Skip to content

output splunk plugin: add possibility to set source with record key #10109

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

rfloyrac
Copy link

@rfloyrac rfloyrac commented Mar 20, 2025

Similarly to event_sourcetype_key, add the possibility to set the splunk source from a specific key of the record.
The key is set via the config property event_source_key and takes precedence if both event_source and event_source_key are set.

The code is a pure adaptation of what was done for the event_sourcetype_key ==> aaecf64

Documentation: PR to fluent-bit-docs PR 1591

Testing
fluent-bit.config.conf: |-

[SERVICE]
  Flush        1
  Daemon       Off
  Log_Level    info

@INCLUDE fluent-bit.test-log.conf

fluent-bit.test-log.conf: |-

[INPUT]
  Name        tail
  DB           /logs/.fluentbit.test-log.db
  DB.locking   true
  Refresh_Interval 5
  read_from_head   true
  Path_Key filepath
  Static_Batch_Size 1M
  Path        /logs/test.log
  tag         test
  Threaded    true

[OUTPUT]
  Name        splunk
  Match       test
  Host        splunk-indexer.splunk
  Splunk_Token ${SPLUNK_TOKEN}
  event_index ${SPLUNK_INDEX}
  event_source source_from_output
  event_host My_pod
  event_sourcetype fluentbit
  event_key $log
  TLS         on
  TLS.Verify  off
  workers     2

[OUTPUT]
  Name        splunk
  Match       test
  Host        splunk-indexer.splunk
  Splunk_Token ${SPLUNK_TOKEN}
  event_index ${SPLUNK_INDEX}
  event_source source_from_event_source
  event_source_key $source_from_record_key
  event_host My_pod_1
  event_sourcetype fluentbit
  event_key $log
  TLS         on
  TLS.Verify  off
  workers     2

[OUTPUT]
  Name        splunk
  Match       test
  Host        splunk-indexer.splunk
  Splunk_Token ${SPLUNK_TOKEN}
  event_index ${SPLUNK_INDEX}
  event_source_key $source_from_record_key_2
  event_host My_pod_2
  event_sourcetype fluentbit
  event_key $log
  TLS         on
  TLS.Verify  off
  workers     2

[FILTER]
  Name record_modifier
  Match *
  Record source_from_record_key source_from_record_key
  Record source_from_record_key_2 source_from_record_key_2

image

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

…imilarly to sourcetype

Signed-off-by: Romain FLOYRAC <romain.floyrac@amadeus.com>
@rfloyrac
Copy link
Author

filter_rewrite_tag.c:354: Check heavy_loop > got... failed
expect: 100000 got: 100000

hmm not sure what to say :D

# for free to join this conversation on GitHub. Already have an account? # to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants