Feature.customfields

sample/Sample/Program.cs

@@ -1,12 +1,16 @@
-using System.Linq;
+using System.Collections.Generic;
+using System.Linq;
 using Serilog;
 using Serilog.Sinks.Splunk;
 
 namespace Sample
 {
     public class Program
     {
-        public static string EventCollectorToken = "2B94855F-1184-46F7-BFF1-56A3112F627E";
+        const string SPLUNK_FULL_ENDPOINT = "http://localhost:8088/services/collector"; // Full splunk url 
+        const string SPLUNK_ENDPOINT = "http://localhost:8088"; //  Your splunk url  
+        const string SPLUNK_HEC_TOKEN = "1AFAC088-BFC6-447F-A358-671FA7465342"; // Your HEC token. See http://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector
+        public static string EventCollectorToken = SPLUNK_HEC_TOKEN; 
 
         public static void Main(string[] args)
         {
@@ -30,7 +34,10 @@ public static void Main(string[] args)
             WithNoTemplate(eventsToCreate);
             WithCompactSplunkFormatter(eventsToCreate);
             if (runSSL)
+            {
                 UsingSSL(eventsToCreate);
+            }
+            AddCustomFields(eventsToCreate);
 
             Log.Debug("Done");
         }
@@ -42,10 +49,11 @@ private static void WithCompactSplunkFormatter(int eventsToCreate)
                 .MinimumLevel.Debug()
                 .WriteTo.LiterateConsole()
                 .WriteTo.EventCollector(
-                    "http://localhost:8088/services/collector",
-                    Program.EventCollectorToken,new CompactSplunkJsonFormatter())
+                    SPLUNK_FULL_ENDPOINT,
+                    Program.EventCollectorToken, new CompactSplunkJsonFormatter())
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
-                .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "Vanilla with CompactSplunkJsonFormatter specified")
+                .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType",
+                    "Vanilla with CompactSplunkJsonFormatter specified")
                 .CreateLogger();
 
 
@@ -64,7 +72,7 @@ public static void OverridingSource(int eventsToCreate)
                 .MinimumLevel.Debug()
                 .WriteTo.LiterateConsole()
                 .WriteTo.EventCollector(
-                    "http://localhost:8088",
+                    SPLUNK_ENDPOINT,
                     Program.EventCollectorToken,
                     source: "Serilog.Sinks.Splunk.Sample.TestSource")
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
@@ -77,7 +85,6 @@ public static void OverridingSource(int eventsToCreate)
             }
 
             Log.CloseAndFlush();
-
         }
 
         public static void OverridingSourceType(int eventsToCreate)
@@ -87,9 +94,9 @@ public static void OverridingSourceType(int eventsToCreate)
                 .MinimumLevel.Debug()
                 .WriteTo.LiterateConsole()
                 .WriteTo.EventCollector(
-                    "http://localhost:8088",
+                    SPLUNK_ENDPOINT,
                     Program.EventCollectorToken,
-                    sourceType: "Serilog.Sinks.Splunk.Sample.TestSourceType")
+                    sourceType: "_json")
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "Source Type Override")
                 .CreateLogger();
@@ -100,7 +107,6 @@ public static void OverridingSourceType(int eventsToCreate)
             }
 
             Log.CloseAndFlush();
-
         }
 
         public static void OverridingHost(int eventsToCreate)
@@ -110,7 +116,7 @@ public static void OverridingHost(int eventsToCreate)
                 .MinimumLevel.Debug()
                 .WriteTo.LiterateConsole()
                 .WriteTo.EventCollector(
-                    "http://localhost:8088",
+                    SPLUNK_ENDPOINT,
                     Program.EventCollectorToken,
                     host: "myamazingmachine")
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
@@ -123,7 +129,6 @@ public static void OverridingHost(int eventsToCreate)
             }
 
             Log.CloseAndFlush();
-
         }
 
         public static void UsingFullUri(int eventsToCreate)
@@ -133,7 +138,7 @@ public static void UsingFullUri(int eventsToCreate)
                 .MinimumLevel.Debug()
                 .WriteTo.LiterateConsole()
                 .WriteTo.EventCollector(
-                    "http://localhost:8088/services/collector",
+                    SPLUNK_FULL_ENDPOINT,
                     Program.EventCollectorToken)
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "Vanilla with full uri specified")
@@ -155,7 +160,7 @@ public static void UsingHostOnly(int eventsToCreate)
                 .MinimumLevel.Debug()
                 .WriteTo.LiterateConsole()
                 .WriteTo.EventCollector(
-                    "http://localhost:8088",
+                    SPLUNK_ENDPOINT,
                     Program.EventCollectorToken)
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "Vanilla No services/collector in uri")
@@ -176,7 +181,7 @@ public static void WithNoTemplate(int eventsToCreate)
                 .MinimumLevel.Debug()
                 .WriteTo.LiterateConsole()
                 .WriteTo.EventCollector(
-                    "http://localhost:8088",
+                    SPLUNK_ENDPOINT,
                     Program.EventCollectorToken,
                     renderTemplate: false)
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
@@ -198,7 +203,7 @@ public static void UsingSSL(int eventsToCreate)
                 .MinimumLevel.Debug()
                 .WriteTo.LiterateConsole()
                 .WriteTo.EventCollector(
-                    "https://localhost:8088",
+                    SPLUNK_ENDPOINT,
                     Program.EventCollectorToken)
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
                 .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "HTTPS")
@@ -210,5 +215,39 @@ public static void UsingSSL(int eventsToCreate)
             }
             Log.CloseAndFlush();
         }
+
+        public static void AddCustomFields(int eventsToCreate)
+        {
+            var metaData = new CustomFields(new List<CustomField>
+            {
+                new CustomField("relChan", "Test"),
+                new CustomField("version", "17.8.9.beta"),
+                new CustomField("rel", "REL1706"),
+                new CustomField("role", new List<string>() { "service", "rest", "ESB" })
+            });
+            // Override Source
+            Log.Logger = new LoggerConfiguration()
+                .MinimumLevel.Debug()
+                .WriteTo.LiterateConsole()
+                .WriteTo.EventCollector(
+                    splunkHost: SPLUNK_ENDPOINT
+                    , eventCollectorToken: SPLUNK_HEC_TOKEN
+                    , host: System.Environment.MachineName
+                    , source: "BackPackTestServerChannel"
+                    , sourceType: "_json"
+                    ,fields: metaData)
+                .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample", "ViaEventCollector")
+                .Enrich.WithProperty("Serilog.Sinks.Splunk.Sample.TestType", "AddCustomFields")
+                .CreateLogger();
+
+            foreach (var i in Enumerable.Range(0, eventsToCreate))
+            {
+                Log.Information("AddCustomFields {Counter}", i);
+            }
+
+            Log.CloseAndFlush();
+        }
     }
+
+
 }

serilog-sinks-splunk.sln

@@ -1,7 +1,7 @@
 
 Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio 15
-VisualStudioVersion = 15.0.26430.6
+VisualStudioVersion = 15.0.26430.12
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{7A774CBB-A6E9-4854-B4DB-4CF860B0C1C5}"
 EndProject

src/Serilog.Sinks.Splunk/Sinks/Splunk/CustomField.cs

@@ -0,0 +1,41 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace Serilog.Sinks.Splunk
+{ /// <summary>
+/// A Class for storing CustomField. They are sort of key,value pair. In simpler form key as string and value as single string, but could also be key and list of strings.
+/// </summary>
+    public class CustomField
+    { /// <summary>
+    /// the fieldsname eg: role, version,
+    /// </summary>
+        public string Name { get; set; }
+        /// <summary>
+        /// All values even simple string are stored as a list
+        /// </summary>
+        public List<string> ValueList { get; set; }
+        /// <summary>
+        /// constructor for a simple fieldname and a value both are strings
+        /// </summary>
+        /// <param name="name">Name of filed to be indexed by Splunk. Eg Role,Version,Channel</param>
+        /// <param name="value">Value of keypair. Eg. Test,1.08, RestService</param>
+        public CustomField(string name, string value)
+        {
+            Name = name;
+            ValueList = new List<string> { value };
+        }
+        /// <summary>
+        /// Constructor for Name and array of values
+        /// </summary>
+        /// <param name="name">Name of field eg TypeOfResource</param>
+        /// <param name="value">Array of values that should be connected with field.Eg Backend,Service,Rest</param>
+        public CustomField(string name, List<string> value)
+        {
+            Name = name;
+            ValueList = value;
+        }
+    }
+}

src/Serilog.Sinks.Splunk/Sinks/Splunk/CustomFields.cs

@@ -0,0 +1,41 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace Serilog.Sinks.Splunk
+{
+    /// <summary>
+    /// Class for storing CustomFields that splunk will index for the event but will not be displayed in the event.
+    /// They are the same for all events. Could could contain type of server or releasecode see: http://dev.splunk.com/view/event-collector/SP-CAAAFB6
+    /// </summary>
+    public class CustomFields
+    {/// <summary>
+    /// The List of all CustomFields of type CustomField
+    /// </summary>
+        public List<CustomField> CustomFieldList { get; set; }
+        /// <summary>
+        /// Constructor with no inital data
+        /// </summary>
+        public CustomFields()
+        {
+            CustomFieldList = new List<CustomField>();
+        }
+        /// <summary>
+        /// Constructor with simple CustomField
+        /// </summary>
+        /// <param name="customField"></param>
+        public CustomFields(CustomField customField)
+        {
+            CustomFieldList = new List<CustomField>{customField};
+        }
+        /// <summary>
+        /// Constructor with a list of CustomFields
+        /// </summary>
+        public CustomFields(List<CustomField> customFields)
+        {
+            CustomFieldList = customFields  ;
+        }
+    }
+}

src/Serilog.Sinks.Splunk/Sinks/Splunk/EventCollectorSink.cs

@@ -115,6 +115,47 @@ public EventCollectorSink(
                 messageHandler)
         {
         }
+        /// <summary>
+        /// Creates a new instance of the sink with Customfields
+        /// </summary>
+        /// <param name="splunkHost">The host of the Splunk instance with the Event collector configured</param>
+        /// <param name="eventCollectorToken">The token to use when authenticating with the event collector</param>
+        /// <param name="uriPath">Change the default endpoint of the Event Collector e.g. services/collector/event</param>
+        /// <param name="batchSizeLimit">The size of the batch when sending to the event collector</param>
+        /// <param name="formatProvider">The format provider used when rendering the message</param>
+        /// <param name="renderTemplate">Whether to render the message template</param>
+        /// <param name="batchIntervalInSeconds">The interval in seconds that batching should occur</param>
+        /// <param name="index">The Splunk index to log to</param>
+        /// <param name="fields">Add extra CustomExtraFields for Splunk to index</param>
+        /// <param name="source">The source of the event</param>
+        /// <param name="sourceType">The source type of the event</param>
+        /// <param name="host">The host of the event</param>
+        /// <param name="messageHandler">The handler used to send HTTP requests</param>
+        public EventCollectorSink(
+            string splunkHost,
+            string eventCollectorToken,
+            string uriPath,
+            string source,
+            string sourceType,
+            string host,
+            string index,
+            CustomFields fields,
+            int batchIntervalInSeconds,
+            int batchSizeLimit,
+            IFormatProvider formatProvider = null,
+            bool renderTemplate = true,
+            HttpMessageHandler messageHandler = null)
+            // TODO here is the jsonformatter creation. We must make way to test output of jsonformatter. 
+            : this(
+                splunkHost,
+                eventCollectorToken,
+                uriPath,
+                batchIntervalInSeconds,
+                batchSizeLimit,
+                new SplunkJsonFormatter(renderTemplate, formatProvider, source, sourceType, host, index,fields),
+                messageHandler)
+        {
+        }
 
 
         /// <summary>