Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fields column in Splunk Hec output plugin is not working . #505

Closed
saiinuganti opened this issue Jun 23, 2020 · 1 comment · Fixed by #527
Closed

fields column in Splunk Hec output plugin is not working . #505

saiinuganti opened this issue Jun 23, 2020 · 1 comment · Fixed by #527
Labels
bug Something isn't working priority-low

Comments

@saiinuganti
Copy link

saiinuganti commented Jun 23, 2020

Describe the bug:
fields column in Splunk Hec output plugin is not converting as per fluentd spec in fluentd.conf in secret file

Expected behaviour:

kind: ClusterOutput
metadata:
 name: splunk-output
spec:
 splunkHec:
    hec_host: http-inputs-
    hec_port: 443
    hec_token: 
        valueFrom:
           secretKeyRef:
              name:  splunk-token
              key: SplunkHecToken
    index: qa_main
    fields: 
      dummy: " "
    format:
      type: single_value 
      message_key: MESSAGE

expected config in fluentd.conf ( in secrets)

 <fields>
     dummy
 </fileds> 

what i get is
fields {"dummy":" "}

so logging operator cannot separate dummy from original message to an indexed field.

Steps to reproduce the bug:

kind: ClusterOutput
metadata:
 name: splunk-output
spec:
 splunkHec:
    hec_host: http-inputs-
    hec_port: 443
    hec_token: 
        valueFrom:
           secretKeyRef:
              name:  splunk-token
              key: SplunkHecToken
    index: qa_main
    fields: 
      dummy: " "
    format:
      type: single_value 
      message_key: MESSAGE

Additional context:
the main idea is to separate dummy from the original message to an indexed field in Splunk. But when using above config there is no change in the original message. but when I edited secrets to change fluentd.conf to

 <fields>
     dummy
 </fileds> 

instead of fields {"dummy":" "} then I could see the change in my Splunk output . So I doubt that Splunk output plugin in logging operator is not writing the correct format to underlying fluentd.conf
Environment details:

  • Kubernetes version (v1.15.11):
  • Cloud-provider/provisioner ( EKS):
  • logging operator version : 3.2.0-rc1
  • Install method (static manifests):
  • Resource definition (possibly in YAML format) that caused the issue, without sensitive data:
apiVersion: logging.banzaicloud.io/v1beta1
kind: ClusterOutput
metadata:
 name: splunk-output
spec:
 splunkHec:
    hec_host: http-splunkcloud.com
    hec_port: 443
    hec_token:
        valueFrom:
           secretKeyRef:
              name:  splunk-token
              key: SplunkHecToken
    index: qa_main
    fields:
       dummy: " "
    format:
      type: single_value
      message_key: MESSAGE
      add_newline: true

/kind bug

@saiinuganti saiinuganti added the bug Something isn't working label Jun 23, 2020
@2020testuser
Copy link

@ahma and @saiinuganti - Is this issue resolved? I'm facing a similar issue except I don't have any filtering enabled.
I'm unable to see any of my container logs when I perform my index search in Splunk dashboard.
However, I see the below error message. Am I missing any info. Could you please shed some light on this issue?

Thanks in advance.

Error Msg:
failed to create model: failed to create configured output splunk-flow-output: no plugin config available for output

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working priority-low
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants