fluent / fluent/fluent-plugin-splunk

Configurable metadata fields for TCP output plugin

Open
#33 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Ruby
Stars
45
Forks
16
PR merge metrics
No merged PRs in 30d

Description

This is a feature request to allow configurable default metadata fields (`host`, `source`, `sourcetype`, `index`) for the TCP output, as is currently supported by the HEC output.

I believe this should be possible by sending a header over the TCP socket as the first line of the payload, which should look like:

```
***SPLUNK*** = = ...
```

More info at: https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Assignmetadatatoeventsdynamically

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the TCP and HEC output implementations and compare how HEC handles configurable metadata. Read the linked Splunk documentation for the TCP header format. Done means TCP output accepts the requested default fields and sends them in the first payload line, with coverage for the supported metadata options.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
backend, networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.