logstash-output-splunk_hec 0.2.2 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/logstash/outputs/splunk_hec.rb +3 -19
- data/logstash-output-splunk_hec.gemspec +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 77f41ae7b26b099e92fdef3e0cf4e41855a681bfa94f903d04d95a5907cb6a52
|
|
4
|
+
data.tar.gz: 525a3432cfddbf1a40fc951a62efd198f7901cb497fe750bce967a042c1d12ea
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: f72c3bef105aa5604165b8ee718728cee25b4563292eb6459eaa7235bbed6da512770d1f60db9fa7a2eab8e128a3875e3d1a56aa12269728a3952556d00acea2
|
|
7
|
+
data.tar.gz: fdb77029972571cc683511113f89e599c963f47a381295b9dd87f4e50f7662e43b9cd05a6dbae3bcd9c0a0c239db31baf2667f535ac5bd8d68bccf149767a268
|
|
@@ -8,9 +8,7 @@ require "concurrent"
|
|
|
8
8
|
|
|
9
9
|
class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
|
|
10
10
|
config_name "splunk_hec"
|
|
11
|
-
|
|
12
11
|
concurrency :shared
|
|
13
|
-
|
|
14
12
|
config :hec_token, :validate => :string, :required => true
|
|
15
13
|
config :hec_host, :validate => :string, :required => true
|
|
16
14
|
config :host, :validate => :string, :default => "none"
|
|
@@ -26,9 +24,7 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
|
|
|
26
24
|
def register
|
|
27
25
|
@http = Net::HTTP.new(@hec_host, @port)
|
|
28
26
|
@http.use_ssl = true
|
|
29
|
-
@http.verify_mode = OpenSSL::SSL::VERIFY_NONE
|
|
30
27
|
@uri = URI.parse("https://#{@hec_host}:#{@port}/services/collector/event")
|
|
31
|
-
|
|
32
28
|
@event_batch = Concurrent::Array.new
|
|
33
29
|
@last_flush = Concurrent::AtomicReference.new(Time.now)
|
|
34
30
|
end
|
|
@@ -36,7 +32,6 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
|
|
|
36
32
|
public
|
|
37
33
|
def receive(event)
|
|
38
34
|
format_and_add_to_batch(event)
|
|
39
|
-
|
|
40
35
|
if batch_full? || time_to_flush?
|
|
41
36
|
flush_batch
|
|
42
37
|
end
|
|
@@ -51,7 +46,6 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
|
|
|
51
46
|
def format_and_add_to_batch(event)
|
|
52
47
|
event_data = event.to_hash
|
|
53
48
|
event_data.delete("@version")
|
|
54
|
-
|
|
55
49
|
hec_event = {
|
|
56
50
|
"time" => event.get("@timestamp").to_i,
|
|
57
51
|
"host" => @host != "none" ? @host : event.get("host")&.fetch("name") { Socket.gethostname } || "default_host",
|
|
@@ -60,7 +54,6 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
|
|
|
60
54
|
"index" => @index,
|
|
61
55
|
"event" => event_data
|
|
62
56
|
}
|
|
63
|
-
|
|
64
57
|
@event_batch << hec_event
|
|
65
58
|
end
|
|
66
59
|
|
|
@@ -94,23 +87,14 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
|
|
|
94
87
|
@last_flush.set(Time.now)
|
|
95
88
|
return
|
|
96
89
|
else
|
|
97
|
-
@logger.warn("Failed to send batch to Splunk, will retry",
|
|
98
|
-
:response_code => response.code,
|
|
99
|
-
:response_body => response.body,
|
|
100
|
-
:attempt => attempt + 1,
|
|
101
|
-
:batch_size => batch_to_send.size)
|
|
90
|
+
@logger.warn("Failed to send batch to Splunk, will retry", :response_code => response.code, :response_body => response.body, :attempt => attempt + 1, :batch_size => batch_to_send.size)
|
|
102
91
|
end
|
|
103
92
|
rescue StandardError => e
|
|
104
|
-
@logger.error("Error sending batch to Splunk, will retry",
|
|
105
|
-
:error => e.message,
|
|
106
|
-
:attempt => attempt + 1,
|
|
107
|
-
:batch_size => batch_to_send.size)
|
|
93
|
+
@logger.error("Error sending batch to Splunk, will retry", :error => e.message, :attempt => attempt + 1, :batch_size => batch_to_send.size)
|
|
108
94
|
end
|
|
109
95
|
sleep(1)
|
|
110
96
|
end
|
|
111
|
-
|
|
112
|
-
@logger.error("Failed to send batch to Splunk after #{@retry_count} attempts",
|
|
113
|
-
:batch_size => batch_to_send.size)
|
|
97
|
+
@logger.error("Failed to send batch to Splunk after #{@retry_count} attempts", :batch_size => batch_to_send.size)
|
|
114
98
|
@event_batch.concat(batch_to_send)
|
|
115
99
|
end
|
|
116
100
|
end
|