logstash-output-splunk 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: cac250d08ffbd2a3ea8d4ae96055c0b32236f053
-  data.tar.gz: 5324435255ebc3c2d2ca5dd3f60e37104f1c3cfd
+  metadata.gz: b521d0bd83dfc50757e1c573198cf9d9721bb0ca
+  data.tar.gz: 00f6e480d8a1f75182f20775327ff0f885df31e3
 SHA512:
-  metadata.gz: 6581b385bfc216344467707ec0767179159518b9d77013c4be1a68efdc4f6a59f4a4fa6473f8f1630c3135079b30aa58a437a6b8a5084f6039a7ff690c08bcaf
-  data.tar.gz: 9ffdc739f6429eddf2dd132c21e038d2048a46597d530d7c61ec737913494474e3b83e6b3ce19bf9476ddd378b70322baa26149b8a766aa0b862c60bc28503cd
+  metadata.gz: 81e4a852bae286a84f9ad3e564e56028f7e03665a27912d012925cb1532b9c965a97840c23867e7a0ae82ef5a2277c49fc1a35e3232a33202553ba2a70f5f99d
+  data.tar.gz: 12f316ee5e846ec5e30dbb141a91b00187b74a2424edaf612571acbb204e6d233b624460ebbb355e4759220c7388974b1063f3a6e3ab5b1fae8d84dd504d68a1

data/CHANGELOG.md

@@ -1,2 +1,5 @@
+## 0.0.2
+ - Raw endpoint support
+
 ## 0.0.1
  - Initial

data/README.md

@@ -11,9 +11,12 @@ It is fully free and fully open source. The license is Apache 2.0, meaning you a
 <pre><code>
 output {
   splunk {
-    url => "https://localhost:8080/services/collector/event/1.0"
+    url => "https://localhost:8080/services/collector/raw"
     # HTTP Event Collector token
     token => "xxxxxxx-xxxx-xxxx-xxxx-xxxxxx"
+    # Channel Identifier GUID
+    channel_identifier => "FE0ECFAD-13D5-401B-847D-77833BD77133"
+    is_raw => true
     is_batch => true
     mapping => {
      "event" => "%{message}"

data/lib/logstash/outputs/splunk.rb

@@ -44,6 +44,12 @@ class LogStash::Outputs::Splunk < LogStash::Outputs::Base
   # Splunk HTTP Event Collector tokens to use
   config :token, :validate => :string, :required => :true
 
+  # Splunk HTTP body is raw data
+  config :is_raw, :validate => :boolean, :default => true
+
+  # Splunk Channel Identifier GUID
+  config :channel_identifier, :validate => :string, :required => false
+
   # Content type
   #
   # If not specified, this defaults to the following:
@@ -94,10 +100,15 @@ class LogStash::Outputs::Splunk < LogStash::Outputs::Base
     @requests = Array.new
     @content_type = "application/json"
     @is_batch = @is_batch
+    @is_raw = @is_raw
+    @channel_identifier = @channel_identifier
     @headers["Content-Type"] = @content_type
 
     # Splunk HEC token
     @headers["Authorization"] = "Splunk " + @token
+    if @channel_identifier
+      @headers["X-Splunk-Request-Channel"] = @channel_identifier
+    end
 
     # Run named Timer as daemon thread
     @timer = java.util.Timer.new("Splunk Output #{self.params['id']}", true)
@@ -283,7 +294,11 @@ class LogStash::Outputs::Splunk < LogStash::Outputs::Base
   def event_body(event)
     # TODO: Create an HTTP post data codec, use that here
     if @is_batch
-      event.map {|e| LogStash::Json.dump(map_event(e)) }.join("\n")
+      if @is_raw
+        event.map {|e| map_event(e).fetch("message") }.join("\n")
+      else
+        event.map {|e| LogStash::Json.dump(map_event(e)) }.join("\n")
+      end
     else
       LogStash::Json.dump(map_event(event))
     end
@@ -315,10 +330,11 @@ class LogStash::Outputs::Splunk < LogStash::Outputs::Base
 
   def map_event(event)
     if @mapping
-      convert_mapping(@mapping, event)
+      msg_body = convert_mapping(@mapping, event)
     else
-      event.to_hash
+      msg_body = event.to_hash
     end
+    {"event" => msg_body}
   end
 
   def event_headers(event)

data/logstash-output-splunk.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name            = 'logstash-output-splunk'
-  s.version         = '0.0.1'
+  s.version         = '0.0.2'
   s.licenses        = ['Apache License (2.0)']
   s.summary         = "Sends events to a Splunk HTTP Event Collector REST API endpoints"
   s.description     = "This gem is a Logstash plugin required to be installed on top of the Logstash core pipeline using $LS_HOME/bin/logstash-plugin install gemname. This gem is not a stand-alone program"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-output-splunk
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Jian Chen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-02-06 00:00:00.000000000 Z
+date: 2020-02-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core-plugin-api