openshift / openshift/cluster-logging-operator
set sourcetype without setting payloadkey
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 118
- Forks
- 176
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 32
Description
Hi,
In this commit it was added that sourceType requires payloadkey to be set for Splunk Outputs.
Is there a reason for this specific requirement? Or could we allow to set the sourceType without specifying the payloadkey or defining a reserved keyword (e.g. .) to take the whole payload?
Background:
We have a sourcetype configured in Splunk that is basically _json but allows for much longer lines than the default 10k characters to accommodate the logs of some workload that sometimes generates longer messages.
We still want to include all metadata the ClusterLogForwarder adds (like kubernetes, openshift etc) so reducing the payload to .message is also not an option. Since we don't want to allow longer lines for everything we ended up on the custom sourcetype.
Internal guidelines to contribute to external projects are cumbersome, so starting this issue to get your opinion first.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked commit that introduced the payloadkey requirement and review the issue discussion about Splunk sourceType handling. Determine the agreed behavior for sourceType without payloadkey while retaining the full payload and ClusterLogForwarder metadata; done means that behavior is implemented and verified by the project's relevant checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- observability-sre
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100