def write(chunk)
      body = ''
      chunk.msgpack_each {|(tag,time,record)|

        # define index and sourcetype dynamically
        begin
          index = expand_param(@index, tag, time, record)
          sourcetype = expand_param(@sourcetype, tag, time, record)
          event_host = expand_param(@event_host, tag, time, record)
          token = expand_param(@token, tag, time, record)
        rescue => e
          # handle dynamic parameters misconfigurations
          router.emit_error_event(tag, time, record, e)
          next
        end
        log.debug "routing event from #{event_host} to #{index} index"
        log.debug "expanded token #{token}"

        # Parse record to Splunk event format
        case record
        when Integer
          event = record.to_s
        when Hash
          if @send_event_as_json
            event = record.to_json
          else
            event = record.to_json.gsub("\"", %q(\\\"))
          end
        else
          event = record
        end

        sourcetype = @sourcetype == 'tag' ? tag : @sourcetype

        # Build body for the POST request
        if !@usejson
          event = record["time"]+ " " + record["message"].to_json.gsub(/^"|"$/,"")
          body << '{"time":"'+ DateTime.parse(record["time"]).strftime("%Q") +'", "event":"' + event + '", "sourcetype" :"' + sourcetype + '", "source" :"' + @source + '", "index" :"' + index + '", "host" : "' + event_host + '"}'
        elsif @send_event_as_json
          body << '{"time" :' + time.to_s + ', "event" :' + event + ', "sourcetype" :"' + sourcetype + '", "source" :"' + source + '", "index" :"' + index + '", "host" : "' + event_host + '"}'
        else
          body << '{"time" :' + time.to_s + ', "event" :"' + event + '", "sourcetype" :"' + sourcetype + '", "source" :"' + source + '", "index" :"' + index + '", "host" : "' + event_host + '"}'
        end

        if @send_batched_events
          body << "\n"
        else
          send_to_splunk(body, token)
          body = ''
        end
      }

      if @send_batched_events
        send_to_splunk(body, token)
      end
    end
def write(chunk)
      body = ''
      chunk.msgpack_each {|(tag,time,record)|

        # define index and sourcetype dynamically
        begin
          index = expand_param(@index, tag, time, record)
          sourcetype = expand_param(@sourcetype, tag, time, record)
          event_host = expand_param(@event_host, tag, time, record)
          token = expand_param(@token, tag, time, record)
        rescue => e
          # handle dynamic parameters misconfigurations
          router.emit_error_event(tag, time, record, e)
          next
        end
        log.debug "routing event from #{event_host} to #{index} index"
        log.debug "expanded token #{token}"

        # Parse record to Splunk event format
        case record
        when Integer
          event = record.to_s
        when Hash
          if @send_event_as_json
            event = record.to_json
          else
            event = record.to_json.gsub("\"", %q(\\\"))
          end
        else
          event = record
        end

        sourcetype = @sourcetype == 'tag' ? tag : @sourcetype

        # Build body for the POST request
        if !@usejson
          event = record["time"]+ " " + record["message"].to_json.gsub(/^"|"$/,"")
          body << '{"time":"'+ DateTime.parse(record["time"]).strftime("%Q") +'", "event":"' + event + '", "sourcetype" :"' + sourcetype + '", "source" :"' + @source + '", "index" :"' + index + '", "host" : "' + event_host + '"}'
        elsif @send_event_as_json
          body << '{"time" :' + time.to_s + ', "event" :' + event + ', "sourcetype" :"' + sourcetype + '", "source" :"' + source + '", "index" :"' + index + '", "host" : "' + event_host + '"}'
        else
          body << '{"time" :' + time.to_s + ', "event" :"' + event + '", "sourcetype" :"' + sourcetype + '", "source" :"' + source + '", "index" :"' + index + '", "host" : "' + event_host + '"}'
        end

        if @send_batched_events
          body << "\n"
        else
          send_to_splunk(body, token)
          body = ''
        end
      }

      if @send_batched_events
        send_to_splunk(body, token)
      end
    end
Loop through all records and sent them to Splunk