output splunk plugin: add possibility to set source with record key

[rfloyrac]

Similarly to event_sourcetype_key, add the possibility to set the splunk source from a specific key of the record.
The key is set via the config property event_source_key and takes precedence if both event_source and event_source_key are set.

The code is a pure adaptation of what was done for the event_sourcetype_key ==> aaecf64

Documentation: PR to fluent-bit-docs PR 1591

Testing
fluent-bit.config.conf: |-

[SERVICE]
  Flush        1
  Daemon       Off
  Log_Level    info

@INCLUDE fluent-bit.test-log.conf

fluent-bit.test-log.conf: |-

[INPUT]
  Name        tail
  DB           /logs/.fluentbit.test-log.db
  DB.locking   true
  Refresh_Interval 5
  read_from_head   true
  Path_Key filepath
  Static_Batch_Size 1M
  Path        /logs/test.log
  tag         test
  Threaded    true

[OUTPUT]
  Name        splunk
  Match       test
  Host        splunk-indexer.splunk
  Splunk_Token ${SPLUNK_TOKEN}
  event_index ${SPLUNK_INDEX}
  event_source source_from_output
  event_host My_pod
  event_sourcetype fluentbit
  event_key $log
  TLS         on
  TLS.Verify  off
  workers     2

[OUTPUT]
  Name        splunk
  Match       test
  Host        splunk-indexer.splunk
  Splunk_Token ${SPLUNK_TOKEN}
  event_index ${SPLUNK_INDEX}
  event_source source_from_event_source
  event_source_key $source_from_record_key
  event_host My_pod_1
  event_sourcetype fluentbit
  event_key $log
  TLS         on
  TLS.Verify  off
  workers     2

[OUTPUT]
  Name        splunk
  Match       test
  Host        splunk-indexer.splunk
  Splunk_Token ${SPLUNK_TOKEN}
  event_index ${SPLUNK_INDEX}
  event_source_key $source_from_record_key_2
  event_host My_pod_2
  event_sourcetype fluentbit
  event_key $log
  TLS         on
  TLS.Verify  off
  workers     2

[FILTER]
  Name record_modifier
  Match *
  Record source_from_record_key source_from_record_key
  Record source_from_record_key_2 source_from_record_key_2

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

[rfloyrac]

filter_rewrite_tag.c:354: Check heavy_loop > got... failed
expect: 100000 got: 100000

hmm not sure what to say :D

[github-actions]

This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[eschabell]

@rfloyrac any plans to work on this to resolve the errors?

[github-actions]

This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.