zachtimusprime / go-splunk-http Goto Github PK

If you are moving a high volume of messages to splunk, the doRequest (splunk/splunk.go) function is not properly closing the http request and you quickly run out of file descriptors. The code below should be added before each of the returns on lines 164 and 173. It's better not to use the "defer" as this also waits longer than necessary to close the connection.

if res != nil {
	res.Body.Close()
}

This should be an easy one,
while looking into the code i found that NewEventWithTime ignores the provided time and instead also uses time.now
https://github.com/ZachtimusPrime/Go-Splunk-HTTP/blob/master/splunk/v2/splunk.go#L95

PR here: #20

The latest release tag cannot be used:

$ mkdir repro
$ cd repro
$ go mod init github.com/CodyDWJones/repro
$ go get github.com/ZachtimusPrime/Go-Splunk-HTTP/v2
go get github.com/ZachtimusPrime/Go-Splunk-HTTP/v2: module github.com/ZachtimusPrime/Go-Splunk-HTTP@upgrade found (v0.0.0-20201008172325-b298e35fa174), but does not contain package github.com/ZachtimusPrime/Go-Splunk-HTTP/v2

The following fails too but that's expected since v2 is considered to contain breaking changes:

$ go get github.com/ZachtimusPrime/[email protected]
go get github.com/ZachtimusPrime/[email protected]: github.com/ZachtimusPrime/[email protected]: invalid version: module contains a go.mod file, so major version must be compatible: should be v0 or v1, not v2

In general, I'd say its bad practice to use an insecure http.Client by default. If I don't want safety, I should have to pass in an insecure http.Client

It would be nice if this package included a hook for Logrus (and others, maybe even implement the Logger interface) that would automatically send logs to splunk.

The hook/logger would preferably do async logging, and batch up log events to send to splunk.

splunk.Client would probably be the one to implement the interface, or have a function that would return the logger.

Would this be in scope for this library? I'd like to implement it here so I don't have to implement it elsewhere :)

The timestamps of events logged by this library are less accurate than they could be.

The default time format is epoch time format, in the format ..
(https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/FormateventsforHTTPEventCollector)

Splunk has supported this since at least version 7.0 (released Sept 2017). It might work with older installations too, though I was unable to find a versioned reference before v7.0.

• move go.mod to root
• move ./splunk/v2 to ./v2
• update go.mod to reflect the change of path for the module so that specific release tags don't have to be created in the format splunk/vX.X.X