[exporter/splunkhec] Flatten nested attribute map (#18241)

According to the Splunk HEC doc, the fields key specifies a JSON object that contains a flat (not nested) list of explicit custom fields to be defined at index time.
The current implementations send the nested map or array as it is. It leads to Error in handling indexed fields error.
In this PR, I have added to logic to flatten the nested map and drop nested arrays.

.chloggen/splunkhecexporter_flatten_nested_fields.yaml

@@ -0,0 +1,16 @@
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: splunkhecexporter
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Flatten nested attribute map before sending it to splunk as indexed fields.
+
+# One or more tracking issues related to the change
+issues: [17308]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:

exporter/splunkhecexporter/logdata_to_splunk.go

@@ -16,8 +16,10 @@ package splunkhecexporter // import "github.com/open-telemetry/opentelemetry-col
 
 import (
 	"encoding/hex"
+	"fmt"
 	"time"
 
+	jsoniter "github.com/json-iterator/go"
 	"go.opentelemetry.io/collector/pdata/pcommon"
 	"go.opentelemetry.io/collector/pdata/plog"
 
@@ -70,7 +72,7 @@ func mapLogRecordToSplunkEvent(res pcommon.Resource, lr plog.LogRecord, config *
 		case splunk.HecTokenLabel:
 			// ignore
 		default:
-			fields[k] = v.AsRaw()
+			mergeValue(fields, k, v.AsRaw())
 		}
 		return true
 	})
@@ -87,7 +89,7 @@ func mapLogRecordToSplunkEvent(res pcommon.Resource, lr plog.LogRecord, config *
 		case splunk.HecTokenLabel:
 			// ignore
 		default:
-			fields[k] = v.AsRaw()
+			mergeValue(fields, k, v.AsRaw())
 		}
 		return true
 	})
@@ -117,3 +119,50 @@ func nanoTimestampToEpochMilliseconds(ts pcommon.Timestamp) *float64 {
 	val := duration.Round(time.Millisecond).Seconds()
 	return &val
 }
+
+func mergeValue(dst map[string]any, k string, v any) {
+	switch element := v.(type) {
+	case []any:
+		if isArrayFlat(element) {
+			dst[k] = v
+		} else {
+			jsonStr, _ := jsoniter.MarshalToString(element)
+			dst[k] = jsonStr
+		}
+	case map[string]any:
+		flattenAndMergeMap(element, dst, k)
+	default:
+		dst[k] = v
+	}
+
+}
+
+func isArrayFlat(array []any) bool {
+	for _, v := range array {
+		switch v.(type) {
+		case []any, map[string]any:
+			return false
+		}
+	}
+	return true
+}
+
+func flattenAndMergeMap(src, dst map[string]any, key string) {
+	for k, v := range src {
+		current := fmt.Sprintf("%s.%s", key, k)
+		switch element := v.(type) {
+		case map[string]any:
+			flattenAndMergeMap(element, dst, current)
+		case []any:
+			if isArrayFlat(element) {
+				dst[current] = element
+			} else {
+				jsonStr, _ := jsoniter.MarshalToString(element)
+				dst[current] = jsonStr
+			}
+
+		default:
+			dst[current] = element
+		}
+	}
+}

exporter/splunkhecexporter/logdata_to_splunk_test.go

@@ -477,3 +477,70 @@ func Test_nanoTimestampToEpochMilliseconds(t *testing.T) {
 	splunkTs = nanoTimestampToEpochMilliseconds(0)
 	assert.True(t, nil == splunkTs)
 }
+
+func Test_mergeValue(t *testing.T) {
+	tests := []struct {
+		name     string
+		key      string
+		val      any
+		expected map[string]any
+	}{
+		{
+			name:     "int",
+			key:      "intKey",
+			val:      0,
+			expected: map[string]any{"intKey": 0},
+		},
+		{
+			name:     "flat_array",
+			key:      "arrayKey",
+			val:      []any{0, 1, 2, 3},
+			expected: map[string]any{"arrayKey": []any{0, 1, 2, 3}},
+		},
+		{
+			name:     "nested_array",
+			key:      "arrayKey",
+			val:      []any{0, 1, []any{2, 3}},
+			expected: map[string]any{"arrayKey": "[0,1,[2,3]]"},
+		},
+		{
+			name:     "array_of_map",
+			key:      "arrayKey",
+			val:      []any{0, 1, map[string]any{"3": 3}},
+			expected: map[string]any{"arrayKey": "[0,1,{\"3\":3}]"},
+		},
+		{
+			name:     "flat_map",
+			key:      "mapKey",
+			val:      map[string]any{"1": 1, "2": 2},
+			expected: map[string]any{"mapKey.1": 1, "mapKey.2": 2},
+		},
+		{
+			name:     "nested_map",
+			key:      "mapKey",
+			val:      map[string]any{"1": 1, "2": 2, "nested": map[string]any{"3": 3, "4": 4}},
+			expected: map[string]any{"mapKey.1": 1, "mapKey.2": 2, "mapKey.nested.3": 3, "mapKey.nested.4": 4},
+		},
+		{
+			name:     "flat_array_in_nested_map",
+			key:      "mapKey",
+			val:      map[string]any{"1": 1, "2": 2, "nested": map[string]any{"3": 3, "flat_array": []any{4}}},
+			expected: map[string]any{"mapKey.1": 1, "mapKey.2": 2, "mapKey.nested.3": 3, "mapKey.nested.flat_array": []any{4}},
+		},
+		{
+			name:     "nested_array_in_nested_map",
+			key:      "mapKey",
+			val:      map[string]any{"1": 1, "2": 2, "nested": map[string]any{"3": 3, "nested_array": []any{4, []any{5}}}},
+			expected: map[string]any{"mapKey.1": 1, "mapKey.2": 2, "mapKey.nested.3": 3, "mapKey.nested.nested_array": "[4,[5]]"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fields := make(map[string]any)
+			mergeValue(fields, tt.key, tt.val)
+			assert.Equal(t, tt.expected, fields)
+		})
+	}
+
+}