-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Support generation of multiple HEC destinations dynamically (#553)
This change add the ability to create additional HEC destination to use as alternates this allows the administrator to send events from SC4S to more than one instance of Splunk Enterprise, Splunk Enterprise Cloud, or Splunk DSP
- Loading branch information
Ryan Faircloth
authored and
GitHub
committed
Jul 8, 2020
1 parent
22405a5
commit 50f01ea
Showing
5 changed files
with
115 additions
and
67 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,55 +1,9 @@ | ||
| destination d_hec { | ||
| http( | ||
| url("{{- getenv "SPLUNK_HEC_URL" | strings.ReplaceAll "/services/collector" "" | strings.ReplaceAll "/event" "" | regexp.ReplaceLiteral "[, ]+" "/services/collector/event " }}/services/collector/event") | ||
| method("POST") | ||
| log-fifo-size({{- getenv "SC4S_DEST_SPLUNK_HEC_LOG_FIFO_SIZE" "180000000"}}) | ||
| workers({{- getenv "SC4S_DEST_SPLUNK_HEC_WORKERS" "10"}}) | ||
| batch-lines({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_LINES" "1000"}}) | ||
| batch-bytes({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_BYTES" "4096kb"}}) | ||
| batch-timeout({{- getenv "SC4S_DEST_SPLUNK_HEC_BATCH_TIMEOUT" "3000"}}) | ||
| timeout({{- getenv "SC4S_DEST_SPLUNK_HEC_TIMEOUT" "30"}}) | ||
| user_agent("sc4s/1.0 (events)") | ||
| user("sc4s") | ||
| headers("{{- getenv "SC4S_DEST_SPLUNK_DEST_SPLUNK_HEC_HEADERS" "Connection: close"}}") | ||
| password("{{- getenv "SPLUNK_HEC_TOKEN"}}") | ||
| persist-name("splunk_hec") | ||
| response-action(400 => drop, 404 => retry) | ||
| {{- $context := dict "var_id" "" -}} | ||
| {{- tmpl.Exec "t/splunk_hec.t" $context -}} | ||
|
|
||
| {{- if eq (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_ENABLE" "yes") "yes"}} | ||
|
|
||
| disk-buffer( | ||
|
|
||
| {{- if eq (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_RELIABLE" "no") "yes"}} | ||
| mem-buf-size({{conv.ToInt64 (math.Round ( math.Div (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_MEMBUFSIZE" "10241024") (getenv "SC4S_DEST_SPLUNK_HEC_WORKERS" "10")))}}) | ||
| reliable(yes) | ||
| {{- else}} | ||
| mem-buf-length({{conv.ToInt64 (math.Round ( math.Div (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_MEMBUFLENGTH" "15000") (getenv "SC4S_DEST_SPLUNK_HEC_WORKERS" "10")))}}) | ||
| reliable(no) | ||
| {{- end}} | ||
| {{- if ne (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_DIR") ""}} | ||
| dir("{{- getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_DIR"}}") | ||
| {{- end}} | ||
| disk-buf-size({{conv.ToInt64 (math.Round ( math.Div (getenv "SC4S_DEST_SPLUNK_HEC_DISKBUFF_DISKBUFSIZE" "53687091200") (getenv "SC4S_DEST_SPLUNK_HEC_WORKERS" "10")))}}) | ||
| ) | ||
| {{- end}} | ||
| tls(peer-verify({{- getenv "SC4S_DEST_SPLUNK_HEC_TLS_VERIFY" "yes"}}) | ||
| {{- if ne (getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE") ""}} | ||
| cipher-suite("{{- getenv "SC4S_DEST_SPLUNK_HEC_CIPHER_SUITE"}}") | ||
| {{- end}} | ||
| {{- if ne (getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION") ""}} | ||
| ssl-version("{{- getenv "SC4S_DEST_SPLUNK_HEC_SSL_VERSION"}}") | ||
| {{- end}} | ||
| ca-file("{{- getenv "SC4S_DEST_SPLUNK_HEC_TLS_CA_FILE" "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"}}")) | ||
| body('$(format-json | ||
| time=$S_UNIXTIME | ||
| host=${HOST} | ||
| source=${.splunk.source} | ||
| sourcetype=${.splunk.sourcetype} | ||
| index=${.splunk.index} | ||
| event="$MSG" | ||
| {{- if ne (getenv "SC4S_DEST_SPLUNK_INDEXED_FIELDS") "none" }} | ||
| fields.* | ||
| {{- end }} | ||
| )') | ||
| ); | ||
| }; | ||
| {{- if ne (getenv "SPLUNK_HEC_ALT_DESTS") "" }} | ||
| {{- range split (getenv "SPLUNK_HEC_ALT_DESTS" "") "," }} | ||
| {{- $context := dict "var_id" (print "_" .) -}} | ||
| {{- tmpl.Exec "t/splunk_hec.t" $context -}} | ||
| {{- end}} | ||
| {{- end}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| {{ define "SPLUNK_HEC" }} | ||
| destination d_hec{{ .var_id }} { | ||
| {{- $url := (getenv (print "SPLUNK_HEC" .var_id "_URL")) }} | ||
| http( | ||
| url("{{- $url | strings.ReplaceAll "/services/collector" "" | strings.ReplaceAll "/event" "" | regexp.ReplaceLiteral "[, ]+" "/services/collector/event " }}/services/collector/event") | ||
| method("POST") | ||
| log-fifo-size({{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_LOG_FIFO_SIZE") "180000000"}}) | ||
| workers({{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_WORKERS") "10"}}) | ||
| batch-lines({{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_BATCH_LINES") "1000"}}) | ||
| batch-bytes({{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_BATCH_BYTES") "4096kb"}}) | ||
| batch-timeout({{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_BATCH_TIMEOUT") "3000"}}) | ||
| timeout({{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_TIMEOUT") "30"}}) | ||
| user_agent("sc4s/1.0 (events)") | ||
| user("sc4s") | ||
| headers("{{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_HEADERS") "Connection: close"}}") | ||
| password("{{- getenv (print "SPLUNK_HEC" .var_id "_TOKEN")}}") | ||
| persist-name("splunk_hec") | ||
| response-action(400 => drop, 404 => retry) | ||
|
|
||
| {{- if eq (getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_DISKBUFF_ENABLE") "yes") "yes"}} | ||
|
|
||
| disk-buffer( | ||
|
|
||
| {{- if eq (getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_DISKBUFF_RELIABLE") "no") "yes"}} | ||
| mem-buf-size({{conv.ToInt64 (math.Round ( math.Div (getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_DISKBUFF_MEMBUFSIZE") "10241024") (getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_WORKERS") "10")))}}) | ||
| reliable(yes) | ||
| {{- else}} | ||
| mem-buf-length({{conv.ToInt64 (math.Round ( math.Div (getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_DISKBUFF_MEMBUFLENGTH") "15000") (getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_WORKERS") "10")))}}) | ||
| reliable(no) | ||
| {{- end}} | ||
| {{- if ne (getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_DISKBUFF_DIR")) ""}} | ||
| dir("{{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_DISKBUFF_DIR")}}") | ||
| {{- end}} | ||
| disk-buf-size({{conv.ToInt64 (math.Round ( math.Div (getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_DISKBUFF_DISKBUFSIZE") "53687091200") (getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_WORKERS") "10")))}}) | ||
| ) | ||
| {{- end}} | ||
| tls(peer-verify({{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_TLS_VERIFY") "yes"}}) | ||
| {{- if ne (getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_CIPHER_SUITE")) ""}} | ||
| cipher-suite("{{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_CIPHER_SUITE")}}") | ||
| {{- end}} | ||
| {{- if ne (getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_SSL_VERSION")) ""}} | ||
| ssl-version("{{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_SSL_VERSION")}}") | ||
| {{- end}} | ||
| ca-file("{{- getenv (print "SC4S_DEST_SPLUNK_HEC" .var_id "_TLS_CA_FILE") "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"}}")) | ||
| body('$(format-json | ||
| time=$S_UNIXTIME | ||
| host=${HOST} | ||
| source=${.splunk.source} | ||
| sourcetype=${.splunk.sourcetype} | ||
| index=${.splunk.index} | ||
| event="$MSG" | ||
| {{- if ne (getenv (print "SC4S_DEST_SPLUNK_INDEXED_FIELDS")) "none" }} | ||
| fields.* | ||
| {{- end }} | ||
| )') | ||
| ); | ||
| }; | ||
|
|
||
| {{- end -}} | ||
|
|
||
| {{- template "SPLUNK_HEC" (.) -}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters