spacewander commented on a change in pull request #5819:
URL: https://github.com/apache/apisix/pull/5819#discussion_r771086695



##########
File path: apisix/plugins/splunk-hec-logging.lua
##########
@@ -0,0 +1,189 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements.  See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License.  You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local core            = require("apisix.core")
+local ngx             = ngx
+local type            = type
+local ngx_now         = ngx.now
+local ngx_update_time = ngx.update_time
+local http            = require("resty.http")
+local log_util        = require("apisix.utils.log-util")
+local bp_manager_mod  = require("apisix.utils.batch-processor-manager")
+
+
+local DEFAULT_SPLUNK_HEC_ENTRY_SOURCE = "apache-apisix-splunk-hec-logging"
+local DEFAULT_SPLUNK_HEC_ENTRY_TYPE = "_json"
+
+
+local plugin_name = "splunk-hec-logging"
+local batch_processor_manager = bp_manager_mod.new(plugin_name)
+
+
+local schema = {
+    type = "object",
+    properties = {
+        endpoint = {
+            type = "object",
+            properties = {
+                uri = core.schema.uri_def,
+                token = {
+                    type = "string",
+                },
+                channel = {
+                    type = "string",
+                },
+                timeout = {
+                    type = "integer",
+                    minimum = 1,
+                    default = 60
+                }
+            },
+            required = { "uri", "token" }
+        },
+        ssl_verify = {
+            type = "boolean",
+            default = true
+        },
+        max_retry_count = {
+            type = "integer",
+            minimum = 0,
+            default = 0
+        },
+        retry_delay = {
+            type = "integer",
+            minimum = 0,
+            default = 1
+        },
+        buffer_duration = {
+            type = "integer",
+            minimum = 1,
+            default = 60
+        },
+        inactive_timeout = {
+            type = "integer",
+            minimum = 1,
+            default = 10
+        },
+        batch_max_size = {
+            type = "integer",
+            minimum = 1,
+            default = 100
+        },
+    },
+    required = { "endpoint" },
+}
+
+
+local function get_logger_entry(conf)
+    local entry = log_util.get_full_log(ngx, conf)
+    ngx_update_time()

Review comment:
       The timestamp here is not critical. We don't need to always update the 
cache.

##########
File path: apisix/plugins/splunk-hec-logging.lua
##########
@@ -0,0 +1,189 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements.  See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License.  You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local core            = require("apisix.core")
+local ngx             = ngx
+local type            = type
+local ngx_now         = ngx.now
+local ngx_update_time = ngx.update_time
+local http            = require("resty.http")
+local log_util        = require("apisix.utils.log-util")
+local bp_manager_mod  = require("apisix.utils.batch-processor-manager")
+
+
+local DEFAULT_SPLUNK_HEC_ENTRY_SOURCE = "apache-apisix-splunk-hec-logging"
+local DEFAULT_SPLUNK_HEC_ENTRY_TYPE = "_json"
+
+
+local plugin_name = "splunk-hec-logging"
+local batch_processor_manager = bp_manager_mod.new(plugin_name)
+
+
+local schema = {
+    type = "object",
+    properties = {
+        endpoint = {
+            type = "object",
+            properties = {
+                uri = core.schema.uri_def,
+                token = {
+                    type = "string",
+                },
+                channel = {
+                    type = "string",
+                },
+                timeout = {
+                    type = "integer",
+                    minimum = 1,
+                    default = 60
+                }
+            },
+            required = { "uri", "token" }
+        },
+        ssl_verify = {
+            type = "boolean",
+            default = true
+        },
+        max_retry_count = {

Review comment:
       Better avoid repeating the schema definition in batch-processor

##########
File path: t/plugin/splunk-hec-logging.t
##########
@@ -0,0 +1,259 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+use t::APISIX 'no_plan';
+
+repeat_each(1);
+no_long_string();
+no_root_location();
+
+add_block_preprocessor(sub {
+    my ($block) = @_;
+
+    if ((!defined $block->error_log) && (!defined $block->no_error_log)) {
+        $block->set_value("no_error_log", "[error]");
+    }
+
+    if (!defined $block->request) {
+        $block->set_value("request", "GET /t");
+    }
+
+});
+
+run_tests();
+
+__DATA__
+
+=== TEST 1: full configuration verification
+--- config
+    location /t {
+        content_by_lua_block {
+            local plugin = require("apisix.plugins.splunk-hec-logging")
+            local ok, err = plugin.check_schema({
+                endpoint = {
+                    uri = "http://127.0.0.1:18088/services/collector";,
+                    token = "BD274822-96AA-4DA6-90EC-18940FB2414C",
+                    channel = "FE0ECFAD-13D5-401B-847D-77833BD77131",
+                    timeout = 60
+                },
+                max_retry_count = 0,
+                retry_delay = 1,
+                buffer_duration = 60,
+                inactive_timeout = 2,
+                batch_max_size = 10,
+            })
+
+            if not ok then
+                ngx.say(err)
+            else
+                ngx.say("passed")
+            end
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 2: minimize configuration verification
+--- config
+    location /t {
+        content_by_lua_block {
+            local plugin = require("apisix.plugins.splunk-hec-logging")
+            local ok, err = plugin.check_schema({
+                endpoint = {
+                    uri = "http://127.0.0.1:18088/services/collector";,
+                    token = "BD274822-96AA-4DA6-90EC-18940FB2414C",
+                }
+            })
+
+            if not ok then
+                ngx.say(err)
+            else
+                ngx.say("passed")
+            end
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 3: undefined uri configuration
+--- config
+    location /t {
+        content_by_lua_block {
+            local plugin = require("apisix.plugins.splunk-hec-logging")
+            local ok, err = plugin.check_schema({
+                endpoint = {
+                    token = "BD274822-96AA-4DA6-90EC-18940FB2414C",
+                }
+            })
+
+            if not ok then
+                ngx.say(err)
+            else
+                ngx.say("passed")
+            end
+        }
+    }
+--- response_body
+property "endpoint" validation failed: property "uri" is required
+
+
+
+=== TEST 4: undefined token configuration
+--- config
+    location /t {
+        content_by_lua_block {
+            local plugin = require("apisix.plugins.splunk-hec-logging")
+            local ok, err = plugin.check_schema({

Review comment:
        We can use table drive test for check_schema. You can take this as an 
example: 
https://github.com/apache/apisix/blob/c178435d7ada4eeb713d9a1688fb5f54f971abdf/t/plugin/gzip.t#L494

##########
File path: apisix/plugins/splunk-hec-logging.lua
##########
@@ -0,0 +1,189 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements.  See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License.  You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local core            = require("apisix.core")
+local ngx             = ngx
+local type            = type
+local ngx_now         = ngx.now
+local ngx_update_time = ngx.update_time
+local http            = require("resty.http")
+local log_util        = require("apisix.utils.log-util")
+local bp_manager_mod  = require("apisix.utils.batch-processor-manager")
+
+
+local DEFAULT_SPLUNK_HEC_ENTRY_SOURCE = "apache-apisix-splunk-hec-logging"
+local DEFAULT_SPLUNK_HEC_ENTRY_TYPE = "_json"
+
+
+local plugin_name = "splunk-hec-logging"
+local batch_processor_manager = bp_manager_mod.new(plugin_name)
+
+
+local schema = {
+    type = "object",
+    properties = {
+        endpoint = {
+            type = "object",
+            properties = {
+                uri = core.schema.uri_def,
+                token = {
+                    type = "string",
+                },
+                channel = {
+                    type = "string",
+                },
+                timeout = {
+                    type = "integer",
+                    minimum = 1,
+                    default = 60
+                }
+            },
+            required = { "uri", "token" }
+        },
+        ssl_verify = {
+            type = "boolean",
+            default = true
+        },
+        max_retry_count = {
+            type = "integer",
+            minimum = 0,
+            default = 0
+        },
+        retry_delay = {
+            type = "integer",
+            minimum = 0,
+            default = 1
+        },
+        buffer_duration = {
+            type = "integer",
+            minimum = 1,
+            default = 60
+        },
+        inactive_timeout = {
+            type = "integer",
+            minimum = 1,
+            default = 10
+        },
+        batch_max_size = {
+            type = "integer",
+            minimum = 1,
+            default = 100
+        },
+    },
+    required = { "endpoint" },
+}
+
+
+local function get_logger_entry(conf)
+    local entry = log_util.get_full_log(ngx, conf)
+    ngx_update_time()
+    return {
+        time = ngx_now(),
+        host = entry.server.hostname,
+        source = DEFAULT_SPLUNK_HEC_ENTRY_SOURCE,
+        sourcetype = DEFAULT_SPLUNK_HEC_ENTRY_TYPE,
+        event = {
+            request_url = entry.request.url,
+            request_method = entry.request.method,
+            request_headers = entry.request.headers,
+            request_query = entry.request.querystring,
+            request_size = entry.request.size,
+            response_headers = entry.response.headers,
+            response_status = entry.response.status,
+            response_size = entry.response.size,
+            latency = entry.latency,
+            upstream = entry.upstream,
+        }
+    }
+end
+
+
+local function send_to_splunk(conf, entries)
+    if type(conf.endpoint) ~= "table" then
+        return nil, "endpoint config invalid"
+    end
+
+    if not conf.endpoint.uri then
+        return nil, "endpoint url undefined"
+    end
+
+    if not conf.endpoint.token then
+        return nil, "endpoint token undefined"

Review comment:
       We already check the conf in the check_schema?

##########
File path: conf/config-default.yaml
##########
@@ -355,6 +355,7 @@ plugins:                          # plugin list (sorted by 
priority)
   - http-logger                    # priority: 410
   - skywalking-logger              # priority: 408
   - google-cloud-logging           # priority: 407
+  - splunk-hec-logging             # priority: 409

Review comment:
       sorted by priority

##########
File path: t/plugin/splunk-hec-logging.t
##########
@@ -0,0 +1,259 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+use t::APISIX 'no_plan';
+
+repeat_each(1);
+no_long_string();
+no_root_location();
+
+add_block_preprocessor(sub {
+    my ($block) = @_;
+
+    if ((!defined $block->error_log) && (!defined $block->no_error_log)) {
+        $block->set_value("no_error_log", "[error]");
+    }
+
+    if (!defined $block->request) {
+        $block->set_value("request", "GET /t");
+    }
+
+});
+
+run_tests();
+
+__DATA__
+
+=== TEST 1: full configuration verification
+--- config
+    location /t {
+        content_by_lua_block {
+            local plugin = require("apisix.plugins.splunk-hec-logging")
+            local ok, err = plugin.check_schema({
+                endpoint = {
+                    uri = "http://127.0.0.1:18088/services/collector";,
+                    token = "BD274822-96AA-4DA6-90EC-18940FB2414C",
+                    channel = "FE0ECFAD-13D5-401B-847D-77833BD77131",
+                    timeout = 60
+                },
+                max_retry_count = 0,
+                retry_delay = 1,
+                buffer_duration = 60,
+                inactive_timeout = 2,
+                batch_max_size = 10,
+            })
+
+            if not ok then
+                ngx.say(err)
+            else
+                ngx.say("passed")
+            end
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 2: minimize configuration verification
+--- config
+    location /t {
+        content_by_lua_block {
+            local plugin = require("apisix.plugins.splunk-hec-logging")
+            local ok, err = plugin.check_schema({
+                endpoint = {
+                    uri = "http://127.0.0.1:18088/services/collector";,
+                    token = "BD274822-96AA-4DA6-90EC-18940FB2414C",
+                }
+            })
+
+            if not ok then
+                ngx.say(err)
+            else
+                ngx.say("passed")
+            end
+        }
+    }
+--- response_body
+passed
+
+
+
+=== TEST 3: undefined uri configuration
+--- config
+    location /t {
+        content_by_lua_block {
+            local plugin = require("apisix.plugins.splunk-hec-logging")
+            local ok, err = plugin.check_schema({
+                endpoint = {
+                    token = "BD274822-96AA-4DA6-90EC-18940FB2414C",
+                }
+            })
+
+            if not ok then
+                ngx.say(err)
+            else
+                ngx.say("passed")
+            end
+        }
+    }
+--- response_body
+property "endpoint" validation failed: property "uri" is required
+
+
+
+=== TEST 4: undefined token configuration
+--- config
+    location /t {
+        content_by_lua_block {
+            local plugin = require("apisix.plugins.splunk-hec-logging")
+            local ok, err = plugin.check_schema({
+                endpoint = {
+                    uri = "http://127.0.0.1:18088/services/collector";,
+                }
+            })
+
+            if not ok then
+                ngx.say(err)
+            else
+                ngx.say("passed")
+            end
+        }
+    }
+--- response_body
+property "endpoint" validation failed: property "token" is required
+
+
+
+=== TEST 5: uri configuration format invalid
+--- config
+    location /t {
+        content_by_lua_block {
+            local plugin = require("apisix.plugins.splunk-hec-logging")
+            local ok, err = plugin.check_schema({
+                endpoint = {
+                    uri = "127.0.0.1:18088/services/collector",
+                    token = "BD274822-96AA-4DA6-90EC-18940FB2414C",
+                }
+            })
+
+            if not ok then
+                ngx.say(err)
+            else
+                ngx.say("passed")
+            end
+        }
+    }
+--- response_body_like
+property "endpoint" validation failed: property "uri" validation failed.*
+
+
+
+=== TEST 6: set route (failed auth)
+--- config
+    location /t {
+        content_by_lua_block {
+            local t = require("lib.test_admin").test
+            local code, body = t('/apisix/admin/routes/1', ngx.HTTP_PUT, {
+                uri = "/hello",
+                upstream = {
+                    type = "roundrobin",
+                    nodes = {
+                        ["127.0.0.1:1980"] = 1
+                    }
+                },
+                plugins = {
+                    ["splunk-hec-logging"] = {
+                        endpoint = {
+                            uri = "http://127.0.0.1:18088/services/collector";,
+                            token = "BD274822-96AA-4DA6-90EC-18940FB24444"
+                        },
+                        batch_max_size = 1,
+                        inactive_timeout = 1
+                    }
+                }
+            })
+
+            if code >= 300 then
+                ngx.status = code
+            end
+            ngx.say(body)
+        }
+    }
+--- request

Review comment:
       Please remove the duplicate `GET /t`

##########
File path: docs/en/latest/plugins/splunk-hec-logging.md
##########
@@ -0,0 +1,143 @@
+---
+title: splunk-hec-logging
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Summary
+
+- [**Name**](#name)
+- [**Attributes**](#attributes)
+- [**How To Enable**](#how-to-enable)
+- [**Test Plugin**](#test-plugin)
+- [**Disable Plugin**](#disable-plugin)
+
+## Name
+
+The `splunk-hec-logging` plugin is used to forward the request log of `Apache 
APISIX` to `Splunk HTTP Event Collector (HEC)` for analysis and storage. After 
the plugin is enabled, `Apache APISIX` will obtain request context information 
in `Log Phase` serialize it into [Splunk Event Data 
format](https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector#Event_metadata)
 and submit to the batch queue. When the batch queue is triggered by a capacity 
or time threshold, the data in the queue will be submitted to `Splunk HEC`.

Review comment:
       ```suggestion
   The `splunk-hec-logging` plugin is used to forward the request log of 
`Apache APISIX` to `Splunk HTTP Event Collector (HEC)` for analysis and 
storage. After the plugin is enabled, `Apache APISIX` will obtain request 
context information in `Log Phase` serialize it into [Splunk Event Data 
format](https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector#Event_metadata)
 and submit it to the batch queue. When the batch queue is triggered by a 
capacity or time threshold, the data in the queue will be submitted to `Splunk 
HEC`.
   ```
   
   And "obtain request context information in `Log Phase` serialize it", the 
grammar looks strange to me...

##########
File path: docs/en/latest/plugins/splunk-hec-logging.md
##########
@@ -0,0 +1,143 @@
+---
+title: splunk-hec-logging
+---
+
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+## Summary
+
+- [**Name**](#name)
+- [**Attributes**](#attributes)
+- [**How To Enable**](#how-to-enable)
+- [**Test Plugin**](#test-plugin)
+- [**Disable Plugin**](#disable-plugin)
+
+## Name
+
+The `splunk-hec-logging` plugin is used to forward the request log of `Apache 
APISIX` to `Splunk HTTP Event Collector (HEC)` for analysis and storage. After 
the plugin is enabled, `Apache APISIX` will obtain request context information 
in `Log Phase` serialize it into [Splunk Event Data 
format](https://docs.splunk.com/Documentation/Splunk/latest/Data/FormateventsforHTTPEventCollector#Event_metadata)
 and submit to the batch queue. When the batch queue is triggered by a capacity 
or time threshold, the data in the queue will be submitted to `Splunk HEC`.
+
+For more info on Batch-Processor in Apache APISIX please refer to:
+[Batch-Processor](../batch-processor.md)
+
+## Attributes
+
+| Name                    | Requirement   | Default                            
                                                                                
                                                                               
| Description                                                                   
                                                                                
                   |
+| ----------------------- | ------------- | 
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 | 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 |
+| endpoint                | required      |                                    
                                                                                
                                                                               
| Splunk HEC endpoint configuration info                                        
                                                                                
                   |
+| endpoint.uri            | required      |                                    
                                                                                
                                                                               
| Splunk HEC event collector API                                                
                                                                                
                   |
+| endpoint.token          | required      |                                    
                                                                                
                                                                               
| Splunk HEC authentication token                                               
                                                                                
                   |
+| endpoint.channel        | optional      |                                    
                                                                                
                                                                               
| Splunk HEC send data channel identifier, refer to: [About HTTP Event 
Collector Indexer 
Acknowledgment](https://docs.splunk.com/Documentation/Splunk/8.2.3/Data/AboutHECIDXAck)
   |
+| endpoint.timeout        | optional      | 60                                 
                                                                                
                                                                               
| Splunk HEC send data timeout                                                  
                                                                                
                   |
+| ssl_verify              | optional      | true                               
                                                                                
                                                                               
| enable `SSL` verification, option as per [OpenResty 
docs](https://github.com/openresty/lua-nginx-module#tcpsocksslhandshake)        
                                             |
+| max_retry_count         | optional      | 0                                  
                                                                                
                                                                               
| max number of retries before removing from the processing pipe line           
                                                                                
                   |
+| retry_delay             | optional      | 1                                  
                                                                                
                                                                               
| number of seconds the process execution should be delayed if the execution 
fails                                                                           
                      |
+| buffer_duration         | optional      | 60                                 
                                                                                
                                                                               
| max age in seconds of the oldest entry in a batch before the batch must be 
processed                                                                       
                      |
+| inactive_timeout        | optional      | 10                                 
                                                                                
                                                                               
| max age in seconds when the buffer will be flushed if inactive                
                                                                                
                   |
+| batch_max_size          | optional      | 100                                
                                                                                
                                                                               
| max size of each batch                                                        
                                                                                
                   |

Review comment:
       Please use the default value of batch-processor.

##########
File path: apisix/plugins/splunk-hec-logging.lua
##########
@@ -0,0 +1,189 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements.  See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License.  You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+
+local core            = require("apisix.core")
+local ngx             = ngx
+local type            = type
+local ngx_now         = ngx.now
+local ngx_update_time = ngx.update_time
+local http            = require("resty.http")
+local log_util        = require("apisix.utils.log-util")
+local bp_manager_mod  = require("apisix.utils.batch-processor-manager")
+
+
+local DEFAULT_SPLUNK_HEC_ENTRY_SOURCE = "apache-apisix-splunk-hec-logging"
+local DEFAULT_SPLUNK_HEC_ENTRY_TYPE = "_json"
+
+
+local plugin_name = "splunk-hec-logging"
+local batch_processor_manager = bp_manager_mod.new(plugin_name)
+
+
+local schema = {
+    type = "object",
+    properties = {
+        endpoint = {
+            type = "object",
+            properties = {
+                uri = core.schema.uri_def,
+                token = {
+                    type = "string",
+                },
+                channel = {
+                    type = "string",
+                },
+                timeout = {
+                    type = "integer",
+                    minimum = 1,
+                    default = 60
+                }
+            },
+            required = { "uri", "token" }
+        },
+        ssl_verify = {
+            type = "boolean",
+            default = true
+        },
+        max_retry_count = {
+            type = "integer",
+            minimum = 0,
+            default = 0
+        },
+        retry_delay = {
+            type = "integer",
+            minimum = 0,
+            default = 1
+        },
+        buffer_duration = {
+            type = "integer",
+            minimum = 1,
+            default = 60
+        },
+        inactive_timeout = {
+            type = "integer",
+            minimum = 1,
+            default = 10
+        },
+        batch_max_size = {
+            type = "integer",
+            minimum = 1,
+            default = 100
+        },
+    },
+    required = { "endpoint" },
+}
+
+
+local function get_logger_entry(conf)
+    local entry = log_util.get_full_log(ngx, conf)
+    ngx_update_time()
+    return {
+        time = ngx_now(),
+        host = entry.server.hostname,
+        source = DEFAULT_SPLUNK_HEC_ENTRY_SOURCE,
+        sourcetype = DEFAULT_SPLUNK_HEC_ENTRY_TYPE,
+        event = {
+            request_url = entry.request.url,
+            request_method = entry.request.method,
+            request_headers = entry.request.headers,
+            request_query = entry.request.querystring,
+            request_size = entry.request.size,
+            response_headers = entry.response.headers,
+            response_status = entry.response.status,
+            response_size = entry.response.size,
+            latency = entry.latency,
+            upstream = entry.upstream,
+        }
+    }
+end
+
+
+local function send_to_splunk(conf, entries)
+    if type(conf.endpoint) ~= "table" then
+        return nil, "endpoint config invalid"
+    end
+
+    if not conf.endpoint.uri then
+        return nil, "endpoint url undefined"
+    end
+
+    if not conf.endpoint.token then
+        return nil, "endpoint token undefined"
+    end
+
+    local request_headers = {}
+    request_headers["Content-Type"] = "application/json"
+    request_headers["Authorization"] = "Splunk " .. conf.endpoint.token
+    if conf.endpoint.channel then
+        request_headers["X-Splunk-Request-Channel"] = conf.endpoint.channel
+    end
+
+    local http_new = http.new()
+    local res, err = http_new:request_uri(conf.endpoint.uri, {
+        ssl_verify = conf.ssl_verify,
+        method = "POST",
+        body = core.json.encode(entries),
+        headers = request_headers,
+    })
+
+    if err then
+        return nil, "failed to write log to splunk, " .. err
+    end
+
+    local body
+    body, err = core.json.decode(res.body)
+    if err then
+        return nil, "failed to parse splunk response data, " .. err
+    end
+
+    if res.status ~= 200 then

Review comment:
       We should check status before handling the body




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscr...@apisix.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


Reply via email to