in_splunk is not replying with the expected ok message about fluent-bit HOT 3 CLOSED

thanks for reporting this. it has been assigned

from fluent-bit.

For providing an option to turn on/off and turned off by default, this issue could be resolved. However, if using the curl with enabled HTTP2, we need to implement another mechanism to return back the response during the HTTP2 connections. I'm jumping on it.

from fluent-bit.

I checked the curl code and I found that:

/* On HTTP 1.1, when connection is not to get closed, but no
Content-Length nor Transfer-Encoding chunked have been
received, according to RFC2616 section 4.4 point 5, we
assume that the server will close the connection to
signal the end of the document. */

Sited from: https://github.com/curl/curl/blob/9acf759455f96636bc2132339fc53f4094957be7/lib/http.c#L3494-L3506

This indicates that in_http always closes its connections because just returning HTTP status code and no body. This leads to disconnect HTTP connections on in_http plugin as per RFC2616 section 4.4 point 5.

ref: https://datatracker.ietf.org/doc/html/rfc2616#section-4.4

By contrast, in_splunk should be needed to return some of the body which mustn't be an empty.
So, curl itself always assumed that this connection shouldn't be closed when enabling keepalive.

Therefore, if we need to restore the previous behavior, we need to provide an option to turn on/off keepalive instead of always turned on.

from fluent-bit.