When using splunkmetic serializer with vsphere input, source is not allowed to be overridden

[dgshue]

Bug/Feature Request

When using the splunkmetric serializer with vsphere input, vsphere input adds a tag of "source" which is later interpreted as a the splunk "source" in the payload. This should be allowed to be overridden using tags.

Additionally, the splunkmetic serializer does not include "sourcetype" as an included field in the payload. Would like to add this as a tag.

Opening a feature request kicks off a discussion.

Proposal:

Add SourceType as part of the HECTimeSeries struct and allow to be changed as a tag to the input or global_tags.

Suggest changing the splunkmetric to look for specific named tags for the serializer instead of something generic as "source" or "sourcetype" to "splunkmetric_source" and "splunkmetric_sourcetype".

Current behavior:

Adding tags to vsphere input as follows:

[inputs.vsphere.tags]

host = "overide.host.com"
index = "telegraf_metrics"
sourcetype = "its:esx:metrics"
source = "telegraf_agent"

Outputs JSON:

{
"time":1551372240,
"event":"metric",
"host":"overide.host.com",
"index":"telegraf_metrics",
"source":"VMSERVERNAME",
"fields":{
"_value":0,
"clustername":"CLUSTER",
"dcname":"DCNAME",
"disk":"DISKID",
"esxhostname":"HOSTNAME",
"guest":"GUESTOS",
"metric_name":"METRICNAME",
"moid":"VMID",
"uuid":"UUID",
"vcenter":"VCENTERNAME",
"vmname":"VMNAME"
}
}

Desired behavior:

Adding tags to vsphere input as follows:

[inputs.vsphere.tags]

splunkmetric_host = "overide.host.com"
splunkmetric_index = "telegraf_metrics"
splunkmetric_sourcetype = "its:esx:metrics"
splunkmetric_source = "telegraf_agent"

Outputs JSON:

{
"time":1551372240,
"event":"metric",
"host":"overide.host.com",
"index":"telegraf_metrics",
"source":"telegraf_agent",
"sourcetype":"its:esx:metrics",
"fields":{
"_value":0,
"clustername":"CLUSTER",
"dcname":"DCNAME",
"disk":"DISKID",
"esxhostname":"HOSTNAME",
"guest":"GUESTOS",
"metric_name":"METRICNAME",
"moid":"VMID",
"uuid":"UUID",
"vcenter":"VCENTERNAME",
"vmname":"VMNAME"
}
}

Use case: [Why is this important (helps with prioritizing requests)]

These values can be statically set via the Splunk HEC token, however, this doesn't scale well. I would expect to have one HTTP output with one Token that could collect metrics from multiple sources.

[danielnelson]

This seems like another issue that could be helped by #3362. If you used the override processor to set these tags on some or all metrics would that solve your issue?

[dgshue]

Yes I believe this is the same problem. This could resolve the "bug" issue but not the sourcetype. See pull request.

#5504

[sspaink]

Closing as there hasn't been any activity in this issue for quite some time and the associated pull request was closed as well due to no activity.