/// <summary>
/// Write events using EventStreamWriter
/// </summary>
// This method can be used by manual testing thus is public
public static void WriteEvents()
{
using (var writer = new EventStreamWriter())
{
var eventTemplate = new EventElement
{
Index = "sdk-tests2",
Host = "test host",
SourceType = "test sourcetype",
Source = "test source",
};
WriteEventData(
writer,
eventTemplate,
"Event with all default fields set");
WriteEventData(
writer,
eventTemplate,
"Letter O with double acute: \u0150");
eventTemplate.Unbroken = true;
WriteEventData(
writer,
eventTemplate,
"Part 1 of an unbroken event ");
WriteEventData(
writer,
eventTemplate,
"Part 2 of an unbroken event ending with newline" + Environment.NewLine);
WriteEventDone(
writer,
eventTemplate);
eventTemplate.Unbroken = false;
WriteEventData(
writer,
eventTemplate,
"Event after done key");
var timedEvent = eventTemplate;
timedEvent.Time = new DateTime(2013, 1, 1, 0, 0, 0, DateTimeKind.Utc);
timedEvent.Data = "Event with fixed time";
writer.Write(timedEvent);
WriteMultiplex(writer);
}
}
/// <summary>
/// Write a done key
/// </summary>
/// <param name="writer">An event writer</param>
/// <param name="eventTemplate">An event template</param>
private static void WriteEventDone(EventStreamWriter writer, EventElement eventTemplate)
{
var @event = eventTemplate;
@event.Unbroken = false;
@event.Done = true;
writer.Write(@event);
}
/// <summary>
/// Write for multiple stanzas
/// </summary>
/// <param name="writer">An event writer</param>
private static void WriteMultiplex(EventStreamWriter writer)
{
var eventTemplate1 = new EventElement
{
Stanza = "modular_input://UnitTest1",
Unbroken = true,
};
var eventTemplate2 = new EventElement
{
Stanza = "modular_input://UnitTest2",
Unbroken = true,
};
WriteEventDataLine(writer, eventTemplate1, "Part 1 of channel 1 with a newline");
WriteEventData(writer, eventTemplate2, "Part 1 of channel 2 without a newline ");
// Mark the first channel done.
WriteEventDone(writer, eventTemplate1);
WriteEventDataLine(writer, eventTemplate1, "Part 2 of channel 1 with a newline");
WriteEventDataLine(writer, eventTemplate2, "Part 2 of channel 2 with a newline");
// Mark the second channel done.
WriteEventDone(writer, eventTemplate2);
}
/// <summary>
/// Write event data without appending a newline seperator.
/// </summary>
/// <param name="writer">An event writer</param>
/// <param name="eventTemplate">An event template</param>
/// <param name="eventData">Event data</param>
private static void WriteEventData(EventStreamWriter writer, EventElement eventTemplate, string eventData)
{
var @event = eventTemplate;
@event.Data = eventData;
writer.Write(@event);
}
/// <summary>
/// Write an event data line.
/// </summary>
/// <param name="writer">An event writer</param>
/// <param name="eventTemplate">An event template</param>
/// <param name="eventData">Event data</param>
private static void WriteEventDataLine(
EventStreamWriter writer,
EventElement eventTemplate,
string eventData)
{
WriteEventData(
writer,
eventTemplate,
eventData + Environment.NewLine);
}
/// <summary>
/// Streams the events.
/// </summary>
/// <param name="inputDefinition">The input definition.</param>
public override void StreamEvents(InputDefinition inputDefinition)
{
string tailFilters = inputDefinition.Stanza.SingleValueParameters.GetValueOrDefault("tailfilterproperty","");
string filter = inputDefinition.Stanza.SingleValueParameters.GetValueOrDefault("filter", "");
string address = inputDefinition.Stanza.SingleValueParameters["address"];
string store = string.Empty;
string last = string.Empty;
bool tail = !string.IsNullOrEmpty(tailFilters);
if (tail)
{
store = Path.Combine(inputDefinition.CheckpointDirectory, "lastvalue.txt");
last = File.Exists(store)
? File.ReadAllText(store) // .Split('\n')
: inputDefinition.Stanza.SingleValueParameters.GetValueOrDefault("defaulttailfilter",""); //.Split('\n');
if (!string.IsNullOrEmpty(filter))
{
filter = string.Format(filter, last);
}
else
{
address = string.Format(address, last);
}
}
IEnumerable<IDictionary<string, object>> source = new Splunk.ODataSource()
{
Credentials = System.Net.CredentialCache.DefaultNetworkCredentials,
Address = address,
Resource = inputDefinition.Stanza.SingleValueParameters.GetValueOrDefault("resource",""),
Filter = filter,
//OrderBy = inputDefinition.Stanza.MultiValueParameterXmlElements,
//Select = inputDefinition.Stanza.MultiValueParameterXmlElements,
};
string includeEmptyString;
bool includeEmpty = false;
if(inputDefinition.Stanza.SingleValueParameters.TryGetValue("includeEmpty", out includeEmptyString)) {
bool.TryParse(includeEmptyString, out includeEmpty);
}
using (var writer = new EventStreamWriter())
{
foreach (IDictionary<string, object> item in source)
{
writer.Write(new EventElement
{
Data = item.ToString(includeEmpty: includeEmpty),
Stanza = inputDefinition.Stanza.Name,
});
if (tail)
{
last = ((IDictionary) item).SelectRecursive(tailFilters.Split(',')).ToStringInvariant();
}
}
if (tail)
{
using (var stream = File.Open(store, FileMode.Create, FileAccess.Write))
{
using (var storeWriter = new StreamWriter(stream))
{
storeWriter.WriteLine(last);
}
}
}
}
}
/// <summary>
/// Stream events into stdout
/// </summary>
/// <param name="inputDefinition">Input definition from Splunk</param>
public override void StreamEvents(InputDefinition inputDefinition)
{
string lastVarValue = null;
using (var writer = new EventStreamWriter())
{
var stanza = inputDefinition.Stanza;
// Gets input name. It is also the env var name.
const string Seperator = @"://";
var indexInputName = stanza.Name.IndexOf(Seperator) + Seperator.Length;
var varName = stanza.Name.Substring(indexInputName);
SystemLogger.Write(
string.Format(
"Name of the var to monitor is : {0}",
varName));
var interval = 1000;
string intervalParam;
if (stanza.SingleValueParameters.TryGetValue(
PollingInterval,
out intervalParam))
{
interval = int.Parse(intervalParam);
}
SystemLogger.Write(
string.Format(
"Polling interval is : {0}",
interval));
while (true)
{
var varValue = Environment.GetEnvironmentVariable(
varName,
EnvironmentVariableTarget.Machine);
// Event data can't be null for real events.
varValue = varValue ?? "(not exist)";
// Splunk does not record lines with only white spaces.
varValue = string.IsNullOrWhiteSpace(varValue)
? "(white space)"
: varValue;
if (varValue != lastVarValue)
{
writer.Write(
new EventElement
{
Source = varName,
Data = varValue,
});
lastVarValue = varValue;
}
Thread.Sleep(interval);
}
}
}
/// <summary>
/// Write event data without appending a newline seperator.
/// </summary>
/// <param name="writer">An event writer</param>
/// <param name="eventTemplate">An event template</param>
/// <param name="eventData">Event data</param>
static async Task WriteEventData(EventStreamWriter writer, EventElement eventTemplate, string eventData)
{
var @event = eventTemplate;
@event.Data = eventData;
await writer.WriteEventAsync(@event);
}
/// <summary>
/// Write an event data line.
/// </summary>
/// <param name="writer">An event writer</param>
/// <param name="eventTemplate">An event template</param>
/// <param name="eventData">Event data</param>
static async Task WriteEventDataLine(
EventStreamWriter writer,
EventElement eventTemplate,
string eventData)
{
await WriteEventData(
writer,
eventTemplate,
eventData + Environment.NewLine);
}
/// <summary>
/// Write a done key
/// </summary>
/// <param name="writer">An event writer</param>
/// <param name="eventTemplate">An event template</param>
static async Task WriteEventDone(EventStreamWriter writer, EventElement eventTemplate)
{
var @event = eventTemplate;
@event.Unbroken = false;
@event.Done = true;
await writer.WriteEventAsync(@event);
}