logstash-output-splunk_hec 0.2.0 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c8c44287f9aa9bd45833d5cce538e60db131970141b39c951f64ccffe42e9bc3
-  data.tar.gz: 240a8fb2b2abaa8f60aedd60e158531f21419d90cbc4f4d966096c7fe9eb82e5
+  metadata.gz: f12ba6a4c0c7bd31ea2444db3fa0c169c064f2ca57e3a84e99a6a302f9e730bf
+  data.tar.gz: 13b156bbb63461b8d5c5937ac413815e32de9d6912fc6572369c7157e974984f
 SHA512:
-  metadata.gz: d35c322a512d12e456948eabdbc827dbdb324f6c42ac0114135ce2764f26795f6107f2a6540a82419a2a607ce3aa09585a48cf10e851ab7fd6dd412a3b9271d4
-  data.tar.gz: e891f646147845fa33c5d872fe775afded22a49b41009785eebeb7ea18e0afc75f86cd7c8344dff7ad96cbc9bf651852ca3da369041682ef041136f6ca3d6997
+  metadata.gz: c0f8630726eb385d0b12eff6902889a18522b40dcb3bb9465e8203b26aabe2f0e68d5037a1af34f773f0ddb178a14d19bd953e01dd7ffa6776e3a162752c4763
+  data.tar.gz: 43136925203426b59f606b4190b255a2ef9f4fd92a2e6761e553ba0856e486459acf57e84e5717e64ab1c17177b14366c58b4c24309508e6107a2c1193da6bb0

data/lib/logstash/outputs/splunk_hec.rb

@@ -11,21 +11,23 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
 
   concurrency :shared
 
-  config :token, :validate => :string, :required => true
-  config :host, :validate => :string, :required => true
+  config :hec_token, :validate => :string, :required => true
+  config :hec_host, :validate => :string, :required => true
+  config :host, :validate => :string, :default => "none"
+  config :source, :validate => :string, :default => "none"
+  config :sourcetype, :validate => :string, :default => "none"
   config :port, :validate => :number, :default => 443
   config :index, :validate => :string, :default => "main"
-  config :sourcetype, :validate => :string, :default => "_json"
   config :batch_size, :validate => :number, :default => 100
   config :flush_interval, :validate => :number, :default => 5
   config :retry_count, :validate => :number, :default => 3
 
   public
   def register
-    @http = Net::HTTP.new(@host, @port)
+    @http = Net::HTTP.new(@hec_host, @port)
     @http.use_ssl = true
     @http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-    @uri = URI.parse("https://#{@host}:#{@port}/services/collector/event")
+    @uri = URI.parse("https://#{@hec_host}:#{@port}/services/collector/event")
     
     @event_batch = Concurrent::Array.new
     @last_flush = Concurrent::AtomicReference.new(Time.now)
@@ -51,14 +53,13 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
     event_data.delete("@version")
 
     hec_event = {
-      "time" => (event.get("@timestamp").to_f * 1000).to_i,
-      "host" => event.get("[host][name]") || Socket.gethostname,
-      "source" => event.get("source") || "logstash",
-      "sourcetype" => @sourcetype,
-      "index" => @index
-    }
-
-    hec_event.merge!(event_data)
+      "time" => event.get("@timestamp").to_i,
+      "host" => @host != "none" ? @host : event.get("host")&.fetch("name") { Socket.gethostname } || "default_host",
+      "source" => @source != "none" ? @source : event.get("source") { "logstash" },
+      "sourcetype" => @sourcetype != "none" ? @sourcetype : "_json",
+      "index" => @index,
+      "event" => event_data
+    }    
 
     @event_batch << hec_event
   end
@@ -79,11 +80,11 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
 
     batch_to_send = @event_batch.slice!(0, @batch_size)
     request = Net::HTTP::Post.new(@uri.request_uri)
-    request["Authorization"] = "Splunk #{@token}"
+    request["Authorization"] = "Splunk #{@hec_token}"
     request["Content-Type"] = "application/json"
     request.body = batch_to_send.map(&:to_json).join("\n")
 
-    @logger.warn("Request body to be sent to Splunk:", :request_body => request.body)
+    @logger.warn("Request body to be sent to Splunk: #{request.body}")
 
     @retry_count.times do |attempt|
       begin

data/logstash-output-splunk_hec.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name          = 'logstash-output-splunk_hec'
-  s.version       = '0.2.0'
+  s.version       = '0.2.2'
   s.licenses      = ['Apache-2.0']
   s.summary       = 'Logstash Output Plugin for SplunkHec'
   s.authors       = ['Elisha Mawson']

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: logstash-output-splunk_hec
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.2
 platform: ruby
 authors:
 - Elisha Mawson