lib/fluent/plugin/out_splunk_hec.rb in fluent-plugin-splunk-enterprise-0.9.2 vs lib/fluent/plugin/out_splunk_hec.rb in fluent-plugin-splunk-enterprise-0.9.3

@@ -20,11 +20,14 @@
     config_param :source_key, :string, default: nil
     config_param :remove_source_key, :bool, default: false
     config_param :default_index, :string, default: nil
     config_param :index_key, :string, default: nil
     config_param :remove_index_key, :bool, default: false
-    config_param :sourcetype, :string, default: nil
+    config_param :sourcetype, :string, default: nil, deprecated: "Use default_sourcetype instead"
+    config_param :default_sourcetype, :string, default: nil
+    config_param :sourcetype_key, :string, default: nil
+    config_param :remove_sourcetype_key, :bool, default: false
     config_param :use_fluentd_time, :bool, default: true    
 
     # for Indexer acknowledgement
     config_param :use_ack, :bool, default: false
     config_param :channel, :string, default: nil
@@ -50,18 +53,20 @@
       super
       raise ConfigError, "'channel' parameter is required when 'use_ack' is true" if @use_ack && !@channel
       raise ConfigError, "'ack_interval' parameter must be a non negative integer" if @use_ack && @ack_interval < 0
       raise ConfigError, "'event_key' parameter is required when 'raw' is true" if @raw && !@event_key
       raise ConfigError, "'channel' parameter is required when 'raw' is true" if @raw && !@channel
+      
+      @default_sourcetype = @sourcetype if @sourcetype && !@default_sourcetype
 
       # build hash for query string
       if @raw
         @query = {}
         @query['host'] = @default_host if @default_host
         @query['source'] = @default_source if @default_source
         @query['index'] = @default_index if @default_index
-        @query['sourcetype'] = @sourcetype if @sourcetype
+        @query['sourcetype'] = @default_sourcetype if @default_sourcetype
       end
     end
 
     def start
       setup_client
@@ -101,10 +106,14 @@
     def format_event(time, record)
       msg = {'event' => record}
       msg['time'] = time if @use_fluentd_time
 
       # metadata
-      msg['sourcetype'] = @sourcetype if @sourcetype
+      if record[@sourcetype_key]
+        msg['sourcetype'] = @remove_sourcetype_key ? record.delete(@sourcetype_key) : record[@sourcetype_key]
+      elsif @default_sourcetype
+        msg['sourcetype'] = @default_sourcetype
+      end
 
       if record[@host_key]
         msg['host'] = @remove_host_key ? record.delete(@host_key) : record[@host_key]
       elsif @default_host
         msg['host'] = @default_host