Add information about HEC JSON format limitations and workaround (#7459)

This commit is contained in:
Alex Samorukov 2020-05-05 20:12:21 +02:00 committed by GitHub
parent 53c86890af
commit f25936b796
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 0 deletions

View File

@ -165,3 +165,22 @@ An example configuration of a file based output is:
splunkmetric_hec_routing = false splunkmetric_hec_routing = false
splunkmetric_multimetric = true splunkmetric_multimetric = true
``` ```
## Non-numeric metric values
Splunk supports only numeric field values, so serializer would silently drop metrics with the string values. For some cases it is possible to workaround using ENUM processor. Example, provided below doing this for the `docker_container_health.health_status` metric:
```toml
# splunkmetric does not support sting values
[[processors.enum]]
namepass = ["docker_container_health"]
[[processors.enum.mapping]]
## Name of the field to map
field = "health_status"
[processors.enum.mapping.value_mappings]
starting = 0
healthy = 1
unhealthy = 2
none = 3
```