From 85ee3542556fce8129969d333a3f8de4c54a6fe8 Mon Sep 17 00:00:00 2001
From: Lance O'Connor <lance@ronnoco.net>
Date: Wed, 21 Nov 2018 17:43:42 -0800
Subject: [PATCH] Fix boolean handling in splunkmetric serializer (#5008)

---
 .../serializers/splunkmetric/splunkmetric.go  | 28 +++++++++----
 .../splunkmetric/splunkmetric_test.go         | 40 +++++++++++++++++++
 2 files changed, 61 insertions(+), 7 deletions(-)

diff --git a/plugins/serializers/splunkmetric/splunkmetric.go b/plugins/serializers/splunkmetric/splunkmetric.go
index 01643e334..cdcf6cc59 100644
--- a/plugins/serializers/splunkmetric/splunkmetric.go
+++ b/plugins/serializers/splunkmetric/splunkmetric.go
@@ -68,14 +68,16 @@ func (s *serializer) createObject(metric telegraf.Metric) (metricGroup []byte, e
 
 	for _, field := range metric.FieldList() {
 
-		if !verifyValue(field.Value) {
+		value, valid := verifyValue(field.Value)
+
+		if !valid {
 			log.Printf("D! Can not parse value: %v for key: %v", field.Value, field.Key)
 			continue
 		}
 
 		obj := map[string]interface{}{}
 		obj["metric_name"] = metric.Name() + "." + field.Key
-		obj["_value"] = field.Value
+		obj["_value"] = value
 
 		dataGroup.Event = "metric"
 		// Convert ns to float seconds since epoch.
@@ -94,8 +96,6 @@ func (s *serializer) createObject(metric telegraf.Metric) (metricGroup []byte, e
 				dataGroup.Fields[n] = t
 			}
 		}
-		dataGroup.Fields["metric_name"] = metric.Name() + "." + field.Key
-		dataGroup.Fields["_value"] = field.Value
 
 		switch s.HecRouting {
 		case true:
@@ -117,10 +117,24 @@ func (s *serializer) createObject(metric telegraf.Metric) (metricGroup []byte, e
 	return metricGroup, nil
 }
 
-func verifyValue(v interface{}) bool {
+func verifyValue(v interface{}) (value interface{}, valid bool) {
 	switch v.(type) {
 	case string:
-		return false
+		valid = false
+		value = v
+	case bool:
+		if v == bool(true) {
+			// Store 1 for a "true" value
+			valid = true
+			value = 1
+		} else {
+			// Otherwise store 0
+			valid = true
+			value = 0
+		}
+	default:
+		valid = true
+		value = v
 	}
-	return true
+	return value, valid
 }
diff --git a/plugins/serializers/splunkmetric/splunkmetric_test.go b/plugins/serializers/splunkmetric/splunkmetric_test.go
index f3825d803..04f6e6538 100644
--- a/plugins/serializers/splunkmetric/splunkmetric_test.go
+++ b/plugins/serializers/splunkmetric/splunkmetric_test.go
@@ -97,6 +97,46 @@ func TestSerializeMetricIntHec(t *testing.T) {
 	assert.Equal(t, string(expS), string(buf))
 }
 
+func TestSerializeMetricBool(t *testing.T) {
+	now := time.Unix(0, 0)
+	tags := map[string]string{
+		"container-name": "telegraf-test",
+	}
+	fields := map[string]interface{}{
+		"oomkiller": bool(true),
+	}
+	m, err := metric.New("docker", tags, fields, now)
+	assert.NoError(t, err)
+
+	s, _ := NewSerializer(false)
+	var buf []byte
+	buf, err = s.Serialize(m)
+	assert.NoError(t, err)
+
+	expS := `{"_value":1,"container-name":"telegraf-test","metric_name":"docker.oomkiller","time":0}`
+	assert.Equal(t, string(expS), string(buf))
+}
+
+func TestSerializeMetricBoolHec(t *testing.T) {
+	now := time.Unix(0, 0)
+	tags := map[string]string{
+		"container-name": "telegraf-test",
+	}
+	fields := map[string]interface{}{
+		"oomkiller": bool(false),
+	}
+	m, err := metric.New("docker", tags, fields, now)
+	assert.NoError(t, err)
+
+	s, _ := NewSerializer(true)
+	var buf []byte
+	buf, err = s.Serialize(m)
+	assert.NoError(t, err)
+
+	expS := `{"time":0,"event":"metric","fields":{"_value":0,"container-name":"telegraf-test","metric_name":"docker.oomkiller"}}`
+	assert.Equal(t, string(expS), string(buf))
+}
+
 func TestSerializeMetricString(t *testing.T) {
 	now := time.Unix(0, 0)
 	tags := map[string]string{