log4j2 configuration for Splunk HEC on EC2

crippled-ankle — Thu, 15 Oct 2020 01:20:41 GMT

I have my log4j2.xml as below,

<?xml version="1.0" encoding="UTF-8"?> <Configuration status="info" name="example" packages="com.splunk.logging"> <Appenders> <SplunkHttp name="splunk" url="http://localhost:8088" token="sometoken" index="someindex" messageFormat="text" source="somesource" sourceType="log4j" batch_size_count="1" disableCertificateValidation="true" > <PatternLayout pattern="%m"/> </SplunkHttp> </Appenders> <Loggers> <Root level="INFO"> <AppenderRef ref="splunk"/> </Root> </Loggers> </Configuration>

I'm trying to set up Splunk with HEC on an EC2 instance. The same configuration works for a Splunk instance on my Windows machine.

I used tcpdump to trace packets on port 8088 and it seems there is no packet reaching to that port. Did I miss anything on the configuration?

Thank you!

Re: log4j2 configuration for Splunk HEC on EC2

richgalloway — Thu, 15 Oct 2020 12:33:45 GMT

Have you checked your firewall? Is Splunk listening on port 8088?

topic log4j2 configuration for Splunk HEC on EC2 in Getting Data In

log4j2 configuration for Splunk HEC on EC2

Re: log4j2 configuration for Splunk HEC on EC2