Skip to content

Commit

Permalink
no need add mapping in output config
Browse files Browse the repository at this point in the history
  • Loading branch information
Jian Chen committed Feb 21, 2020
1 parent e154c26 commit c94da68
Showing 1 changed file with 8 additions and 5 deletions.
13 changes: 8 additions & 5 deletions lib/logstash/outputs/splunk.rb
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ class LogStash::Outputs::Splunk < LogStash::Outputs::Base
config :is_raw, :validate => :boolean, :default => true

# Splunk Channel Identifier GUID
config :channel_identifier, :validate => :string, :required => true
config :channel_identifier, :validate => :string, :required => false

# Content type
#
Expand Down Expand Up @@ -106,7 +106,9 @@ def register

# Splunk HEC token
@headers["Authorization"] = "Splunk " + @token
@headers["X-Splunk-Request-Channel"] = @channel_identifier
if @channel_identifier
@headers["X-Splunk-Request-Channel"] = @channel_identifier
end

# Run named Timer as daemon thread
@timer = java.util.Timer.new("Splunk Output #{self.params['id']}", true)
Expand Down Expand Up @@ -293,7 +295,7 @@ def event_body(event)
# TODO: Create an HTTP post data codec, use that here
if @is_batch
if @is_raw
event.map {|e| map_event(e).fetch("event") }.join("\n")
event.map {|e| map_event(e).fetch("message") }.join("\n")
else
event.map {|e| LogStash::Json.dump(map_event(e)) }.join("\n")
end
Expand Down Expand Up @@ -328,10 +330,11 @@ def convert_mapping(mapping, event)

def map_event(event)
if @mapping
convert_mapping(@mapping, event)
msg_body = convert_mapping(@mapping, event)
else
event.to_hash
msg_body = event.to_hash
end
{"event" => msg_body}
end

def event_headers(event)
Expand Down

0 comments on commit c94da68

Please sign in to comment.