generate_events(500)
+run_benchmark_and_print_results(data, method(:run_func))
+
+# 1000 events in a batch
+data = generate_events(1000)
+run_benchmark_and_print_results(data, method(:run_func))
+
+# 2000 events in a batch
+data = generate_events(2000)
+run_benchmark_and_print_results(data, method(:run_func))
+
+# 3000 events in a batch
+data = generate_events(3000)
+run_benchmark_and_print_results(data, method(:run_func))
+
+# 5000 events in a batch
+data = generate_events(5000)
+puts data.size
+run_benchmark_and_print_results(data, method(:run_func))

data/spec/logstash/outputs/scalyr_integration_spec.rb

@@ -42,7 +42,7 @@ describe LogStash::Outputs::Scalyr do
                   :batch_num=>1,
                   :code=>401,
                   :message=>"error/client/badParam",
-                  :payload_size=>781,
+                  :payload_size=>737,
                   :record_count=>3,
                   :total_batches=>1,
                   :url=>"https://agent.scalyr.com/addEvents",
@@ -65,7 +65,7 @@ describe LogStash::Outputs::Scalyr do
                   :error_class=>"Manticore::UnknownException",
                   :batch_num=>1,
                   :message=>"java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty",
-                  :payload_size=>781,
+                  :payload_size=>737,
                   :record_count=>3,
                   :total_batches=>1,
                   :url=>"https://agent.scalyr.com/addEvents",
@@ -91,7 +91,7 @@ describe LogStash::Outputs::Scalyr do
                   :error_class=>"Manticore::UnknownException",
                   :batch_num=>1,
                   :message=>"java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty",
-                  :payload_size=>781,
+                  :payload_size=>737,
                   :record_count=>3,
                   :total_batches=>1,
                   :url=>"https://agent.scalyr.com/addEvents",
@@ -130,7 +130,7 @@ describe LogStash::Outputs::Scalyr do
                   :error_class=>"Manticore::UnknownException",
                   :batch_num=>1,
                   :message=>"Host name 'invalid.mitm.should.fail.test.agent.scalyr.com' does not match the certificate subject provided by the peer (CN=*.scalyr.com)",
-                  :payload_size=>781,
+                  :payload_size=>737,
                   :record_count=>3,
                   :total_batches=>1,
                   :url=>"https://invalid.mitm.should.fail.test.agent.scalyr.com/addEvents",
@@ -175,7 +175,7 @@ describe LogStash::Outputs::Scalyr do
             :batch_num=>1,
             :code=>503,
             :message=>"Invalid JSON response from server",
-            :payload_size=>781,
+            :payload_size=>737,
             :record_count=>3,
             :total_batches=>1,
             :url=>"https://agent.scalyr.com/addEvents",
@@ -203,7 +203,7 @@ describe LogStash::Outputs::Scalyr do
             :batch_num=>1,
             :code=>500,
             :message=>"Invalid JSON response from server",
-            :payload_size=>781,
+            :payload_size=>737,
             :record_count=>3,
             :total_batches=>1,
             :url=>"https://agent.scalyr.com/addEvents",
@@ -231,7 +231,7 @@ describe LogStash::Outputs::Scalyr do
             :batch_num=>1,
             :code=>500,
             :message=>"Invalid JSON response from server",
-            :payload_size=>781,
+            :payload_size=>737,
             :record_count=>3,
             :total_batches=>1,
             :url=>"https://agent.scalyr.com/addEvents",

data/spec/logstash/outputs/scalyr_spec.rb

@@ -6,6 +6,7 @@ require "logstash/event"
 require "json"
 require "quantile"
 
+NODE_HOSTNAME = Socket.gethostname
 
 class MockClientSession
   DEFAULT_STATS = {
@@ -103,7 +104,7 @@ describe LogStash::Outputs::Scalyr do
         plugin.instance_variable_set(:@client_session, mock_client_session)
         plugin.instance_variable_set(:@session_id, "some_session_id")
         status_event = plugin.send_status
-        expect(status_event[:attrs]["message"]).to eq("Started Scalyr LogStash output plugin (%s)." % [PLUGIN_VERSION])
+        expect(status_event[:attrs]["message"]).to eq("Started Scalyr LogStash output plugin %s (compression_type=deflate,compression_level=deflate,json_library=stdlib)." % [PLUGIN_VERSION])
 
         # 2. Second send
         plugin.instance_variable_set(:@last_status_transmit_time, 100)
@@ -210,7 +211,7 @@ describe LogStash::Outputs::Scalyr do
         body = JSON.parse(result[0][:body])
         expect(body['events'].size).to eq(3)
         logattrs2 = body['logs'][2]['attrs']
-        expect(logattrs2.fetch('serverHost', nil)).to eq('my host 3')
+        expect(logattrs2.fetch(EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME, nil)).to eq('my host 3')
         expect(logattrs2.fetch('logfile', nil)).to eq('/logstash/my host 3')
         expect(logattrs2.fetch('tags', nil)).to eq(['t1', 't2', 't3'])
       end
@@ -240,7 +241,7 @@ describe LogStash::Outputs::Scalyr do
         body = JSON.parse(result[0][:body])
         expect(body['events'].size).to eq(3)
         logattrs2 = body['logs'][2]['attrs']
-        expect(logattrs2.fetch('serverHost', nil)).to eq('my host 3')
+        expect(logattrs2.fetch(EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME, nil)).to eq('my host 3')
         expect(logattrs2.fetch('logfile', nil)).to eq('/logstash/my host 3')
       end
     end
@@ -258,7 +259,7 @@ describe LogStash::Outputs::Scalyr do
         body = JSON.parse(result[0][:body])
         expect(body['events'].size).to eq(3)
         logattrs2 = body['logs'][2]['attrs']
-        expect(logattrs2.fetch('serverHost', nil)).to eq('my host 3')
+        expect(logattrs2.fetch(EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME, nil)).to eq('my host 3')
         expect(logattrs2.fetch('logfile', nil)).to eq('my file 3')
       end
     end
@@ -287,7 +288,6 @@ describe LogStash::Outputs::Scalyr do
                                                      'seq' => 3,
                                                      'source_file' => 'my file 3',
                                                      'source_host' => 'my host 3',
-                                                     'serverHost' => 'Logstash',
                                                      "tag_prefix_t1" => "true",
                                                      "tag_prefix_t2" => "true",
                                                      "tag_prefix_t3" => "true",
@@ -321,7 +321,6 @@ describe LogStash::Outputs::Scalyr do
                                                      'seq' => 3,
                                                      'source_file' => 'my file 3',
                                                      'source_host' => 'my host 3',
-                                                     'serverHost' => 'Logstash',
                                                      "tag_prefix_t1" => "true",
                                                      "tag_prefix_t2" => "true",
                                                      "tag_prefix_t3" => "true",
@@ -353,7 +352,6 @@ describe LogStash::Outputs::Scalyr do
                                                      'seq' => 3,
                                                      'source_file' => 'my file 3',
                                                      'source_host' => 'my host 3',
-                                                     'serverHost' => 'Logstash',
                                                      "tag_prefix_t1" => "true",
                                                      "tag_prefix_t2" => "true",
                                                      "tag_prefix_t3" => "true",
@@ -385,7 +383,6 @@ describe LogStash::Outputs::Scalyr do
                                                      'seq' => 3,
                                                      'source_file' => 'my file 3',
                                                      'source_host' => 'my host 3',
-                                                     'serverHost' => 'Logstash',
                                                      "tag_prefix_t1" => "true",
                                                      "tag_prefix_t2" => "true",
                                                      "tag_prefix_t3" => "true",
@@ -428,7 +425,6 @@ describe LogStash::Outputs::Scalyr do
                                                      'seq' => 3,
                                                      'source_file' => 'my file 3',
                                                      'source_host' => 'my host 3',
-                                                     'serverHost' => 'Logstash',
                                                      "tag_prefix_t1" => "true",
                                                      "tag_prefix_t2" => "true",
                                                      "tag_prefix_t3" => "true",
@@ -468,7 +464,6 @@ describe LogStash::Outputs::Scalyr do
                                                      'seq' => 3,
                                                      'source_file' => 'my file 3',
                                                      'source_host' => 'my host 3',
-                                                     'serverHost' => 'Logstash',
                                                      "tag_prefix_t1" => "true",
                                                      "tag_prefix_t2" => "true",
                                                      "tag_prefix_t3" => "true",
@@ -503,7 +498,6 @@ describe LogStash::Outputs::Scalyr do
                                                      'seq' => 3,
                                                      'source_file' => 'my file 3',
                                                      'source_host' => 'my host 3',
-                                                     'serverHost' => 'Logstash',
                                                      "tag_prefix_t1" => "true",
                                                      "tag_prefix_t2" => "true",
                                                      "tag_prefix_t3" => "true",
@@ -528,7 +522,6 @@ describe LogStash::Outputs::Scalyr do
                                                      'seq' => 3,
                                                      'source_file' => 'my file 3',
                                                      'source_host' => 'my host 3',
-                                                     'serverHost' => 'Logstash',
                                                      "tags" => ["t1", "t2", "t3"],
                                                      "parser" => "logstashParser",
                                                  })
@@ -554,19 +547,278 @@ describe LogStash::Outputs::Scalyr do
                                                      'seq' => 3,
                                                      'source_file' => 'my file 3',
                                                      'source_host' => 'my host 3',
-                                                     'serverHost' => 'Logstash',
                                                      "tags" => ["t1", "t2", "t3"],
                                                      "parser" => "logstashParser",
                                                  })
         expect(plugin.instance_variable_get(:@logger)).to have_received(:warn).with("Error while flattening record",
           {
             :error_message=>"Resulting flattened object will contain more keys than the configured flattening_max_key_count of 3",
-            :sample_keys=>["serverHost", "parser", "tags_2", "tags_1"]
+            :sample_keys=>["parser", "tags_2", "tags_1", "tags_0"]
           }
         ).exactly(3).times
       end
     end
 
+    context "serverHost attribute handling" do
+      it "no serverHost defined in server_attributes, no serverHost defined on event level - should use node hostname as the default session level value" do
+        config = {
+            'api_write_token' => '1234',
+        }
+        plugin = LogStash::Outputs::Scalyr.new(config)
+
+        allow(plugin).to receive(:send_status).and_return(nil)
+        plugin.register
+        e = LogStash::Event.new
+        result = plugin.build_multi_event_request_array([e])
+        body = JSON.parse(result[0][:body])
+        expect(body['sessionInfo']['serverHost']).to eq(NODE_HOSTNAME)
+
+        expect(body['logs']).to eq([])
+        expect(body['events'].size).to eq(1)
+        expect(body['events'][0]['attrs']["serverHost"]).to eq(nil)
+      end
+
+      it "serverHost defined in server_attributes, nothing defined on event level - server_attributes value should be used" do
+        config = {
+            'api_write_token' => '1234',
+            'server_attributes' => {'serverHost' => 'fooHost'}
+        }
+        plugin = LogStash::Outputs::Scalyr.new(config)
+
+        allow(plugin).to receive(:send_status).and_return(nil)
+        plugin.register
+        e = LogStash::Event.new
+        result = plugin.build_multi_event_request_array([e])
+        body = JSON.parse(result[0][:body])
+        expect(body['sessionInfo']['serverHost']).to eq('fooHost')
+        expect(body['events'].size).to eq(1)
+        expect(body['events'][0]['attrs']["serverHost"]).to eq(nil)
+      end
+
+      # sessionInfo serverHost always has precedence this means it's important that we don't include it if event level attribute is set, otherwise
+      # session level one would simply always overwrite event level one which would be ignored
+      it "serverHost defined in server_attributes (explicitly defined), event level serverHost defined - event level value should be used" do
+        config = {
+            'api_write_token' => '1234',
+            'server_attributes' => {'serverHost' => 'fooHost', 'attr1' => 'val1'}
+        }
+        plugin = LogStash::Outputs::Scalyr.new(config)
+
+        allow(plugin).to receive(:send_status).and_return(nil)
+        plugin.register
+        expect(plugin.server_attributes['serverHost']).to eq('fooHost')
+
+        e1 = LogStash::Event.new
+        e1.set('a1', 'v1')
+        e1.set('serverHost', 'event-host-1')
+
+        e2 = LogStash::Event.new
+        e2.set('a2', 'v2')
+        e2.set('serverHost', 'event-host-2')
+
+        e3 = LogStash::Event.new
+        e3.set('a3', 'v3')
+        e3.set('serverHost', 'event-host-2')
+
+        e4 = LogStash::Event.new
+        e4.set('a4', 'v4')
+        e4.set('serverHost', 'event-host-1')
+
+        result = plugin.build_multi_event_request_array([e1, e2, e3, e4])
+        body = JSON.parse(result[0][:body])
+        expect(body['sessionInfo']['serverHost']).to eq(nil)
+        expect(body['sessionInfo']['attr1']).to eq('val1')
+
+        expect(body['logs'].size).to eq(2)
+        expect(body['logs'][0]['id']).to eq(1)
+        expect(body['logs'][0]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq('event-host-1')
+        expect(body['logs'][1]['id']).to eq(2)
+        expect(body['logs'][1]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq('event-host-2')
+
+        expect(body['events'].size).to eq(4)
+        expect(body['events'][0]['log']).to eq(1)
+        expect(body['events'][0]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][0]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+
+        expect(body['events'][1]['log']).to eq(2)
+        expect(body['events'][1]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][1]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+
+        expect(body['events'][2]['log']).to eq(2)
+        expect(body['events'][2]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][2]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+
+        expect(body['events'][3]['log']).to eq(1)
+        expect(body['events'][3]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][3]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+      end
+
+      it "serverHost defined in server_attributes (defined via node hostname), event level serverHost defined - event level value should be used" do
+        config = {
+            'api_write_token' => '1234',
+            'server_attributes' => {'attr1' => 'val1'}
+        }
+        plugin = LogStash::Outputs::Scalyr.new(config)
+
+        allow(plugin).to receive(:send_status).and_return(nil)
+        plugin.register
+
+        expect(plugin.server_attributes['serverHost']).to eq(NODE_HOSTNAME)
+
+        e1 = LogStash::Event.new
+        e1.set('a1', 'v1')
+        e1.set('serverHost', 'event-host-1')
+
+        e2 = LogStash::Event.new
+        e2.set('a2', 'v2')
+        e2.set('serverHost', 'event-host-2')
+
+        e3 = LogStash::Event.new
+        e3.set('a3', 'v3')
+        e3.set('serverHost', 'event-host-2')
+
+        e4 = LogStash::Event.new
+        e4.set('a4', 'v4')
+        e4.set('serverHost', 'event-host-1')
+
+        result = plugin.build_multi_event_request_array([e1, e2, e3, e4])
+        body = JSON.parse(result[0][:body])
+        expect(body['sessionInfo']['serverHost']).to eq(nil)
+        expect(body['sessionInfo']['attr1']).to eq('val1')
+
+        expect(body['logs'].size).to eq(2)
+        expect(body['logs'][0]['id']).to eq(1)
+        expect(body['logs'][0]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq('event-host-1')
+        expect(body['logs'][1]['id']).to eq(2)
+        expect(body['logs'][1]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq('event-host-2')
+
+        expect(body['events'].size).to eq(4)
+        expect(body['events'][0]['log']).to eq(1)
+        expect(body['events'][0]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][0]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+
+        expect(body['events'][1]['log']).to eq(2)
+        expect(body['events'][1]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][1]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+
+        expect(body['events'][2]['log']).to eq(2)
+        expect(body['events'][2]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][2]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+
+        expect(body['events'][3]['log']).to eq(1)
+        expect(body['events'][3]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][3]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+      end
+
+      # If set_session_level_serverhost_on_events config option is true, we set session level serverHost on events which don't
+      # explicitly define this special attribute.
+      it "serverHost defined in server_attributes (explicitly defined), event level serverHost defined - event level value should be used and server level one for events without server host" do
+        config = {
+            'api_write_token' => '1234',
+            'server_attributes' => {'serverHost' => 'top-level-session-host', 'attr1' => 'val1'}
+        }
+        plugin = LogStash::Outputs::Scalyr.new(config)
+
+        allow(plugin).to receive(:send_status).and_return(nil)
+        plugin.register
+        expect(plugin.server_attributes['serverHost']).to eq('top-level-session-host')
+
+        e1 = LogStash::Event.new
+        e1.set('a1', 'v1')
+        e1.set('serverHost', 'event-host-1')
+
+        e2 = LogStash::Event.new
+        e2.set('a2', 'v2')
+
+        e3 = LogStash::Event.new
+        e3.set('a3', 'v3')
+
+        e4 = LogStash::Event.new
+        e4.set('a4', 'v4')
+        e4.set('serverHost', 'event-host-1')
+
+        result = plugin.build_multi_event_request_array([e1, e2, e3, e4])
+        body = JSON.parse(result[0][:body])
+        expect(body['sessionInfo']['serverHost']).to eq(nil)
+        expect(body['sessionInfo']['attr1']).to eq('val1')
+
+        expect(body['logs'].size).to eq(1)
+        expect(body['logs'][0]['id']).to eq(1)
+        expect(body['logs'][0]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq('event-host-1')
+
+        expect(body['events'].size).to eq(4)
+        expect(body['events'][0]['log']).to eq(1)
+        expect(body['events'][0]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][0]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+
+        expect(body['events'][1]['log']).to eq(nil)
+        expect(body['events'][1]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][2]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq("top-level-session-host")
+
+        expect(body['events'][1]['log']).to eq(nil)
+        expect(body['events'][2]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][2]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq("top-level-session-host")
+
+        expect(body['events'][3]['log']).to eq(1)
+        expect(body['events'][3]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][3]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+      end
+
+      it "no serverHost defined, event level serverHost defined - event level value should be used" do
+        config = {
+            'api_write_token' => '1234',
+            'server_attributes' => {'attr1' => 'val1'},
+            'use_hostname_for_serverhost' => false
+        }
+        plugin = LogStash::Outputs::Scalyr.new(config)
+
+        allow(plugin).to receive(:send_status).and_return(nil)
+        plugin.register
+
+        expect(plugin.server_attributes['serverHost']).to eq(nil)
+
+        e1 = LogStash::Event.new
+        e1.set('a1', 'v1')
+        e1.set('serverHost', 'event-host-1')
+
+        e2 = LogStash::Event.new
+        e2.set('a2', 'v2')
+        e2.set('serverHost', 'event-host-2')
+
+        e3 = LogStash::Event.new
+        e3.set('a3', 'v3')
+        e3.set('serverHost', 'event-host-2')
+
+        e4 = LogStash::Event.new
+        e4.set('a4', 'v4')
+        e4.set('serverHost', 'event-host-2')
+
+        result = plugin.build_multi_event_request_array([e1, e2, e3, e4])
+        body = JSON.parse(result[0][:body])
+        expect(body['sessionInfo']['serverHost']).to eq(nil)
+        expect(body['sessionInfo']['attr1']).to eq('val1')
+
+        expect(body['logs'][0]['id']).to eq(1)
+        expect(body['logs'][0]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq('event-host-1')
+        expect(body['logs'][1]['id']).to eq(2)
+        expect(body['logs'][1]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq('event-host-2')
+
+        expect(body['events'].size).to eq(4)
+        expect(body['events'][0]['log']).to eq(1)
+        expect(body['events'][0]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][0]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+        expect(body['events'][1]['log']).to eq(2)
+        expect(body['events'][1]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][1]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+        expect(body['events'][2]['log']).to eq(2)
+        expect(body['events'][2]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][2]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+        expect(body['events'][3]['log']).to eq(2)
+        expect(body['events'][3]['attrs']["serverHost"]).to eq(nil)
+        expect(body['events'][3]['attrs'][EVENT_LEVEL_SERVER_HOST_ATTRIBUTE_NAME]).to eq(nil)
+      end
+    end
+
     context "when receiving an event with Bignums" do
       config = {
           'api_write_token' => '1234',
@@ -585,6 +837,59 @@ describe LogStash::Outputs::Scalyr do
       end
     end
 
+    context "host attribute handling" do
+      it "host attribute removed by default" do
+       config = {
+            'api_write_token' => '1234',
+        }
+        plugin = LogStash::Outputs::Scalyr.new(config)
+
+        allow(plugin).to receive(:send_status).and_return(nil)
+        plugin.register
+
+        expect(plugin.server_attributes['serverHost']).to eq(NODE_HOSTNAME)
+
+        e1 = LogStash::Event.new
+        e1.set('a1', 'v1')
+        e1.set('host', 'event-host-1')
+
+        result = plugin.build_multi_event_request_array([e1])
+        body = JSON.parse(result[0][:body])
+        expect(body['sessionInfo']['serverHost']).to eq(NODE_HOSTNAME)
+
+        expect(body['logs'].size).to eq(0)
+
+        expect(body['events'].size).to eq(1)
+        expect(body['events'][0]['attrs']["host"]).to eq(nil)
+      end
+
+      it "host attribute not removed if config option set" do
+       config = {
+            'api_write_token' => '1234',
+            'remove_host_attribute_from_events' => false,
+        }
+        plugin = LogStash::Outputs::Scalyr.new(config)
+
+        allow(plugin).to receive(:send_status).and_return(nil)
+        plugin.register
+
+        expect(plugin.server_attributes['serverHost']).to eq(NODE_HOSTNAME)
+
+        e1 = LogStash::Event.new
+        e1.set('a1', 'v1')
+        e1.set('host', 'event-host-1')
+
+        result = plugin.build_multi_event_request_array([e1])
+        body = JSON.parse(result[0][:body])
+        expect(body['sessionInfo']['serverHost']).to eq(NODE_HOSTNAME)
+
+        expect(body['logs'].size).to eq(0)
+
+        expect(body['events'].size).to eq(1)
+        expect(body['events'][0]['attrs']["host"]).to eq("event-host-1")
+      end
+    end
+
     context "when using custom json library" do
       it "stdlib (implicit)" do
         config = {
@@ -598,7 +903,7 @@ describe LogStash::Outputs::Scalyr do
         e.set('bignumber', 20)
         result = plugin.build_multi_event_request_array([e])
         body = JSON.parse(result[0][:body])
-        expect(result[0][:body]).to include('{"monitor":"pluginLogstash"}')
+        expect(result[0][:body]).to include(sprintf('{"serverHost":"%s","monitor":"pluginLogstash"}', NODE_HOSTNAME))
         expect(body['events'].size).to eq(1)
       end
 
@@ -615,7 +920,7 @@ describe LogStash::Outputs::Scalyr do
         e.set('bignumber', 20)
         result = plugin.build_multi_event_request_array([e])
         body = JSON.parse(result[0][:body])
-        expect(result[0][:body]).to include('{"monitor":"pluginLogstash"}')
+        expect(result[0][:body]).to include(sprintf('{"serverHost":"%s","monitor":"pluginLogstash"}', NODE_HOSTNAME))
         expect(body['events'].size).to eq(1)
       end
 
@@ -632,7 +937,7 @@ describe LogStash::Outputs::Scalyr do
         e.set('bignumber', 20)
         result = plugin.build_multi_event_request_array([e])
         body = JSON.parse(result[0][:body])
-        expect(result[0][:body]).to include('{"monitor":"pluginLogstash"}')
+        expect(result[0][:body]).to include(sprintf('{"serverHost":"%s","monitor":"pluginLogstash"}', NODE_HOSTNAME))
         expect(body['events'].size).to eq(1)
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-output-scalyr
 version: !ruby/object:Gem::Version
-  version: 0.1.26.beta
+  version: 0.2.0.beta
 platform: ruby
 authors:
 - Edward Chee
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-08-30 00:00:00.000000000 Z
+date: 2021-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement
@@ -164,6 +164,7 @@ files:
 - spec/benchmarks/flattening_and_serialization.rb
 - spec/benchmarks/json_serialization.rb
 - spec/benchmarks/metrics_overhead.rb
+- spec/benchmarks/set_session_level_serverhost_on_events.rb
 - spec/benchmarks/util.rb
 - spec/logstash/outputs/scalyr_integration_spec.rb
 - spec/logstash/outputs/scalyr_spec.rb
@@ -4097,6 +4098,7 @@ test_files:
 - spec/benchmarks/flattening_and_serialization.rb
 - spec/benchmarks/json_serialization.rb
 - spec/benchmarks/metrics_overhead.rb
+- spec/benchmarks/set_session_level_serverhost_on_events.rb
 - spec/benchmarks/util.rb
 - spec/logstash/outputs/scalyr_integration_spec.rb
 - spec/logstash/outputs/scalyr_spec.rb