New morpheus stackstorm integration pack

[xod442]

Pack for Morpheus

[CLAassistant]

All committers have signed the CLA.

[cognifloyd]

I'm not sure about including the morpheus=>splunk workflow in this pack because I expect packs to focus on only one service. In any case, here's some feedback on that workflow + actions:

Passing around all of the logs like that could be resource intensive (eg the workflow context gets copied multiple times and it includes input parameters).

Maybe you could use the action_service to store an ID in the datastore: https://docs.stackstorm.com/actions.html#action-service So, in an action you

• retrieve the last ID that you sent to splunk from the datastore,
• loop through the new logs until you find the ID after the last ID sent,
• send the remaining log entries
• save a new last ID in the datastore

Also, to avoid passing large amounts of data via action input params, I would probably try to combine your actions. So, you could have one python action that:

• gets logs from morpheus (yes, in addition to the get_logs action - it can reuse the morpheus API bits)
• gets the last ID from the datastore
• ships the new log entries to splunk
• save the new last ID in the datastore

That also has the benefit of simplifying the configuration so you don't need to know how to connect to mongo.

Another thought: You can extend the get_logs action with something like an after_id input parameter. Then inside the action it would filter the logs and only return log entries after that ID.