External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-02 09:18:48 -03:30
Code Issues Packages Projects Releases Wiki Activity

Added required epoc time field for Splunk HEC Event Receiver (#14246)

Browse Source 
Signed-off-by: Iain <iain@digitalbadger.com>
This commit is contained in:
digitalbadger-uk
2023-08-21 13:44:52 +01:00
committed by GitHub
parent 3de8455960
commit 8c7ab8fcf2
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
awx/main/utils/formatters.py
View File

@@ -283,6 +283,7 @@ class LogstashFormatter(LogstashFormatterBase):
message.update(self.get_debug_fields(record)) message.update(self.get_debug_fields(record))
if settings.LOG_AGGREGATOR_TYPE == 'splunk': if settings.LOG_AGGREGATOR_TYPE == 'splunk':
# splunk messages must have a top level "event" key # splunk messages must have a top level "event" key when using the /services/collector/event receiver.
message = {'event': message} # The event receiver wont scan an event for a timestamp field therefore a time field must also be supplied containing epoch timestamp
message = {'time': record.created, 'event': message}
return self.serialize(message) return self.serialize(message)