Skip to content

Commit 492be58

Browse files
author
Donald Tregonning
authored
Merge pull request #100 from cloudfoundry-community/readme-updates
Readme updates
2 parents 7b2421e + 7bf692f commit 492be58

File tree

1 file changed

+43
-98
lines changed

1 file changed

+43
-98
lines changed

‎README.md‎

Lines changed: 43 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -47,108 +47,53 @@ uaac -t member add doppler.firehose splunk-nozzle
4747
`cloud_controller.admin_read_only` will work for cf v241
4848
or later. Earlier versions should use `cloud_controller.admin` instead.
4949

50-
51-
#### Environment Parameters (declare parameters by making a copy of tools/nozzle.sh.template)
52-
53-
DEBUG -
54-
Enable debug mode (forward to standard out instead of Splunk).
55-
56-
Cloud Foundry configuration parameters:
57-
API_ENDPOINT -
58-
Cloud Foundry API endpoint address.
59-
60-
API_USER -
61-
Cloud Foundry user name. (Must have scope described above)
62-
63-
API_PASSWORD -
64-
Cloud Foundry user password.
65-
66-
Splunk configuration parameters:
67-
SPLUNK_TOKEN -
68-
[Splunk HTTP event collector token](http://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector/).
69-
70-
SPLUNK_HOST -
71-
Splunk HTTP event collector host.
72-
example: https://example.cloud.splunk.com:8088
73-
74-
SPLUNK_INDEX -
75-
The Splunk index events will be sent to.
76-
Warning: Setting an invalid index will cause events to be lost.
77-
78-
JOB_NAME -
79-
Tag nozzle log events with job name.
80-
81-
JOB_INDEX -
82-
Tag nozzle log events with job index.
83-
84-
JOB_HOST -
85-
Tag nozzle log events with job host.
86-
87-
SKIP_SSL_VALIDATION_CF -
88-
Skip SSL certificate validation for connection to CF. Secure communications will not check SSL certificates against a trusted CA Authority.
89-
(recommended for dev environments only).
90-
91-
SKIP_SSL_VALIDATION_SPLUNK -
92-
Skip SSL certificate validation for connection to Splunk. Secure communications will not check SSL certificates against a trusted CA Authority.
93-
(recommended for dev environments only).
94-
95-
FIREHOSE_SUBSCRIPTION_ID -
96-
Tag nozzle events with a firehose subscription id. (More information on - https://docs.pivotal.io/pivotalcf/1-11/loggregator/log-ops-guide.html).
97-
98-
FIREHOSE_KEEP_ALIVE -
99-
Keep Alive duration for the firehose consumer.
100-
101-
ADD_APP_INFO -
102-
Enrich raw data with app details.
103-
104-
IGNORE_MISSING_APP -
105-
If application is missing, stop repeatedly querying application info from Cloud Foundry.
106-
107-
MISSING_APP_CACHE_INVALIDATE_TTL -
108-
How frequently the missing app info cache invalidates.
109-
110-
APP_CACHE_INVALIDATE_TTL -
111-
How frequently the app info local cache invalidates.
112-
113-
APP_LIMITS -
114-
Restrict to APP_LIMITS most updated apps per request when populating the app metadata cache.
115-
116-
BOLTDB_PATH -
117-
Bolt Database path.
118-
119-
EVENTS -
120-
Comma separated list of events to include.
121-
possible values: ValueMetric,CounterEvent,Error,LogMessage,HttpStartStop,ContainerMetric
122-
123-
EXTRA_FIELDS -
124-
Extra fields you want to annotate your events with (format is key:value,key:value).
125-
126-
FLUSH_INTERVAL -
127-
Time interval for flushing queue to Splunk regardless of CONSUMER_QUEUE_SIZE. Protects against stale events in low throughput systems.
128-
129-
CONSUMER_QUEUE_SIZE -
130-
Set the internal consumer queue buffer size. Events wil be pushed to Splunk after queue is full.
131-
132-
HEC_BATCH_SIZE -
133-
Set the batch size for the events to push to HEC (Splunk HTTP Event Collector).
134-
135-
HEC_RETRIES -
136-
Retry count for sending events to Splunk. After expiring events will begin dropping causing data loss.
137-
138-
HEC_WORKERS -
139-
Set the amount of Splunk HEC workers to increase concurrency while ingesting in Splunk.
140-
141-
SPLUNK_VERSION - Splunk version will determine how metadata fields are ingested for HEC.(example: 6.6).
142-
143-
ENABLE_EVENT_TRACING -
144-
Enable event trace logging. Splunk events will now contain a UUID, Splunk Nozzle Event Count and Subscription-ID
145-
for Splunk correlation searches.
50+
- - - -
51+
#### Environment Parameters
52+
You can declare parameters by making a copy of the scripts/nozzle.sh.template.
53+
* `DEBUG`: Enable debug mode (forward to standard out instead of Splunk).
54+
55+
__Cloud Foundry configuration parameters:__
56+
* `API_ENDPOINT`: Cloud Foundry API endpoint address.
57+
* `API_USER`: Cloud Foundry user name. (Must have scope described above)
58+
* `API_PASSWORD`: Cloud Foundry user password.
59+
60+
__Splunk configuration parameters:__
61+
* `SPLUNK_TOKEN`: [Splunk HTTP event collector token](http://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector/).
62+
* `SPLUNK_HOST`: Splunk HTTP event collector host. example: https://example.cloud.splunk.com:8088
63+
* `SPLUNK_INDEX`: The Splunk index events will be sent to. Warning: Setting an invalid index will cause events to be lost. This index must match one of the selected indexes for the Splunk HTTP event collector token used for the SPLUNK_TOKEN parameter.
64+
65+
__Advanced Configuration Features:__
66+
* `JOB_NAME`: Tags nozzle log events with job name.
67+
* `JOB_INDEX`: Tags nozzle log events with job index.
68+
* `JOB_HOST`: Tags nozzle log events with job host.
69+
* `SKIP_SSL_VALIDATION_CF`: Skips SSL certificate validation for connection to Cloud Foundry. Secure communications will not check SSL certificates against a trusted certificate authority.
70+
This is recommended for dev environments only.
71+
* `SKIP_SSL_VALIDATION_SPLUNK`: Skips SSL certificate validation for connection to Splunk. Secure communications will not check SSL certificates against a trusted certificate authority.
72+
This is recommended for dev environments only.
73+
* `FIREHOSE_SUBSCRIPTION_ID`: Tags nozzle events with a Firehose subscription id. See https://docs.pivotal.io/pivotalcf/1-11/loggregator/log-ops-guide.html.
74+
* `FIREHOSE_KEEP_ALIVE`: Keep alive duration for the Firehose consumer.
75+
* `ADD_APP_INFO`: Enriches raw data with app details.
76+
* `IGNORE_MISSING_APP`: If the application is missing, then stop repeatedly querying application info from Cloud Foundry.
77+
* `MISSING_APP_CACHE_INVALIDATE_TTL`: How frequently the missing app info cache invalidates.
78+
* `APP_CACHE_INVALIDATE_TTL`: How frequently the app info local cache invalidates.
79+
* `APP_LIMITS`: Restrict to APP_LIMITS the most updated apps per request when populating the app metadata cache.
80+
* `BOLTDB_PATH`: Bolt database path.
81+
* `EVENTS`: A comma separated list of events to include. Possible values: ValueMetric,CounterEvent,Error,LogMessage,HttpStartStop,ContainerMetric
82+
* `EXTRA_FIELDS`: Extra fields to annotate your events with (format is key:value,key:value).
83+
* `FLUSH_INTERVAL`: Time interval for flushing queue to Splunk regardless of CONSUMER_QUEUE_SIZE. Protects against stale events in low throughput systems.
84+
* `CONSUMER_QUEUE_SIZE`: Sets the internal consumer queue buffer size. Events will be pushed to Splunk after queue is full.
85+
* `HEC_BATCH_SIZE`: Set the batch size for the events to push to HEC (Splunk HTTP Event Collector).
86+
* `HEC_RETRIES`: Retry count for sending events to Splunk. After expiring, events will begin dropping causing data loss.
87+
* `HEC_WORKERS`: Set the amount of Splunk HEC workers to increase concurrency while ingesting in Splunk.
88+
* `SPLUNK_VERSION`: The Splunk version that determines how HEC ingests metadata fields. For example: 6.6.
89+
* `ENABLE_EVENT_TRACING`: Enables event trace logging. Splunk events will now contain a UUID, Splunk Nozzle Event Counts, and a Subscription-ID for Splunk correlation searches.
90+
91+
- - - -
14692

14793
### Push as an App to Cloud Foundry
14894

14995
[splunk-firehose-nozzle-release](https://github.com/cloudfoundry-community/splunk-firehose-nozzle-release)
150-
packages this code into a
151-
[BOSH](https://bosh.io) release for deployment. The code could also be run on
96+
packages this code into a [BOSH](https://bosh.io) release for deployment. The code could also be run on
15297
Cloud Foundry as an application. See the **Setup** section for details
15398
on making a user and credentials.
15499

0 commit comments

Comments
 (0)