splunk-hec-logging

Description

The splunk-hec-logging plugin is used to forward the request log of Apache APISIX to Splunk HTTP Event Collector (HEC) for analysis and storage. After the plugin is enabled, Apache APISIX will obtain request context information in Log Phase serialize it into Splunk Event Data format and submit it to the batch queue. When the maximum processing capacity of each batch of the batch processing queue or the maximum time to refresh the buffer is triggered, the data in the queue will be submitted to Splunk HEC.

For more info on Batch-Processor in Apache APISIX please refer to: Batch-Processor

Attributes

NameRequirementDefaultDescription
endpointrequiredSplunk HEC endpoint configuration info
endpoint.urirequiredSplunk HEC event collector API
endpoint.tokenrequiredSplunk HEC authentication token
endpoint.channeloptionalSplunk HEC send data channel identifier, refer to: About HTTP Event Collector Indexer Acknowledgment
endpoint.timeoutoptional10Splunk HEC send data timeout, time unit: (seconds)
ssl_verifyoptionaltrueenable SSL verification, option as per OpenResty docs

The plugin supports the use of batch processors to aggregate and process entries(logs/data) in a batch. This avoids frequent data submissions by the plugin, which by default the batch processor submits data every 5 seconds or when the data in the queue reaches 1000. For information or custom batch processor parameter settings, see Batch-Processor configuration section.

How To Enable

The following is an example of how to enable the splunk-hec-logging for a specific route.

Full configuration

  1. curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3.     "plugins":{
  4.         "splunk-hec-logging":{
  5.             "endpoint":{
  6.                 "uri":"http://127.0.0.1:8088/services/collector",
  7.                 "token":"BD274822-96AA-4DA6-90EC-18940FB2414C",
  8.                 "channel":"FE0ECFAD-13D5-401B-847D-77833BD77131",
  9.                 "timeout":60
  10.             },
  11.             "buffer_duration":60,
  12.             "max_retry_count":0,
  13.             "retry_delay":1,
  14.             "inactive_timeout":2,
  15.             "batch_max_size":10
  16.         }
  17.     },
  18.     "upstream":{
  19.         "type":"roundrobin",
  20.         "nodes":{
  21.             "127.0.0.1:1980":1
  22.         }
  23.     },
  24.     "uri":"/splunk.do"
  25. }'

Minimize configuration

  1. curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3.     "plugins":{
  4.         "splunk-hec-logging":{
  5.             "endpoint":{
  6.                 "uri":"http://127.0.0.1:8088/services/collector",
  7.                 "token":"BD274822-96AA-4DA6-90EC-18940FB2414C"
  8.             }
  9.         }
  10.     },
  11.     "upstream":{
  12.         "type":"roundrobin",
  13.         "nodes":{
  14.             "127.0.0.1:1980":1
  15.         }
  16.     },
  17.     "uri":"/splunk.do"
  18. }'

Test Plugin

  • Send request to route configured with the splunk-hec-logging plugin
  1. $ curl -i http://127.0.0.1:9080/splunk.do?q=hello
  2. HTTP/1.1 200 OK
  3. ...
  4. hello, world
  • Login to Splunk Dashboard to search and view

splunk hec search view

Disable Plugin

Disabling the splunk-hec-logging plugin is very simple, just remove the JSON configuration corresponding to splunk-hec-logging.

  1. $ curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
  2. {
  3.     "uri": "/hello",
  4.     "plugins": {},
  5.     "upstream": {
  6.         "type": "roundrobin",
  7.         "nodes": {
  8.             "127.0.0.1:1980": 1
  9.         }
  10.     }
  11. }'