Module tencent_cloud_cls 

Tencent Cloud CLS (Cloud Log Service) access-logger (tencent-cloud-cls).

Ships access-log entries to Tencent Cloud’s Log Service. Each request builds one log entry (the shared build_entry shape, or a custom log_format) that is handed to a fire-and-forget BatchSink; a background task POSTs batches to the CLS /structuredlog upload endpoint, signed with the CLS/COS-style q-sign-algorithm=sha1 Authorization header.

The signature is ported faithfully from APISIX’s cls-sdk.lua sign(): sign_key = hex(hmac_sha1(secret_key, sign_time)), then signature = hex(hmac_sha1(sign_key, string_to_sign)), where string_to_sign = "sha1\n<sign_time>\n<sha1(http_request_info)>\n" and http_request_info = "post\n/structuredlog\n\n\n". See https://cloud.tencent.com/document/product/614/12445.

Deviations from APISIX

• JSON body, not protobuf. The CLS SDK serializes the LogGroupList with protobuf and sends application/x-protobuf. featherbit has no protobuf codec, so it sends the equivalent structured-log payload as JSON (application/json): each entry is normalized to a list of {key, value} contents (non-string values JSON-encoded), grouped into one LogGroup. The signature, endpoint, topic query parameter, and log normalization are otherwise faithful. Against a live CLS endpoint the protobuf content type would be required; this is documented as a subset.
• source omitted. The SDK sets each LogGroup.source to the host IP; featherbit does not resolve its own IP and leaves it empty.

The signing helper and its primitives (SHA-1, HMAC-SHA1) are unit-tested against fixed vectors.

Structs

ClsFlusher 🔒

Delivers batches to the CLS /structuredlog endpoint.

TencentCloudClsPlugin

Node that batches access-log entries and ships them to Tencent Cloud CLS.

Constants

AUTH_EXPIRE_SECS 🔒

CLS_API_PATH 🔒

Functions

build_log_payload 🔒

Builds the CLS structured-log payload: one LogGroup whose logs carry the normalized {key, value} contents of each entry. Pure and network-free for testing.

hmac_sha1_hex 🔒

Lowercase hex HMAC-SHA1 (str_util.to_hex(ngx_hmac_sha1(key, msg))).

required_string 🔒

sha1_hex 🔒

Lowercase hex SHA-1 (str_util.to_hex(ngx_sha1_bin(msg))).

sign 🔒

Builds the CLS Authorization header value for the current time. Faithful port of cls-sdk.lua’s sign(). cur_time (Unix seconds) is injected so the signature is unit-testable.

string_alias 🔒

stringify 🔒

CLS content.value is a string; keep strings as-is, JSON-encode the rest.

to_hex 🔒