jiangfucheng commented on issue #9458: URL: https://github.com/apache/apisix/issues/9458#issuecomment-1544252988
> The batch protocol for HTTP Event Collector involves event objects stacked one after the other, and not in a JSON array ref:https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector#Example_3:_Batched_data I reproduced this bug when using vector as the log server. But I can't test this behavior for use Splunk, since I only has MBP with M1 arch, it can't deploy splunk server. Though the explaination of splunk documentation, Maybe we can change these codes to fix this issues: ``` local function send_to_splunk(conf, entries) local request_headers = {} request_headers["Content-Type"] = "application/json" request_headers["Authorization"] = "Splunk " .. conf.endpoint.token if conf.endpoint.channel then request_headers["X-Splunk-Request-Channel"] = conf.endpoint.channel end local http_new = http.new() http_new:set_timeout(conf.endpoint.timeout * 1000) local t = {} for _, e in ipairs(entries) do table_insert(t, core.json.encode(e)) end local res, err = http_new:request_uri(conf.endpoint.uri, { ssl_verify = conf.ssl_verify, method = "POST", body = table_concat(t), headers = request_headers, }) if not res then return false, "failed to write log to splunk, " .. err end if res.status ~= 200 then local body = core.json.decode(res.body) if not body then return false, "failed to send splunk, http status code: " .. res.status else return false, "failed to send splunk, " .. body.text end end return true end ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
