Getting Data In

Does the HTTP Event Collector API support events with arbitrary metadata? (2019 edition)

New Member

3 years ago, someone asked my exact question:

"Does the HTTP Event Collector API support events with arbitrary metadata?" (can't add a link, no karma)

In short, POSTing {"event": "hello world", "foo": "bar"} results in {"text":"No data","code":5}.

Has the answer changed significantly in the intervening time? If so, in which version, and is there any documentation?

I'm using logstash 5.6 as a client.

0 Karma

SplunkTrust
SplunkTrust

What is it you are trying to solve? Because it depends what you mean by metadata and if you can control the HEC payload.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!