HEC Appender logging slow

[kombi]

Logging a single line to Splunk is taking about 30ms with the HEC appender. 

e.g, the result of the below is 30ms.

Long start1 = System.currentTimeMillis(); 
log.info("Test logging"); 
Long start2 = System.currentTimeMillis(); 
log.info("logTime={}", start2 - start1);

This is our logback config - 

kombi_0-1715999515555.png

Taking 30 ms is too long for a single log action. Are we missing anything in the config ?

[PickleRick]

What do you mean by "takes 30ms"? Measured how - from when till when?

Did you do a tcpdump to check packets timeline?

Did you test just a single event or pushed in batch?

[kombi]

Hi,

We re measuring with a code snippet like the below, the time before we called the logger subtract the time the logger completed.

Long start1 = System.currentTimeMillis(); 
log.info("Test logging"); 
Long start2 = System.currentTimeMillis(); 
log.info("logTime={}", start2 - start1);

We have not use a tcpdump yet as this is running on a container, not able to use batch too since we needed type=raw which don't support batch configs from my understanding. Is there a way to work with Raw type and send as batch?

Thanks.