How to send Kong log to Splunk by using the HTTP Log plugin?
How to send Kong log to Splunk by using HTTP Log plugin
Uses:
Kong Gateway
TL;DR
How do I send Kong logs to Splunk using the HTTP Log plugin?
Configure the HTTP Log plugin’s http_endpoint to point at your Splunk HEC raw endpoint (for example https://<splunk-host>:8088/services/collector/raw), and set the Authorization header to Splunk <token>. On Kong versions before 3.0, the Authorization header value must be given as a list rather than a plain string.
Steps
Please note the example below is for Splunk 9.0.2. Check the Splunk docs to use the appropriate method if you are using a different version of Splunk.
The HTTP Log plugin will send the response body in the plugin log format.
We could follow example 3 and send the raw data to the /services/collector/raw endpoint of Splunk.
Also, the secure token is required by Splunk with this endpoint.
Assuming our Splunk is running at https://demo.splunkcloud.com:8088/ and its secure token is 123456, then we could enable an HTTP Log plugin with the configuration below:
config:
headers:
Authorization: "Splunk 123456"
http_endpoint: https://demo.splunkcloud.com:8088/services/collector/raw
method: POST
timeout: 3000
retry_count: 1If you are running Kong version less than 3.0, please enable an HTTP Log plugin with the configuration below instead:
config:
headers:
Authorization:
- "Splunk 123456"
http_endpoint: https://demo.splunkcloud.com:8088/services/collector/raw
method: POST
timeout: 3000
retry_count: 1This HTTP Log plugin will send the log to https://demo.splunkcloud.com:8088/services/collector/raw with the secure token, as in example 3 of the Splunk HEC examples.