openshift / openshift/cluster-logging-operator

set sourcetype without setting payloadkey

Open
#3,372 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
118
Forks
176
Avg merge
2d 15h
Merged PRs (30d)
32

Description

Hi,

In this commit it was added that sourceType requires payloadkey to be set for Splunk Outputs.
Is there a reason for this specific requirement? Or could we allow to set the sourceType without specifying the payloadkey or defining a reserved keyword (e.g. .) to take the whole payload?

Background:
We have a sourcetype configured in Splunk that is basically _json but allows for much longer lines than the default 10k characters to accommodate the logs of some workload that sometimes generates longer messages.
We still want to include all metadata the ClusterLogForwarder adds (like kubernetes, openshift etc) so reducing the payload to .message is also not an option. Since we don't want to allow longer lines for everything we ended up on the custom sourcetype.

Internal guidelines to contribute to external projects are cumbersome, so starting this issue to get your opinion first.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the linked commit that introduced the payloadkey requirement and review the issue discussion about Splunk sourceType handling. Determine the agreed behavior for sourceType without payloadkey while retaining the full payload and ClusterLogForwarder metadata; done means that behavior is implemented and verified by the project's relevant checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
observability-sre
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.