diff --git a/changelog.d/add_default_fallback_index_google_chronicle_sink.enhancement.md b/changelog.d/add_default_fallback_index_google_chronicle_sink.enhancement.md new file mode 100644 index 0000000000000..04d2a76a82937 --- /dev/null +++ b/changelog.d/add_default_fallback_index_google_chronicle_sink.enhancement.md @@ -0,0 +1,3 @@ +Add an option to Google Chronicle sink to set a fallback index if the provided template in the `log_type` field cannot be resolved + +authors: ArunPiduguDD diff --git a/src/sinks/gcp_chronicle/chronicle_unstructured.rs b/src/sinks/gcp_chronicle/chronicle_unstructured.rs index 2c30b157ec194..537ce9dde6f68 100644 --- a/src/sinks/gcp_chronicle/chronicle_unstructured.rs +++ b/src/sinks/gcp_chronicle/chronicle_unstructured.rs @@ -237,6 +237,10 @@ pub struct ChronicleUnstructuredConfig { #[configurable(metadata(docs::examples = "WINDOWS_DNS", docs::examples = "{{ log_type }}"))] pub log_type: Template, + /// The default `log_type` to attach to events if the template in `log_type` cannot be resolved. + #[configurable(metadata(docs::examples = "VECTOR_DEV"))] + pub fallback_log_type: Option, + #[configurable(derived)] #[serde( default, @@ -261,6 +265,7 @@ impl GenerateConfig for ChronicleUnstructuredConfig { namespace = "namespace" compression = "gzip" log_type = "log_type" + fallback_log_type = "VECTOR_DEV" encoding.codec = "text" "#}) .unwrap() @@ -355,6 +360,7 @@ impl ChronicleUnstructuredConfig { fn partitioner(&self) -> crate::Result { Ok(ChroniclePartitioner::new( self.log_type.clone(), + self.fallback_log_type.clone(), self.namespace.clone(), )) } diff --git a/src/sinks/gcp_chronicle/partitioner.rs b/src/sinks/gcp_chronicle/partitioner.rs index 35ee79cf96f0f..24181a458d9c2 100644 --- a/src/sinks/gcp_chronicle/partitioner.rs +++ b/src/sinks/gcp_chronicle/partitioner.rs @@ -9,11 +9,23 @@ pub struct ChroniclePartitionKey { } /// Partitions items based on the generated key for the given event. -pub struct ChroniclePartitioner(Template, Option