I dunno. Since HEC works on port 8088 (and your log4j configuration seems to be pointed on that port properly) limit your network dump to port 8088 and see if there is any traffic there. Does the TCP session get properly initialized, processed and closed? If so, check the HTTP transaction that's going on inside that session - do you get the proper HTTP POST request? Is it received properly and responded with a normal 200 OK code? ... View more