fluent / fluent/fluent-plugin-splunk
Configurable metadata fields for TCP output plugin
- Dominant language
- Ruby
- Stars
- 45
- Forks
- 16
- PR merge metrics
- No merged PRs in 30d
Description
This is a feature request to allow configurable default metadata fields (`host`, `source`, `sourcetype`, `index`) for the TCP output, as is currently supported by the HEC output.
I believe this should be possible by sending a header over the TCP socket as the first line of the payload, which should look like:
```
***SPLUNK*** = = ...
```
More info at: https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Assignmetadatatoeventsdynamically
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the TCP and HEC output implementations and compare how HEC handles configurable metadata. Read the linked Splunk documentation for the TCP header format. Done means TCP output accepts the requested default fields and sends them in the first payload line, with coverage for the supported metadata options.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- backend, networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100