Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion lib/fluent/plugin/out_splunk_hec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -279,7 +279,9 @@ def format_metric(tag, time, record)
end

def construct_api
URI("#{@protocol}://#{@hec_host}:#{@hec_port}/services/collector")
host = @hec_host.delete_prefix("/").delete_suffix("/").split("/", 2)
host_suffix = host[1].nil? ? "" : "/#{host[1]}"
URI("https://#{host[0]}:#{@hec_port}#{host_suffix}/services/collector")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it can only support one path, right? can it be updated so that it can support any number of it?
like https://mydomain.com/splunk/hec

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe a better approach would be adding another parameter. full_url.
use full_url if provided. if not build one using host, port, and protocol .
@chaitanyaphalak any thoughts?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it can only support one path, right? can it be updated so that it can support any number of it? like https://mydomain.com/splunk/hec

It will support any number of path as I am splitting host in 2 half only.
For mydomain.com/splunk/hec, it will split into mydomain.com and splunk/hec and will be join them with port value

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like rock's idea

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@harshit-splunk i see. so it works.
hmm still, this way of parsing is not intuitive for the user.
instead of full_url we can add url_path parameter.
default would be "" but user can set it to /splunk/hec or anything.

However, having a full_url parameter is something that will benefit usability in the future. we can use it in the helm chart to reduce number of arguments that they need to pass.
this way, we are consistent with olly chart. (ie splunkPlatform.endpoint)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@harshit-splunk
So I would like to suggest to edit this PR with full_url approach.

rescue StandardError
raise Fluent::ConfigError, "hec_host (#{@hec_host}) and/or hec_port (#{@hec_port}) are invalid."
end
Expand Down