fields column in Splunk Hec output plugin is not working . kube-loggi…

…ng#505 (kube-logging#527)

docs/plugins/outputs/splunk_hec.md

@@ -51,6 +51,6 @@ More info at https://github.com/splunk/fluent-plugin-splunk-hec
 | ca_path | string | No | - | The path to a directory containing CA certificates in PEM format.<br> |
 | ssl_ciphers | string | No | - | List of SSL ciphers allowed.<br> |
 | insecure_ssl | *bool | No | false | Indicates if insecure SSL connection is allowed <br> |
-| fields | map[string]string | No | - | In this case, parameters inside <fields> are used as indexed fields and removed from the original input events<br> |
+| fields | Fields | No | - | In this case, parameters inside <fields> are used as indexed fields and removed from the original input events<br> |
 | format | *Format | No | - | [Format](../format/)<br> |
 | buffer | *Buffer | No | - | [Buffer](../buffer/)<br> |

pkg/sdk/model/output/splunk_hec.go

@@ -107,13 +107,26 @@ type SplunkHecOutput struct {
 	// Indicates if insecure SSL connection is allowed (default:false)
 	InsecureSSL *bool `json:"insecure_ssl,omitempty"`
 	// In this case, parameters inside <fields> are used as indexed fields and removed from the original input events
-	Fields map[string]string `json:"fields,omitempty"`
+	Fields Fields `json:"fields,omitempty"`
 	// +docLink:"Format,../format/"
 	Format *Format `json:"format,omitempty"`
 	// +docLink:"Buffer,../buffer/"
 	Buffer *Buffer `json:"buffer,omitempty"`
 }
 
+type Fields map[string]string
+
+func (r Fields) ToDirective(secretLoader secret.SecretLoader, id string) (types.Directive, error) {
+	recordSet := types.PluginMeta{
+		Directive: "fields",
+	}
+	directive := &types.GenericDirective{
+		PluginMeta: recordSet,
+		Params:     r,
+	}
+	return directive, nil
+}
+
 func (c *SplunkHecOutput) ToDirective(secretLoader secret.SecretLoader, id string) (types.Directive, error) {
 	pluginType := "splunk_hec"
 	splunkHec := &types.OutputPlugin{
@@ -150,6 +163,14 @@ func (c *SplunkHecOutput) ToDirective(secretLoader secret.SecretLoader, id strin
 		}
 	}
 
+	if c.Fields != nil {
+		if meta, err := c.Fields.ToDirective(secretLoader, ""); err != nil {
+			return nil, err
+		} else {
+			splunkHec.SubDirectives = append(splunkHec.SubDirectives, meta)
+		}
+	}
+
 	return splunkHec, nil
 }
 

pkg/sdk/model/output/splunk_hec_test.go

@@ -28,6 +28,8 @@ hec_host: splunk.default.svc.cluster.local
 hec_port: 8088
 insecure_ssl: true
 index: foo
+fields:
+  dummy: " "
 host: foo
 protocol: http
 metrics_from_event: true
@@ -55,6 +57,9 @@ source: foo
 		protocol http
 		source foo
 		sourcetype foo
+		<fields>
+		  dummy  
+		</fields>
 	</match>
 `
 	es := &output.SplunkHecOutput{}