Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion README.hec.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,9 @@
ca_file /path/to/ca.pem

# buffered output parameter
flush_interval 10s
<buffer>
flush_interval 10s
</buffer>
</match>
```

Expand Down
8 changes: 6 additions & 2 deletions README.tcp.md
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,9 @@
ca_file /path/to/ca.pem

# buffered output parameter
flush_interval 10s
<buffer>
flush_interval 10s
</buffer>
</match>
```

Expand All @@ -70,7 +72,9 @@ This example shows json format.
ca_file /path/to/ca.pem

# flush
flush_interval 10s
<buffer>
flush_interval 10s
</buffer>
</match>
```

Expand Down
2 changes: 1 addition & 1 deletion fluent-plugin-splunk-enterprise.gemspec
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ Gem::Specification.new do |spec|
spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
spec.require_paths = ["lib"]

spec.add_dependency 'fluentd', [">= 0.12.0"]
spec.add_dependency 'fluentd', [">= 1"]
spec.add_dependency 'json'
spec.add_dependency 'httpclient'

Expand Down
23 changes: 14 additions & 9 deletions lib/fluent/plugin/out_splunk_hec.rb
Original file line number Diff line number Diff line change
@@ -1,14 +1,17 @@
require 'fluent/output'
require 'fluent/plugin/output'
require 'httpclient'
require 'json'
require 'yajl'
require 'securerandom'

# http://dev.splunk.com/view/event-collector/SP-CAAAE6P

module Fluent
class SplunkHECOutput < ObjectBufferedOutput
module Fluent::Plugin
class SplunkHECOutput < Output
Fluent::Plugin.register_output('splunk_hec', self)

helpers :compat_parameters

config_param :host, :string
config_param :port, :integer
config_param :token, :string
Expand Down Expand Up @@ -52,6 +55,8 @@ class SplunkHECOutput < ObjectBufferedOutput
config_param :client_key_pass, :string, default: nil

def configure(conf)
compat_parameters_convert(conf, :buffer)

super

if @channel && @auto_generate_channel
Expand All @@ -60,10 +65,10 @@ def configure(conf)

@channel = SecureRandom.uuid if @auto_generate_channel

raise ConfigError, "'channel' parameter is required when 'use_ack' is true" if @use_ack && !@channel
raise ConfigError, "'ack_interval' parameter must be a non negative integer" if @use_ack && @ack_interval < 0
raise ConfigError, "'event_key' parameter is required when 'raw' is true" if @raw && !@event_key
raise ConfigError, "'channel' parameter is required when 'raw' is true" if @raw && !@channel
raise Fluent::ConfigError, "'channel' parameter is required when 'use_ack' is true" if @use_ack && !@channel
raise Fluent::ConfigError, "'ack_interval' parameter must be a non negative integer" if @use_ack && @ack_interval < 0
raise Fluent::ConfigError, "'event_key' parameter is required when 'raw' is true" if @raw && !@event_key
raise Fluent::ConfigError, "'channel' parameter is required when 'raw' is true" if @raw && !@channel

@default_sourcetype = @sourcetype if @sourcetype && !@default_sourcetype

Expand All @@ -90,7 +95,7 @@ def shutdown
super
end

def write_objects(_tag, chunk)
def write(chunk)
return if chunk.empty?

payload = ''
Expand Down Expand Up @@ -119,7 +124,7 @@ def setup_client
def format_event(time, record)
msg = {'event' => record}
if @use_fluentd_time
msg['time'] = time.respond_to?('to_f') ? time.to_f : time
msg['time'] = time.to_f
end

# metadata
Expand Down
20 changes: 12 additions & 8 deletions lib/fluent/plugin/out_splunk_tcp.rb
Original file line number Diff line number Diff line change
@@ -1,16 +1,18 @@
require 'fluent/output'
require 'fluent/formatter'
require 'fluent/plugin/output'
require 'fluent/time'
require 'fluent/config/error'
require 'socket'
require 'openssl'
require 'json'

# http://dev.splunk.com/view/event-collector/SP-CAAAE6P

module Fluent
class SplunkTCPOutput < ObjectBufferedOutput
module Fluent::Plugin
class SplunkTCPOutput < Output
Fluent::Plugin.register_output('splunk_tcp', self)

helpers :compat_parameters

config_param :host, :string
config_param :port, :integer

Expand Down Expand Up @@ -43,11 +45,13 @@ def implement?(feature)
end

def configure(conf)
compat_parameters_convert(conf, :buffer)

super

case @time_format
when 'unixtime'
@time_formatter = lambda {|time| time }
@time_formatter = lambda {|time| time.to_i }
else
@timef = Fluent::TimeFormatter.new(@time_format, @localtime)
@time_formatter = lambda {|time| @timef.format(time) }
Expand All @@ -68,11 +72,11 @@ def configure(conf)
end
when 'raw'
unless @event_key
raise ConfigError, "'event_key' option is required for format 'raw'"
raise Fluent::ConfigError, "'event_key' option is required for format 'raw'"
end
@formatter = lambda {|_time, record| record[@event_key] || '' }
else
raise ConfigError, "invalid 'format' option: #{@format}"
raise Fluent::ConfigError, "invalid 'format' option: #{@format}"
end
end

Expand All @@ -88,7 +92,7 @@ def shutdown
super
end

def write_objects(_tag, chunk)
def write(chunk)
return if chunk.empty?

payload = ''
Expand Down