private void DefaultSuffixPropertiesSplunk(LogSplunkMapper mapper)
{
var suffixWriter = new StringWriter();
suffixWriter.Write("}"); // Terminates "event"
if (!string.IsNullOrWhiteSpace(mapper.Source))
{
suffixWriter.Write(",\"source\":");
JsonValueFormatter.WriteQuotedJsonString(mapper.Source, suffixWriter);
}
if (!string.IsNullOrWhiteSpace(mapper.SourceType))
{
suffixWriter.Write(",\"sourcetype\":");
JsonValueFormatter.WriteQuotedJsonString(mapper.SourceType, suffixWriter);
}
if (!string.IsNullOrWhiteSpace(mapper.Host))
{
suffixWriter.Write(",\"host\":");
JsonValueFormatter.WriteQuotedJsonString(mapper.Host, suffixWriter);
}
if (!string.IsNullOrWhiteSpace(mapper.Index))
{
suffixWriter.Write(",\"index\":");
JsonValueFormatter.WriteQuotedJsonString(mapper.Index, suffixWriter);
}
suffixWriter.Write('}'); // Terminates the types of Splunk
_suffix = suffixWriter.ToString();
}
private void FillLogSplunkStone(LogEvent logEvent, TextWriter output)
{
LogSplunkMapper logData = ArrangeLogData(logEvent);
DefaultSuffixPropertiesSplunk(logData);
FormatPropertiesSplunk(logEvent: logEvent, output: output, logData: logData);
}
private LogSplunkMapper ArrangeLogData(LogEvent logEvent)
{
var time = (long)(DateTime.Now.Subtract(new DateTime(1970, 1, 1))).TotalSeconds;
var index = _splunkSettings.Index;
var sourceType = _splunkSettings.SourceType;
var productCompany = _splunkSettings.ProductCompany;
var productVersion = _splunkSettings.ProductVersion;
var processName = _splunkSettings.ProcessName;
var application = _splunkSettings.Application;
var machine = Environment.MachineName;
var logSplunkMapper = new LogSplunkMapper();
var message = logEvent.RenderMessage(null);
logSplunkMapper.Time = time;
logSplunkMapper.Host = machine?.ToString();
logSplunkMapper.Source = application?.ToString();
logSplunkMapper.SourceType = sourceType?.ToString();
logSplunkMapper.Index = index?.ToString();
logSplunkMapper.Event.ProcessName = processName;
logSplunkMapper.Event.ProductCompany = productCompany;
logSplunkMapper.Event.ProductName = application;
logSplunkMapper.Event.ProductVersion = productVersion;
logSplunkMapper.Event.Severity = logEvent.Level.ToString();
logSplunkMapper.Event.Message = message.Replace(@"""", "") ?? logSplunkMapper.Event.ProcessName;
return(logSplunkMapper);
}
public void FormatPropertiesSplunk(LogEvent logEvent, TextWriter output, LogSplunkMapper logData)
{
if (logEvent == null)
{
throw new ArgumentNullException(nameof(logEvent));
}
if (output == null)
{
throw new ArgumentNullException(nameof(output));
}
output.Write("{\"time\":\"");
output.Write(logData.Time);
output.Write("\",\"event\":{");
if (!string.IsNullOrWhiteSpace(logData.Event.Message))
{
output.Write("\"Message\":");
JsonValueFormatter.WriteQuotedJsonString(logData.Event.Message, output);
}
if (!string.IsNullOrWhiteSpace(logData.Event.ProcessName))
{
output.Write(",\"ProcessName\":");
JsonValueFormatter.WriteQuotedJsonString(logData.Event.ProcessName, output);
}
if (!string.IsNullOrWhiteSpace(logData.Event.ProductCompany))
{
output.Write(",\"ProductCompany\":");
JsonValueFormatter.WriteQuotedJsonString(logData.Event.ProductCompany, output);
}
if (!string.IsNullOrWhiteSpace(logData.Event.ProductName))
{
output.Write(",\"ProductName\":");
JsonValueFormatter.WriteQuotedJsonString(logData.Event.ProductName, output);
}
if (!string.IsNullOrWhiteSpace(logData.Event.ProductVersion))
{
output.Write(",\"ProductVersion\":");
JsonValueFormatter.WriteQuotedJsonString(logData.Event.ProductVersion, output);
}
if (!string.IsNullOrWhiteSpace(logData.Event.Severity))
{
output.Write(",\"Severity\":");
JsonValueFormatter.WriteQuotedJsonString(logData.Event.Severity, output);
}
string[] aditionalDataToBeRemoved = { "SplunkIndex", "ProductCompany", "ProductVersion", "ProcessName" };
var propertiesFiltered = logEvent.Properties.Where(p => !aditionalDataToBeRemoved.Contains(p.Key)).ToDictionary(d => d.Key, d => d.Value);
WriteProperties(propertiesFiltered, output, logEvent.Exception);
output.WriteLine(_suffix);
}
