hec

README

Splunk HEC Golang Library

Golang library for Splunk HTTP Event Collector (HEC).

Build

You need install glide before build.

Install all dependencies

glide install

Build the example

go build -o build/example ./example/main.go

Features

• Support HEC JSON mode and Raw mode
• Send batch of events
• Customize retrying times
• Cut big batch into chunk less than MaxContentLength
• Streaming data via HEC Raw
• Indexer acknowledgement

Example

client := hec.NewCluster(
	[]string{"https://127.0.0.1:8088", "https://localhost:8088"},
	"00000000-0000-0000-0000-000000000000",
)
client.SetHTTPClient(&http.Client{Transport: &http.Transport{
	TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
}})

event1 := hec.NewEvent("event one")
event1.SetTime(time.Now())
event2 := hec.NewEvent("event two")
event2.SetTime(time.Now().Add(-time.Minute))

err := client.WriteBatch([]*hec.Event{event1, event2})
if err != nil {
	log.Fatal(err)
}

See hec.go for more usages.

Documentation

Index

• Constants
• Variables
• func String(str string) *string
• type Client
  • func (hec *Client) SetChannel(channel string)
  • func (hec *Client) SetHTTPClient(client *http.Client)
  • func (hec *Client) SetKeepAlive(enable bool)
  • func (hec *Client) SetMaxContentLength(size int)
  • func (hec *Client) SetMaxRetry(retries int)
  • func (hec *Client) WriteBatch(events []*Event) error
  • func (hec *Client) WriteEvent(event *Event) error
  • func (hec *Client) WriteRaw(reader io.ReadSeeker, metadata *EventMetadata) error
• type Cluster
  • func (c *Cluster) SetChannel(channel string)
  • func (c *Cluster) SetHTTPClient(httpClient *http.Client)
  • func (c *Cluster) SetKeepAlive(enable bool)
  • func (c *Cluster) SetMaxContentLength(size int)
  • func (c *Cluster) SetMaxRetry(retries int)
  • func (c *Cluster) WriteBatch(events []*Event) error
  • func (c *Cluster) WriteEvent(event *Event) error
  • func (c *Cluster) WriteRaw(reader io.ReadSeeker, metadata *EventMetadata) error
• type Event
  • func NewEvent(data interface{}) *Event
  • func (e *Event) SetHost(host string)
  • func (e *Event) SetIndex(index string)
  • func (e *Event) SetSource(source string)
  • func (e *Event) SetSourceType(sourcetype string)
  • func (e *Event) SetTime(time time.Time)
• type EventMetadata
• type HEC
  • func NewClient(serverURL string, token string) HEC
  • func NewCluster(serverURLs []string, token string) HEC
• type Response
  • func (res *Response) Error() string
  • func (res *Response) String() string

Constants

const (
	StatusSuccess              = 0
	StatusTokenDisabled        = 1
	StatusTokenRequired        = 2
	StatusInvalidAuthorization = 3
	StatusInvalidToken         = 4
	StatusNoData               = 5
	StatusInvalidDataFormat    = 6
	StatusIncorrectIndex       = 7
	StatusInternalServerError  = 8
	StatusServerBusy           = 9
	StatusChannelMissing       = 10
	StatusInvalidChannel       = 11
	StatusEventFieldRequired   = 12
	StatusEventFieldBlank      = 13
	StatusAckDisabled          = 14
)

Response status codes

Variables

var ErrEventTooLong = errors.New("Event length is too long")

Functions

func String

func String(str string) *string

Types

type Client

type Client struct {
	HEC
	// contains filtered or unexported fields
}

func (*Client) SetChannel

func (hec *Client) SetChannel(channel string)

func (*Client) SetHTTPClient

func (hec *Client) SetHTTPClient(client *http.Client)

func (*Client) SetKeepAlive

func (hec *Client) SetKeepAlive(enable bool)

func (*Client) SetMaxContentLength

func (hec *Client) SetMaxContentLength(size int)

func (*Client) SetMaxRetry

func (hec *Client) SetMaxRetry(retries int)

func (*Client) WriteBatch

func (hec *Client) WriteBatch(events []*Event) error

func (*Client) WriteEvent

func (hec *Client) WriteEvent(event *Event) error

func (*Client) WriteRaw

func (hec *Client) WriteRaw(reader io.ReadSeeker, metadata *EventMetadata) error

type Cluster

type Cluster struct {
	HEC
	// contains filtered or unexported fields
}

func (*Cluster) SetChannel

func (c *Cluster) SetChannel(channel string)

func (*Cluster) SetHTTPClient

func (c *Cluster) SetHTTPClient(httpClient *http.Client)

func (*Cluster) SetKeepAlive

func (c *Cluster) SetKeepAlive(enable bool)

func (*Cluster) SetMaxContentLength

func (c *Cluster) SetMaxContentLength(size int)

func (*Cluster) SetMaxRetry

func (c *Cluster) SetMaxRetry(retries int)

func (*Cluster) WriteBatch

func (c *Cluster) WriteBatch(events []*Event) error

func (*Cluster) WriteEvent

func (c *Cluster) WriteEvent(event *Event) error

func (*Cluster) WriteRaw

func (c *Cluster) WriteRaw(reader io.ReadSeeker, metadata *EventMetadata) error

type Event

type Event struct {
	Host       *string     `json:"host,omitempty"`
	Index      *string     `json:"index,omitempty"`
	Source     *string     `json:"source,omitempty"`
	SourceType *string     `json:"sourcetype,omitempty"`
	Time       *string     `json:"time,omitempty"`
	Event      interface{} `json:"event"`
}

func NewEvent

func NewEvent(data interface{}) *Event

func (*Event) SetHost

func (e *Event) SetHost(host string)

func (*Event) SetIndex

func (e *Event) SetIndex(index string)

func (*Event) SetSource

func (e *Event) SetSource(source string)

func (*Event) SetSourceType

func (e *Event) SetSourceType(sourcetype string)

func (*Event) SetTime

func (e *Event) SetTime(time time.Time)

type EventMetadata

type EventMetadata struct {
	Host       *string
	Index      *string
	Source     *string
	SourceType *string
	Time       *time.Time
}

type HEC

type HEC interface {
	SetHTTPClient(client *http.Client)
	SetKeepAlive(enable bool)
	SetChannel(channel string)
	SetMaxRetry(retries int)
	SetMaxContentLength(size int)

	// WriteEvent writes single event via HEC json mode
	WriteEvent(event *Event) error

	// WriteBatch writes multiple events via HCE batch mode
	WriteBatch(events []*Event) error

	// WriteRaw writes raw data stream via HEC raw mode
	WriteRaw(reader io.ReadSeeker, metadata *EventMetadata) error
}

func NewClient

func NewClient(serverURL string, token string) HEC

func NewCluster

func NewCluster(serverURLs []string, token string) HEC

type Response

type Response struct {
	Text string `json:"text"`
	Code int    `json:"code"`
}

Response is response message from HEC. For example, `{"text":"Success","code":0}`.

func (*Response) Error

func (res *Response) Error() string

func (*Response) String

func (res *Response) String() string