Named tokens for splunk_hec source

[ellull]

I'm using the splunk_hec source to ingest logs from external services. For every service I want to create a distinct token and I want to enrich the log event with the name of the service.

I know that seting the store_hec_token to true, the enriching remap component can access the received token by get_secret("splunk_hec_token"). But in order to compare the recived token with the configured one I have to use something like:

if get_secret("splunk_hec_token") == "SECRET[splunk_tokens.service1]" {
  .app = "service1"
} else if get_secret("splunk_hec_token") == "SECRET[splunk_tokens.service2]" {
  .app = "service2"
}

I wondered if it could be possible to change/extend the source configuration with "named tokens" so it could simplified. Let me explain what I mean.

Lets say we could use a list of key/value pairs to configure the tokens where the key is the token value and the value is the token name:

sources:
  splunk:
    type: splunk_hec
    address: 0.0.0.0:8088
    valid_tokens: # This changes from a list of tokens to a list of key/value pairs
      "SECRET[splunk_tokens.service1]": service1
      "SECRET[splunk_tokens.service2]": service2

With this configuration, the splunk_hec source sets some atribute on the event or on its metadata with the name of the received token. Lets suppose that we name it %splunk_hec.token_name

Then, the remaping code could be simplified to:

.app = %splunk_hec.token_name

Also, we could use the token names in the actual code without being a security risk:

if %splunk_hec.token_name == "service1" {  # service1 is not a sensible string.
  ...
}

Using the name as the value would allow to do rolling rotation of tokens: temporarily we could configure two tokens with the same name while we rotate the token in the external service.

What do you all think about this?