logstash-output-splunk_hec 0.3.0 → 0.3.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/logstash/outputs/splunk_hec.rb +13 -4
- data/logstash-output-splunk_hec.gemspec +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: d8e13e0d8fc9710b93c781847aea608d0465c1d1da0c09515672c03933c8ffaa
|
|
4
|
+
data.tar.gz: b153c7ec6cbf0c3089d88017d97d6fe0a255c84ce934f62f5f6690b8fa0a7a5c
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: a322311348c0a03d7b5ab34e6c172ef0b0c1871ac449bcbbdeb89dedcc17aacc2e09d6dc1fb2b12ec56aace9931b2785ad7f6c473aff4eae808704f3a46bbf64
|
|
7
|
+
data.tar.gz: f4a705ec8d6ca6ffe75efa6e2193c27f5bee4d8a05a06dc7a9c08e55802dd61ed1eeaf7725995102c351f126107960b8b9b6702160f482ca3dbd00e9001527da
|
|
@@ -48,15 +48,24 @@ class LogStash::Outputs::SplunkHec < LogStash::Outputs::Base
|
|
|
48
48
|
event_data.delete("@version")
|
|
49
49
|
hec_event = {
|
|
50
50
|
"time" => event.get("@timestamp").to_i,
|
|
51
|
-
"host" => @host
|
|
52
|
-
"source" => @source
|
|
53
|
-
"sourcetype" => @sourcetype
|
|
54
|
-
"index" => @index,
|
|
51
|
+
"host" => interpolate_field(@host, event),
|
|
52
|
+
"source" => interpolate_field(@source, event),
|
|
53
|
+
"sourcetype" => interpolate_field(@sourcetype, event),
|
|
54
|
+
"index" => interpolate_field(@index, event),
|
|
55
55
|
"event" => event_data
|
|
56
56
|
}
|
|
57
57
|
@event_batch << hec_event
|
|
58
58
|
end
|
|
59
59
|
|
|
60
|
+
private
|
|
61
|
+
def interpolate_field(field, event)
|
|
62
|
+
return field if field == "none"
|
|
63
|
+
event.sprintf(field)
|
|
64
|
+
rescue => e
|
|
65
|
+
@logger.warn("Error interpolating field", :field => field, :error => e.message)
|
|
66
|
+
field
|
|
67
|
+
end
|
|
68
|
+
|
|
60
69
|
private
|
|
61
70
|
def batch_full?
|
|
62
71
|
@event_batch.size >= @batch_size
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: logstash-output-splunk_hec
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.3.
|
|
4
|
+
version: 0.3.1
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Elisha Mawson
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2024-08-
|
|
11
|
+
date: 2024-08-30 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: logstash-core-plugin-api
|