CAMEL-16577 add support to set the index time #5504
Conversation
|
I wonder if you wont want to have a header with the time that can take precedence, instead of endpoint option. Endpoint options tend to be more static. |
|
Thanks for the feedback!!! To be clear. What is the desired approach here?
My initial idea was to use `.toD("${header.splunkTime}"). So, yes the header is pretty much always required when using this feature. Thank you for the time and guidance in this! :) |
|
Option2 is what other components would do. |
|
Do you have time to work on this, we are getting close to be ready for building the next release. |
|
Thanks for the reminder @davsclaus I pushed a new commit that adds support for the header as well as some update to the documentation. I am definitely still learning the ropes of best practices so feedback is welcomed! Thanks for your time on this. |
| @@ -128,5 +131,25 @@ private void buildPayload(Map<String, Object> payload) { | |||
| if (endpoint.getConfiguration().getHost() != null) { | |||
| payload.put("host", endpoint.getConfiguration().getHost()); | |||
| } | |||
|
|
|||
| Object timeInput = message.getHeader(SplunkHECComponent.INDEX_TIME, endpoint.getConfiguration().getTime()); | |||
There was a problem hiding this comment.
You should use Camel's type converter, and use getHeader where you can specify the returned time as Long so Camel deal with type conversions. Then all the code below can be removed
Add new option in the splunk-hec component in order to set the time the event occurred rather than defaulting the time to the index time.