logstash-output-splunk_hec 0.3.0 → 0.3.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/logstash/outputs/splunk_hec.rb +13 -4
- data/logstash-output-splunk_hec.gemspec +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 93ea85c3998aa97ec0abd4c12aaa4626e16ea4f79b31c7e69867b74e239f853d
|
|
4
|
+
data.tar.gz: c8c2689c3f3d5fcaddacf61b2f01597d4092ff3db7d0757417a1402dfde0e697
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: b684cd697bb5646cd706ec5dd3ad93eb8fca938835cba15f2983d1ee61b4036a336e6e7e05cf8c5e2b600a6e9002b8445fe8fe700c581c5e54e0a73e23a17752
|
|
7
|
+
data.tar.gz: b91c638d3f0ae51baeb020352ebb08f7f7f43501aa1b885fd73b37bd4cff5b8852efeff9bf99d36daaa992d8f1414218488fb9ec634a0571da5d25349a22be04
|
|
@@ -48,15 +48,24 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
|
|
|
48
48
|
event_data.delete("@version")
|
|
49
49
|
hec_event = {
|
|
50
50
|
"time" => event.get("@timestamp").to_i,
|
|
51
|
-
"host" => @host
|
|
52
|
-
"source" => @source
|
|
53
|
-
"sourcetype" => @sourcetype
|
|
54
|
-
"index" => @index,
|
|
51
|
+
"host" => interpolate_field(@host, event),
|
|
52
|
+
"source" => interpolate_field(@source, event),
|
|
53
|
+
"sourcetype" => interpolate_field(@sourcetype, event),
|
|
54
|
+
"index" => interpolate_field(@index, event),
|
|
55
55
|
"event" => event_data
|
|
56
56
|
}
|
|
57
57
|
@event_batch << hec_event
|
|
58
58
|
end
|
|
59
59
|
|
|
60
|
+
private
|
|
61
|
+
def interpolate_field(field, event)
|
|
62
|
+
return field if field == "none"
|
|
63
|
+
event.sprintf(field)
|
|
64
|
+
rescue => e
|
|
65
|
+
@logger.warn("Error interpolating field", :field => field, :error => e.message)
|
|
66
|
+
field
|
|
67
|
+
end
|
|
68
|
+
|
|
60
69
|
private
|
|
61
70
|
def batch_full?
|
|
62
71
|
@event_batch.size >= @batch_size
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: logstash-output-splunk_hec
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.3.
|
|
4
|
+
version: 0.3.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Elisha Mawson
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2024-08-
|
|
11
|
+
date: 2024-08-30 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: logstash-core-plugin-api
|