How to connect my Heroku app log stream to Splunk Light?

[rivaliq]

I am trying to hook up my existing Heroku app log stream to a Splunk Light (hosted) instance. How do I do this?

The Splunk Light documentation (http://docs.splunk.com/Documentation/SplunkLight/6.4.0/GettingStarted/Monitornetworkports) says I can set up a TCP listener via Add Data / Monitor, but when I go there, the only option is the HTTP Event Collector. I did try setting up this HTTP Event Collector, and I get a token value, but what is the URL to use to access it?

Heroku can set up TCP or HTTPS log drains (https://devcenter.heroku.com/articles/log-drains), but in either case, it requires the URL of the destination.

Has anyone done this successfully?

Thanks!
Seth

[dkoshe_splunk]

For Splunk Light Cloud, you cannot open up a new TCP inputs, due to security constraints.
You could use Universal Forwarder to forward Hiroku logs (if they are file system based) to Splunk Light Cloud Service.
See how to setup forwarders for Splunk Light Cloud

Alternatively, HTTP Event collector should work just fine. See here for the details about HTTP event collector.

The URL is of the form:
curl -k https://hostname:8088/services/collector/event -H "Authorization: Splunk " -d '{"event": "hello world"}

[rivaliq]

Thanks dkoshe for the quick response. The link to the details on the HTTP event collector is helpful.

Heroku logs are stream-based, not file based. They can be streamed via TCP or HTTPS. However, as far as i know, there is no way to add custom headers to these heroku log drains, which means that i don't believe this path will work.

There is also no direct facility to install something like the universal forwarder on Heroku directly.

So, it seems like the way to get this to work would be to install the universal forwarder on a seperate (non-heroku) computer and have it act as an intermediary? is that true?

Thanks,
Seth

[dkoshe_splunk]

Exactly Seth.
Setup TCP input port on your universal forwarder, that will receive Hiroku log stream data, and forward it to Splunk Light cloud.