From f25936b79630446c48e6fa67ab1a2c2aca0aa44d Mon Sep 17 00:00:00 2001 From: Alex Samorukov Date: Tue, 5 May 2020 20:12:21 +0200 Subject: [PATCH] Add information about HEC JSON format limitations and workaround (#7459) --- plugins/serializers/splunkmetric/README.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/plugins/serializers/splunkmetric/README.md b/plugins/serializers/splunkmetric/README.md index 96049e45f..acd497dbc 100644 --- a/plugins/serializers/splunkmetric/README.md +++ b/plugins/serializers/splunkmetric/README.md @@ -165,3 +165,22 @@ An example configuration of a file based output is: splunkmetric_hec_routing = false splunkmetric_multimetric = true ``` + +## Non-numeric metric values + +Splunk supports only numeric field values, so serializer would silently drop metrics with the string values. For some cases it is possible to workaround using ENUM processor. Example, provided below doing this for the `docker_container_health.health_status` metric: + +```toml +# splunkmetric does not support sting values +[[processors.enum]] + namepass = ["docker_container_health"] + [[processors.enum.mapping]] + ## Name of the field to map + field = "health_status" + [processors.enum.mapping.value_mappings] + starting = 0 + healthy = 1 + unhealthy = 2 + none = 3 +``` +