Skip to content

Add hec format #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 12 commits into
base: develop
Choose a base branch
from
Open

Conversation

stephenwood4-nhs
Copy link

Proposed changes

Introduce a new splunk-format named "hec" which fixes issue #48

This allows containers to output logs in the JSON format as expected by the Splunk HEC endpoint (https://docs.splunk.com/Documentation/Splunk/9.0.0/Data/FormateventsforHTTPEventCollector) and the logging driver will parse these correctly. Applications running in containers will be able to control which index, source, sourcetype etc. log events should be set to within Splunk.

Also replaces the CircleCI integration for testing with Github Actions. Unfortunately this has not fixed issue #45 and functional tests still intermittently fail. A fully successful run has been completed with the current changes.

Minor changes; uplift Go version to 1.19.0 and switch to go modules instead of dep (which has been deprecated since 2020). Uplift Python version used for functional tests to 3.8 (needed due to updated Python dependencies), this also required a rebuild of the python protobuf file.

Types of changes

What types of changes does your code introduce?
Put an x in the boxes that apply

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

Put an x in the boxes that apply.

  • I have read the CONTRIBUTING doc
  • I have read the CLA
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)
  • Any dependent changes have been merged and published in downstream modules

labelsKey: "a",
envRegexKey: "^foo",
},
ContainerID: "containeriid",

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this a typo? Should it be containerid?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It does look like a typo but it is copied from elsewhere in this file (see lines 348 & 452). It actually doesn't matter if it is a typo in this context as it is just test data that isn't used for anything meaningful

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants