Splunk HEC Logging Configuration
Configuration reference for the Splunk HEC Logging plugin (`splunk-hec-logging`): the parameters and plugin metadata, each attribute with its type, whether it is required, its default and its accepted values.
Parameters
See plugin common configurations (opens in Apache APISIX docs) for configuration options available to all plugins.
endpoint — object[object] · required · since APISIX 2.12.0 · API7 Gateway 3.2.16.0
Splunk HEC endpoint configurations.
uri — string · required · since APISIX 2.12.0 · API7 Gateway 3.2.16.0
Splunk HEC event collector API endpoint.
token — string · required · since APISIX 2.12.0 · API7 Gateway 3.2.16.0
Splunk HEC authentication token. API7 Gateway encrypts the value with AES at rest. APISIX encrypts it before etcd storage when apisix.data_encryption.enable_encrypt_fields is enabled.
channel — string · optional · since APISIX 2.12.0 · API7 Gateway 3.2.16.0
Splunk HEC send data channel identifier. For more information, see About HTTP Event Collector Indexer Acknowledgment.
timeout — integer · optional · default: 10 · since APISIX 2.12.0 · API7 Gateway 3.2.16.0
Splunk HEC send data timeout in seconds.
keepalive_timeout — integer · optional · default: 60000 · since APISIX 3.11.0 · API7 Gateway 3.2.16.0
Valid values: greater than or equal to 1000
Keepalive timeout in milliseconds.
ssl_verify — boolean · optional · default: true · since APISIX 2.12.0 · API7 Gateway 3.2.16.0
log_format — object · optional · since APISIX 3.2.0 · API7 Gateway 3.2.16.0
Custom log format using key-value pairs in JSON format. Values can reference built-in variables (opens in Apache APISIX docs).
In APISIX from 3.15.0, log format nested structures are supported up to five levels deep. In API7 Enterprise, only flat key-value structures are supported; nested structures are not yet supported.
You can also configure log format on a global scale using the plugin metadata (opens in Apache APISIX docs), which configures the log format for all splunk-hec-logging plugin instances. If the log format configured on the individual plugin instance differs from the log format configured on plugin metadata, the log format configured on the individual plugin instance takes precedence. See the example for more details.
log_format_extra — object · optional · since APISIX 3.18.0 · API7 Gateway 3.9.15
Additional fields to add to the default log entry, using key-value pairs in JSON format. Values can reference built-in variables (opens in Apache APISIX docs). A configured field does not overwrite an existing default field. A plugin instance takes precedence over plugin metadata; setting an empty object on the instance disables the metadata value. When log_format is configured, log_format_extra is ignored. Introduced in API7 Enterprise 3.9.15 and 3.10.2, and APISIX 3.18.0.
name — string · optional · default: splunk-hec-logging · since APISIX 2.12.0 · API7 Gateway 3.8.6
Unique identifier of the plugin for the batch processor.
batch_max_size — integer · optional · default: 1000 · since APISIX 2.12.0 · API7 Gateway 3.8.6
Valid values: greater than 0
The number of log entries allowed in one batch. Once reached, the batch will be sent to Splunk HEC. Setting this parameter to 1 means immediate processing.
inactive_timeout — integer · optional · default: 5 · since APISIX 2.12.0 · API7 Gateway 3.8.6
Valid values: greater than 0
The maximum time in seconds to wait for new logs before sending the batch to the logging service. The value should be smaller than buffer_duration.
buffer_duration — integer · optional · default: 60 · since APISIX 2.12.0 · API7 Gateway 3.8.6
Valid values: greater than 0
The maximum time in seconds from the earliest entry allowed before sending the batch to the logging service.
retry_delay — integer · optional · default: 1 · since APISIX 2.12.0 · API7 Gateway 3.8.6
Valid values: greater than or equal to 0
The time interval in seconds to retry sending the batch to the logging service if the batch was not successfully sent.
max_retry_count — integer · optional · default: 0 · since APISIX 2.12.0 · API7 Gateway 3.8.6
Valid values: greater than or equal to 0
The maximum number of unsuccessful retries allowed before dropping the log entries.
Plugin Metadata
log_format — object · optional · since APISIX 3.2.0 · API7 Gateway 3.2.16.0
Custom log format using key-value pairs in JSON format. Values can reference built-in variables (opens in Apache APISIX docs).
In APISIX from 3.15.0, log format nested structures are supported up to five levels deep. In API7 Enterprise, only flat key-value structures are supported; nested structures are not yet supported.
log_format_extra — object · optional · since APISIX 3.18.0 · API7 Gateway 3.9.15
Additional fields to add to the default log entry, using key-value pairs in JSON format. Values can reference built-in variables (opens in Apache APISIX docs). A configured field does not overwrite an existing default field. A plugin instance takes precedence over plugin metadata; setting an empty object on the instance disables the metadata value. When log_format is configured, log_format_extra is ignored. Introduced in API7 Enterprise 3.9.15 and 3.10.2, and APISIX 3.18.0.
max_pending_entries — integer · optional · default: 8192 in APISIX 3.18.0 and in API7 Enterprise 3.9.19 and 3.10.6; none in API7 Enterprise 3.9.18 and 3.10.5 · since APISIX 3.15.0 · API7 Gateway 3.8.17
Valid values: greater than or equal to 1
Maximum number of entries waiting in the batch processor. New entries are discarded when the backlog reaches the limit.
Introduced in API7 Enterprise 3.8.17 and APISIX 3.15.0.
The default changed to 8192 in APISIX 3.18.0 and in API7 Enterprise 3.9.19 on the 3.9 line and 3.10.6 on the 3.10 line. In API7 Enterprise 3.9.18 and 3.10.5, and in earlier APISIX versions, omitting the parameter leaves the backlog unlimited.
See Batch Processor (opens in Apache APISIX docs) for sizing and verification guidance.