[SplunkHecReceiver] Allows users to disable line breaking for Raw endpoint

[splunkericl]

Component(s)

receiver/splunkhec

Is your feature request related to a problem? Please describe.

The HEC receiver handleRaw method uses a bufio Scanner that uses the default splitFunc. As an user of splunk hec receiver, I want an option to configure the bufio Scanner to disable line breaking functionality.

Background

Our team has much more extensive line breaking functionality(and will need to support more) so we want to handle line breaking inside our processor. If the events are line broken already at the receiver, our processor can't properly line break.

• an example is if the event abc\r\n\r\nefg comes in, the user might want to configure to split based on \r\n\r\n but bufio scanner would behave differently.

So instead, we want line breaking to be disabled in receiver all completely.

Describe the solution you'd like

We want to add an option in the config to disable line breaking completely. So the whole raw event will be sent as one single log record.

Add an option in splunkhecreceiver:

type Config struct {
    DisableLineBreaking bool
}

inside handleRaw method:

var neverSplitFunc = func(data []byte, atEOF bool) (int, []byte, error) {
	if atEOF {
		return len(data), data, nil
	}
	return 0, nil, nil
}

sc := bufio.NewScanner(bodyReader)
if c.DisableLineBreaking {
    sc.Split(neverSplitFunc)
}

Describe alternatives you've considered

N/A

Additional context

No response

[github-actions]

Pinging code owners:

• receiver/splunkhec: @atoulme

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[atoulme]

Understood. Is a boolean flag the right config or would you foresee different line breaking strategies?

It looks like you answered the question actually - I'll work on this now.