From a0d98a62b0b7005b62919d00215c45c63bd1a1fa Mon Sep 17 00:00:00 2001 From: Jeroen Date: Wed, 18 Oct 2023 15:12:50 +0200 Subject: [PATCH] Updated --- EonaCat.Logger/Managers/LogHelper.cs | 32 +++++------ EonaCat.Logger/Splunk/Models/SplunkPayload.cs | 13 +++++ EonaCat.Logger/Splunk/SplunkServer.cs | 56 ++++++++++++++++++- 3 files changed, 82 insertions(+), 19 deletions(-) create mode 100644 EonaCat.Logger/Splunk/Models/SplunkPayload.cs diff --git a/EonaCat.Logger/Managers/LogHelper.cs b/EonaCat.Logger/Managers/LogHelper.cs index d6c02c6..f5ca71d 100644 --- a/EonaCat.Logger/Managers/LogHelper.cs +++ b/EonaCat.Logger/Managers/LogHelper.cs @@ -7,8 +7,10 @@ using System.Text; using System.Threading.Tasks; using System.Xml.Linq; using EonaCat.Json; +using EonaCat.Json.Linq; using EonaCat.Logger.Extensions; using EonaCat.Logger.GrayLog; +using EonaCat.Logger.Splunk.Models; using EonaCat.Logger.Syslog; using Microsoft.Extensions.Logging; @@ -136,9 +138,9 @@ namespace EonaCat.Logger.Managers logger.Log(logLevel, message); } - public static async Task SendToSplunkServersAsync(LoggerSettings settings, string jsonPayload, bool sendToSplunkServer) + public static async Task SendToSplunkServersAsync(LoggerSettings settings, SplunkPayload splunkPayload, bool sendToSplunkServer) { - if (settings == null || !sendToSplunkServer || string.IsNullOrWhiteSpace(jsonPayload)) + if (settings == null || !sendToSplunkServer || splunkPayload == null) return; if (settings.SplunkServers == null) @@ -165,17 +167,11 @@ namespace EonaCat.Logger.Managers { try { - using (var httpClient = new HttpClient(splunkServer.SplunkClientHandler)) + var response = await splunkServer.SendAsync(splunkPayload); + + if (!response.IsSuccessStatusCode) { - var content = new StringContent(jsonPayload, Encoding.UTF8, "application/json"); - httpClient.DefaultRequestHeaders.Add("Authorization", $"Splunk {splunkServer.SplunkHecToken}"); - - var response = await httpClient.PostAsync(splunkServer.SplunkHecUrl, content); - - if (!response.IsSuccessStatusCode) - { - OnException?.Invoke(null, new ErrorMessage { Message = $"Failed to send log to Splunk '{splunkServer.SplunkHecUrl}'. Status code: {response.StatusCode}" }); - } + OnException?.Invoke(null, new ErrorMessage { Message = $"Failed to send log to Splunk '{splunkServer.SplunkHecUrl}'. Status code: {response.StatusCode}" }); } } catch (Exception exception) @@ -191,12 +187,14 @@ namespace EonaCat.Logger.Managers if (settings == null || !sendToSplunkServer || string.IsNullOrWhiteSpace(message)) return; - var jsonPayload = JsonHelper.ToJson(new + var splunkPayload = new SplunkPayload { - @event = message, - sourcetype = logType - }); - await SendToSplunkServersAsync(settings, jsonPayload, sendToSplunkServer); + Host = Environment.MachineName, + EventData = message, + SourceType = logType + }; + + await SendToSplunkServersAsync(settings, splunkPayload, sendToSplunkServer); } internal static async Task SendToGrayLogServersAsync(LoggerSettings settings, string message, ELogType logLevel, string facility, string source, bool sendToGrayLogServer, string version = "1.1") diff --git a/EonaCat.Logger/Splunk/Models/SplunkPayload.cs b/EonaCat.Logger/Splunk/Models/SplunkPayload.cs new file mode 100644 index 0000000..c10d7e6 --- /dev/null +++ b/EonaCat.Logger/Splunk/Models/SplunkPayload.cs @@ -0,0 +1,13 @@ +using System; +using System.Collections.Generic; +using System.Text; + +namespace EonaCat.Logger.Splunk.Models +{ + public class SplunkPayload + { + public string EventData { get; set; } + public string SourceType { get; set; } + public string Host { get; set; } + } +} diff --git a/EonaCat.Logger/Splunk/SplunkServer.cs b/EonaCat.Logger/Splunk/SplunkServer.cs index 4527526..4f44b81 100644 --- a/EonaCat.Logger/Splunk/SplunkServer.cs +++ b/EonaCat.Logger/Splunk/SplunkServer.cs @@ -1,5 +1,12 @@ -using System; +using EonaCat.Json; +using EonaCat.Logger.Splunk.Models; +using System; +using System.Net; using System.Net.Http; +using System.Net.Security; +using System.Text; +using System.Threading; +using System.Threading.Tasks; namespace EonaCat.Logger.SplunkServer { @@ -49,9 +56,10 @@ namespace EonaCat.Logger.SplunkServer } public HttpClientHandler SplunkClientHandler { get; internal set; } + public HttpClient HttpClient { get; private set; } internal readonly object SendLock = new object(); - private string _splunkHecUrl = "https://127.0.0.1:8088/services/collector"; + private string _splunkHecUrl = "https://127.0.0.1:8088/services/collector/event"; private string _splunkHecToken = "splunk-hec-token"; public bool HasHecToken => !string.IsNullOrWhiteSpace(SplunkHecToken) && SplunkHecToken != "splunk-hec-token"; @@ -78,6 +86,16 @@ namespace EonaCat.Logger.SplunkServer } SplunkClientHandler = httpClientHandler; + CreateHttpClient(); + } + + private void CreateHttpClient() + { + HttpClient = new HttpClient(SplunkClientHandler); + HttpClient.BaseAddress = new Uri(SplunkHecUrl); + + // Add the HEC token to the request headers for authorization + HttpClient.DefaultRequestHeaders.Add("Authorization", $"Splunk {SplunkHecToken}"); } /// @@ -90,7 +108,41 @@ namespace EonaCat.Logger.SplunkServer { ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true, }; + SplunkClientHandler = clientHandler; + CreateHttpClient(); + } + + public async Task SendAsync(SplunkPayload splunkPayload) + { + if (splunkPayload == null) + { + return null; + } + + // Create an event object with the required fields + var eventObject = new + { + @event = splunkPayload.EventData, + sourcetype = splunkPayload.SourceType, + host = splunkPayload.Host + }; + + // Serialize the event object to JSON + string eventJson = JsonHelper.ToJson(eventObject); + + if (!HasHecToken) + { + CreateHttpClient(); + } + + // Create an HTTP content with the event data + var content = new StringContent(eventJson, Encoding.UTF8, "application/json"); + + // Send the event to Splunk + HttpResponseMessage response = await HttpClient.PostAsync("/services/collector/event", content); + + return response; } } }