Getting Data In

Does the HTTP Event Collector API support events with arbitrary metadata? (2019 edition)

olivercole
New Member

3 years ago, someone asked my exact question:

"Does the HTTP Event Collector API support events with arbitrary metadata?" (can't add a link, no karma)

In short, POSTing {"event": "hello world", "foo": "bar"} results in {"text":"No data","code":5}.

Has the answer changed significantly in the intervening time? If so, in which version, and is there any documentation?

I'm using logstash 5.6 as a client.

0 Karma

starcher
Influencer

What is it you are trying to solve? Because it depends what you mean by metadata and if you can control the HEC payload.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...