Improvement request: use_ack chunk acknowledgement, http_keepalive

[sspreitzer]

Hi there

Thank you for this plugin!

In the current implementation of use_ack is only usable for small amounts of events. use_ack blocks the process by it's check_interval and per event POST request.

This should be implemented as per chunk POST of data and also per chunk request of acknowledgement (one POST with list of events instead of one POST per event).

Finally http_keepalive should be implemented as well.

use_ack with 10000 events is not usable.

Thank you and kind regards
Sascha

[venky999]

I am seeing same issue..

[repeatedly]

This should be implemented as per chunk POST of data and also per chunk request of acknowledgement (one POST with list of events instead of one POST per event).

Current implemention seems to use this approach: https://github.com/fluent/fluent-plugin-splunk/blob/master/lib/fluent/plugin/out_splunk_hec.rb#L150-L176
I'm not an expert of Splunk internal. Does this HTTP call sequence check acks for each event?

[venky999]

More info here https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/AboutHECIDXAck

[repeatedly]

Yes. My comment is based on splunk document.
Could you explain why sending only 1 ackID for batch request is same as send per event, not send per chunk?