External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-01-11 01:57:35 -03:30
Code Issues Packages Projects Releases Wiki Activity

Added required epoc time field for Splunk HEC Event Receiver (#14246)

Browse Source 
Signed-off-by: Iain <iain@digitalbadger.com>
This commit is contained in:
digitalbadger-uk 2023-08-21 13:44:52 +01:00 committed by GitHub
parent 3de8455960
commit 8c7ab8fcf2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
awx/main/utils/formatters.py
View File

@ -283,6 +283,7 @@ class LogstashFormatter(LogstashFormatterBase):
message.update(self.get_debug_fields(record))
if settings.LOG_AGGREGATOR_TYPE == 'splunk':
# splunk messages must have a top level "event" key
message = {'event': message}
# splunk messages must have a top level "event" key when using the /services/collector/event receiver.
# The event receiver wont scan an event for a timestamp field therefore a time field must also be supplied containing epoch timestamp
message = {'time': record.created, 'event': message}
return self.serialize(message)