I am using Splunk's HttpEventCollectorLogbackAppender to automatically send application logs to Splunk. I am trying to set the host, source and sourcetype type, but I will not be able to send them to Splunk.
Is it possible to set the host, source or sourcetype using Splunk HttpEventCollectorLogbackAppender, and if so, how to do it?
I am trying to send JSON and it does not seem to work.
Here is the documentation that tells which options are available and says that they should be passed as a query string, but since I'm using the Splunk appender from the box, I'm not sure how to install them.
http://dev.splunk.com/view/event-collector/SP-CAAAE6P
Share the backup application:
... <appender name="SPLUNK" class="com.splunk.logging.HttpEventCollectorLogbackAppender"> <url>http://myurl:8088</url> <token>mytoken</token> <disableCertificateValidation>true</disableCertificateValidation> <batch_size_count>1</batch_size_count> <layout class="ch.qos.logback.classic.PatternLayout"> <pattern>%logger: %msg%n</pattern> </layout> </appender> <root level="INFO"> <appender-ref ref="SPLUNK"/> </root> ...
Log line example
Logger logger = LoggerFactory.getLogger(MyClass.class); logger.debug("I'm logging debug stuff");
source share