Skip to content

Commit c251109

Browse files
patriklindstrommerbla
patriklindstrom
authored and
merbla
committed
Feature Custom Fields for Event Collector (#59)
* started with feature Extra splunk fields * Added CustomFieldsClass * Rename class to CustomField * Added new CustomFields constructor and started on tests * setting up Arrange part of CustomFields_for_Splunk_Sink test * Added new test project with NUnit Test for CustomField in style of Arrange Act Assert * Adding splunkjsonformatter new constructor * Test_CustomFields_Jsonformatter_for_Splunk_Sink AA part done * Test_CustomFields_Jsonformatter_for_Splunk_Sink starts to work * new constructor for SplunkJsonFormatter with customfields Test_CustomFields_Jsonformatter_for_Splunk_Sink test works for new constructor * Added Fact for CustomFieldTest * Renam CustomField in Sample * Added Comments for params and Classes * Changes for pullreques * Small sloppmistake fixes * Moved CustomFieldTest from NUnit to Xunit * Removed NUnit test project
1 parent 4be2ce4 commit c251109

File tree

9 files changed

+446
-25
lines changed

9 files changed

+446
-25
lines changed

‎sample/Sample/Program.cs

Lines changed: 55 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,16 @@
1-
using System.Linq;
1+
using System.Collections.Generic;
2+
using System.Linq;
23
using Serilog;
34
using Serilog.Sinks.Splunk;
45

56
namespace Sample
67
{
78
public class Program
89
{
9-
public static string EventCollectorToken = "2B94855F-1184-46F7-BFF1-56A3112F627E";
10+
const string SPLUNK_FULL_ENDPOINT = "http://localhost:8088/services/collector"; // Full splunk url
11+
const string SPLUNK_ENDPOINT = "http://localhost:8088"; // Your splunk url
12+
const string SPLUNK_HEC_TOKEN = "1AFAC088-BFC6-447F-A358-671FA7465342"; // Your HEC token. See http://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector
13+
public static string EventCollectorToken = SPLUNK_HEC_TOKEN;
1014

1115
public static void Main(string[] args)
1216
{
@@ -30,7 +34,10 @@ public static void Main(string[] args)
3034
WithNoTemplate(eventsToCreate);
3135
WithCompactSplunkFormatter(eventsToCreate);
3236
if (runSSL)
37+
{
3338
UsingSSL(eventsToCreate);
39+
}
40+
AddCustomFields(eventsToCreate);
3441

3542
Log.Debug("Done");
3643
}
@@ -42,10 +49,11 @@ private static void WithCompactSplunkFormatter(int eventsToCreate)
4249
.MinimumLevel.Debug()
4350
.WriteTo.LiterateConsole()
4451
.WriteTo.EventCollector(
45-
"http://localhost:8088/services/collector",
46-
Program.EventCollectorToken,new CompactSplunkJsonFormatter())
52+
SPLUNK_FULL_ENDPOINT,
53+
Program.EventCollectorToken, new CompactSplunkJsonFormatter())
4754
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
48-
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "Vanilla with CompactSplunkJsonFormatter specified")
55+
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType",
56+
"Vanilla with CompactSplunkJsonFormatter specified")
4957
.CreateLogger();
5058

5159

@@ -64,7 +72,7 @@ public static void OverridingSource(int eventsToCreate)
6472
.MinimumLevel.Debug()
6573
.WriteTo.LiterateConsole()
6674
.WriteTo.EventCollector(
67-
"http://localhost:8088",
75+
SPLUNK_ENDPOINT,
6876
Program.EventCollectorToken,
6977
source: "Serilog.Sinks.Splunk.Sample.TestSource")
7078
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
@@ -77,7 +85,6 @@ public static void OverridingSource(int eventsToCreate)
7785
}
7886

7987
Log.CloseAndFlush();
80-
8188
}
8289

8390
public static void OverridingSourceType(int eventsToCreate)
@@ -87,9 +94,9 @@ public static void OverridingSourceType(int eventsToCreate)
8794
.MinimumLevel.Debug()
8895
.WriteTo.LiterateConsole()
8996
.WriteTo.EventCollector(
90-
"http://localhost:8088",
97+
SPLUNK_ENDPOINT,
9198
Program.EventCollectorToken,
92-
sourceType: "Serilog.Sinks.Splunk.Sample.TestSourceType")
99+
sourceType: "_json")
93100
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
94101
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "Source Type Override")
95102
.CreateLogger();
@@ -100,7 +107,6 @@ public static void OverridingSourceType(int eventsToCreate)
100107
}
101108

102109
Log.CloseAndFlush();
103-
104110
}
105111

106112
public static void OverridingHost(int eventsToCreate)
@@ -110,7 +116,7 @@ public static void OverridingHost(int eventsToCreate)
110116
.MinimumLevel.Debug()
111117
.WriteTo.LiterateConsole()
112118
.WriteTo.EventCollector(
113-
"http://localhost:8088",
119+
SPLUNK_ENDPOINT,
114120
Program.EventCollectorToken,
115121
host: "myamazingmachine")
116122
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
@@ -123,7 +129,6 @@ public static void OverridingHost(int eventsToCreate)
123129
}
124130

125131
Log.CloseAndFlush();
126-
127132
}
128133

129134
public static void UsingFullUri(int eventsToCreate)
@@ -133,7 +138,7 @@ public static void UsingFullUri(int eventsToCreate)
133138
.MinimumLevel.Debug()
134139
.WriteTo.LiterateConsole()
135140
.WriteTo.EventCollector(
136-
"http://localhost:8088/services/collector",
141+
SPLUNK_FULL_ENDPOINT,
137142
Program.EventCollectorToken)
138143
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
139144
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "Vanilla with full uri specified")
@@ -155,7 +160,7 @@ public static void UsingHostOnly(int eventsToCreate)
155160
.MinimumLevel.Debug()
156161
.WriteTo.LiterateConsole()
157162
.WriteTo.EventCollector(
158-
"http://localhost:8088",
163+
SPLUNK_ENDPOINT,
159164
Program.EventCollectorToken)
160165
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
161166
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "Vanilla No services/collector in uri")
@@ -176,7 +181,7 @@ public static void WithNoTemplate(int eventsToCreate)
176181
.MinimumLevel.Debug()
177182
.WriteTo.LiterateConsole()
178183
.WriteTo.EventCollector(
179-
"http://localhost:8088",
184+
SPLUNK_ENDPOINT,
180185
Program.EventCollectorToken,
181186
renderTemplate: false)
182187
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
@@ -198,7 +203,7 @@ public static void UsingSSL(int eventsToCreate)
198203
.MinimumLevel.Debug()
199204
.WriteTo.LiterateConsole()
200205
.WriteTo.EventCollector(
201-
"https://localhost:8088",
206+
SPLUNK_ENDPOINT,
202207
Program.EventCollectorToken)
203208
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
204209
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "HTTPS")
@@ -210,5 +215,39 @@ public static void UsingSSL(int eventsToCreate)
210215
}
211216
Log.CloseAndFlush();
212217
}
218+
219+
public static void AddCustomFields(int eventsToCreate)
220+
{
221+
var metaData = new CustomFields(new List<CustomField>
222+
{
223+
new CustomField("relChan", "Test"),
224+
new CustomField("version", "17.8.9.beta"),
225+
new CustomField("rel", "REL1706"),
226+
new CustomField("role", new List<string>() { "service", "rest", "ESB" })
227+
});
228+
// Override Source
229+
Log.Logger = new LoggerConfiguration()
230+
.MinimumLevel.Debug()
231+
.WriteTo.LiterateConsole()
232+
.WriteTo.EventCollector(
233+
splunkHost: SPLUNK_ENDPOINT
234+
, eventCollectorToken: SPLUNK_HEC_TOKEN
235+
, host: System.Environment.MachineName
236+
, source: "BackPackTestServerChannel"
237+
, sourceType: "_json"
238+
,fields: metaData)
239+
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
240+
.Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "AddCustomFields")
241+
.CreateLogger();
242+
243+
foreach (var i in Enumerable.Range(0, eventsToCreate))
244+
{
245+
Log.Information("AddCustomFields {Counter}", i);
246+
}
247+
248+
Log.CloseAndFlush();
249+
}
213250
}
251+
252+
214253
}

‎serilog-sinks-splunk.sln

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
Microsoft Visual Studio Solution File, Format Version 12.00
33
# Visual Studio 15
4-
VisualStudioVersion = 15.0.26430.6
4+
VisualStudioVersion = 15.0.26430.12
55
MinimumVisualStudioVersion = 10.0.40219.1
66
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{7A774CBB-A6E9-4854-B4DB-4CF860B0C1C5}"
77
EndProject

‎src/Serilog.Sinks.Splunk/Sinks/Splunk/CustomField.cs

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
using System;
2+
using System.Collections.Generic;
3+
using System.Linq;
4+
using System.Text;
5+
using System.Threading.Tasks;
6+
7+
namespace Serilog.Sinks.Splunk
8+
{ /// <summary>
9+
/// A Class for storing CustomField. They are sort of key,value pair. In simpler form key as string and value as single string, but could also be key and list of strings.
10+
/// </summary>
11+
public class CustomField
12+
{ /// <summary>
13+
/// the fieldsname eg: role, version,
14+
/// </summary>
15+
public string Name { get; set; }
16+
/// <summary>
17+
/// All values even simple string are stored as a list
18+
/// </summary>
19+
public List<string> ValueList { get; set; }
20+
/// <summary>
21+
/// constructor for a simple fieldname and a value both are strings
22+
/// </summary>
23+
/// <param name="name">Name of filed to be indexed by Splunk. Eg Role,Version,Channel</param>
24+
/// <param name="value">Value of keypair. Eg. Test,1.08, RestService</param>
25+
public CustomField(string name, string value)
26+
{
27+
Name = name;
28+
ValueList = new List<string> { value };
29+
}
30+
/// <summary>
31+
/// Constructor for Name and array of values
32+
/// </summary>
33+
/// <param name="name">Name of field eg TypeOfResource</param>
34+
/// <param name="value">Array of values that should be connected with field.Eg Backend,Service,Rest</param>
35+
public CustomField(string name, List<string> value)
36+
{
37+
Name = name;
38+
ValueList = value;
39+
}
40+
}
41+
}

‎src/Serilog.Sinks.Splunk/Sinks/Splunk/CustomFields.cs

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
using System;
2+
using System.Collections.Generic;
3+
using System.Linq;
4+
using System.Text;
5+
using System.Threading.Tasks;
6+
7+
namespace Serilog.Sinks.Splunk
8+
{
9+
/// <summary>
10+
/// Class for storing CustomFields that splunk will index for the event but will not be displayed in the event.
11+
/// They are the same for all events. Could could contain type of server or releasecode see: http://dev.splunk.com/view/event-collector/SP-CAAAFB6
12+
/// </summary>
13+
public class CustomFields
14+
{/// <summary>
15+
/// The List of all CustomFields of type CustomField
16+
/// </summary>
17+
public List<CustomField> CustomFieldList { get; set; }
18+
/// <summary>
19+
/// Constructor with no inital data
20+
/// </summary>
21+
public CustomFields()
22+
{
23+
CustomFieldList = new List<CustomField>();
24+
}
25+
/// <summary>
26+
/// Constructor with simple CustomField
27+
/// </summary>
28+
/// <param name="customField"></param>
29+
public CustomFields(CustomField customField)
30+
{
31+
CustomFieldList = new List<CustomField>{customField};
32+
}
33+
/// <summary>
34+
/// Constructor with a list of CustomFields
35+
/// </summary>
36+
public CustomFields(List<CustomField> customFields)
37+
{
38+
CustomFieldList = customFields ;
39+
}
40+
}
41+
}

‎src/Serilog.Sinks.Splunk/Sinks/Splunk/EventCollectorSink.cs

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,47 @@ public EventCollectorSink(
115115
messageHandler)
116116
{
117117
}
118+
/// <summary>
119+
/// Creates a new instance of the sink with Customfields
120+
/// </summary>
121+
/// <param name="splunkHost">The host of the Splunk instance with the Event collector configured</param>
122+
/// <param name="eventCollectorToken">The token to use when authenticating with the event collector</param>
123+
/// <param name="uriPath">Change the default endpoint of the Event Collector e.g. services/collector/event</param>
124+
/// <param name="batchSizeLimit">The size of the batch when sending to the event collector</param>
125+
/// <param name="formatProvider">The format provider used when rendering the message</param>
126+
/// <param name="renderTemplate">Whether to render the message template</param>
127+
/// <param name="batchIntervalInSeconds">The interval in seconds that batching should occur</param>
128+
/// <param name="index">The Splunk index to log to</param>
129+
/// <param name="fields">Add extra CustomExtraFields for Splunk to index</param>
130+
/// <param name="source">The source of the event</param>
131+
/// <param name="sourceType">The source type of the event</param>
132+
/// <param name="host">The host of the event</param>
133+
/// <param name="messageHandler">The handler used to send HTTP requests</param>
134+
public EventCollectorSink(
135+
string splunkHost,
136+
string eventCollectorToken,
137+
string uriPath,
138+
string source,
139+
string sourceType,
140+
string host,
141+
string index,
142+
CustomFields fields,
143+
int batchIntervalInSeconds,
144+
int batchSizeLimit,
145+
IFormatProvider formatProvider = null,
146+
bool renderTemplate = true,
147+
HttpMessageHandler messageHandler = null)
148+
// TODO here is the jsonformatter creation. We must make way to test output of jsonformatter.
149+
: this(
150+
splunkHost,
151+
eventCollectorToken,
152+
uriPath,
153+
batchIntervalInSeconds,
154+
batchSizeLimit,
155+
new SplunkJsonFormatter(renderTemplate, formatProvider, source, sourceType, host, index,fields),
156+
messageHandler)
157+
{
158+
}
118159

119160

120161
/// <summary>

0 commit comments

Comments
 (0)