logstash-output-splunk_hec 0.2.2 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f12ba6a4c0c7bd31ea2444db3fa0c169c064f2ca57e3a84e99a6a302f9e730bf
-  data.tar.gz: 13b156bbb63461b8d5c5937ac413815e32de9d6912fc6572369c7157e974984f
+  metadata.gz: d8e13e0d8fc9710b93c781847aea608d0465c1d1da0c09515672c03933c8ffaa
+  data.tar.gz: b153c7ec6cbf0c3089d88017d97d6fe0a255c84ce934f62f5f6690b8fa0a7a5c
 SHA512:
-  metadata.gz: c0f8630726eb385d0b12eff6902889a18522b40dcb3bb9465e8203b26aabe2f0e68d5037a1af34f773f0ddb178a14d19bd953e01dd7ffa6776e3a162752c4763
-  data.tar.gz: 43136925203426b59f606b4190b255a2ef9f4fd92a2e6761e553ba0856e486459acf57e84e5717e64ab1c17177b14366c58b4c24309508e6107a2c1193da6bb0
+  metadata.gz: a322311348c0a03d7b5ab34e6c172ef0b0c1871ac449bcbbdeb89dedcc17aacc2e09d6dc1fb2b12ec56aace9931b2785ad7f6c473aff4eae808704f3a46bbf64
+  data.tar.gz: f4a705ec8d6ca6ffe75efa6e2193c27f5bee4d8a05a06dc7a9c08e55802dd61ed1eeaf7725995102c351f126107960b8b9b6702160f482ca3dbd00e9001527da

data/lib/logstash/outputs/splunk_hec.rb

@@ -8,9 +8,7 @@ require "concurrent"
 
 class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
   config_name "splunk_hec"
-
   concurrency :shared
-
   config :hec_token, :validate => :string, :required => true
   config :hec_host, :validate => :string, :required => true
   config :host, :validate => :string, :default => "none"
@@ -26,9 +24,7 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
   def register
     @http = Net::HTTP.new(@hec_host, @port)
     @http.use_ssl = true
-    @http.verify_mode = OpenSSL::SSL::VERIFY_NONE
     @uri = URI.parse("https://#{@hec_host}:#{@port}/services/collector/event")
-    
     @event_batch = Concurrent::Array.new
     @last_flush = Concurrent::AtomicReference.new(Time.now)
   end
@@ -36,7 +32,6 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
   public
   def receive(event)
     format_and_add_to_batch(event)
-    
     if batch_full? || time_to_flush?
       flush_batch
     end
@@ -51,19 +46,26 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
   def format_and_add_to_batch(event)
     event_data = event.to_hash
     event_data.delete("@version")
-
     hec_event = {
       "time" => event.get("@timestamp").to_i,
-      "host" => @host != "none" ? @host : event.get("host")&.fetch("name") { Socket.gethostname } || "default_host",
-      "source" => @source != "none" ? @source : event.get("source") { "logstash" },
-      "sourcetype" => @sourcetype != "none" ? @sourcetype : "_json",
-      "index" => @index,
+      "host" => interpolate_field(@host, event),
+      "source" => interpolate_field(@source, event),
+      "sourcetype" => interpolate_field(@sourcetype, event),
+      "index" => interpolate_field(@index, event),
       "event" => event_data
     }    
-
     @event_batch << hec_event
   end
 
+  private
+  def interpolate_field(field, event)
+    return field if field == "none"
+    event.sprintf(field)
+  rescue => e
+    @logger.warn("Error interpolating field", :field => field, :error => e.message)
+    field
+  end
+
   private
   def batch_full?
     @event_batch.size >= @batch_size
@@ -94,23 +96,14 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
           @last_flush.set(Time.now)
           return
         else
-          @logger.warn("Failed to send batch to Splunk, will retry",
-                       :response_code => response.code,
-                       :response_body => response.body,
-                       :attempt => attempt + 1,
-                       :batch_size => batch_to_send.size)
+          @logger.warn("Failed to send batch to Splunk, will retry", :response_code => response.code, :response_body => response.body, :attempt => attempt + 1, :batch_size => batch_to_send.size)
         end
       rescue StandardError => e
-        @logger.error("Error sending batch to Splunk, will retry",
-                      :error => e.message,
-                      :attempt => attempt + 1,
-                      :batch_size => batch_to_send.size)
+        @logger.error("Error sending batch to Splunk, will retry", :error => e.message, :attempt => attempt + 1, :batch_size => batch_to_send.size)
       end
       sleep(1)
     end
-
-    @logger.error("Failed to send batch to Splunk after #{@retry_count} attempts",
-                  :batch_size => batch_to_send.size)
+    @logger.error("Failed to send batch to Splunk after #{@retry_count} attempts", :batch_size => batch_to_send.size)
     @event_batch.concat(batch_to_send)
   end
 end

data/logstash-output-splunk_hec.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name          = 'logstash-output-splunk_hec'
-  s.version       = '0.2.2'
+  s.version       = '0.3.1'
   s.licenses      = ['Apache-2.0']
   s.summary       = 'Logstash Output Plugin for SplunkHec'
   s.authors       = ['Elisha Mawson']

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: logstash-output-splunk_hec
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.3.1
 platform: ruby
 authors:
 - Elisha Mawson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-08-29 00:00:00.000000000 Z
+date: 2024-08-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core-plugin-api