Skip to main content
API7.ai Logo

Parameters​

See plugin common configurations for configuration options available to all plugins.

  • endpoint

    object[object]

    required

    Splunk HEC endpoint configurations.

    • uri

      string

      required

      Splunk HEC event collector API endpoint.

    • token

      string

      required

      Splunk HEC authentication token.

    • channel

      string

      Splunk HEC send data channel identifier. For more information, see About HTTP Event Collector Indexer Acknowledgment.

    • timeout

      integer

      default: 10

      Splunk HEC send data timeout in seconds.

    • keepalive_timeout

      integer

      default: 60000

      vaild vaule:

      greater than or equal to 1000

      Keepalive timeout in milliseconds.

  • ssl_verify

    boolean

    default: true

  • log_format

    object

    Custom log format using key-value pairs in JSON format. Values can reference built-in variables.

    In APISIX from 3.15.0, log format nested structures are supported up to five levels deep. In API7 Enterprise, only flat key-value structures are supported; nested structures are not yet supported.

    You can also configure log format on a global scale using the plugin metadata, which configures the log format for all splunk-hec-logging plugin instances. If the log format configured on the individual plugin instance differs from the log format configured on plugin metadata, the log format configured on the individual plugin instance takes precedence. See the example for more details.

  • log_format_extra

    object

    Additional log fields to overlay on the default log entry, using key-value pairs in JSON format. Values can reference built-in variables. Unlike log_format, which replaces the entire default log entry, log_format_extra keeps the default entry and adds the configured fields on top of it. When log_format is set, log_format_extra is ignored. Available in API7 Enterprise from version 3.9.15.

  • name

    string

    default: splunk-hec-logging

    Unique identifier of the plugin for the batch processor.

  • batch_max_size

    integer

    default: 1000

    vaild vaule:

    greater than 0

    The number of log entries allowed in one batch. Once reached, the batch will be sent to Splunk HEC. Setting this parameter to 1 means immediate processing.

  • inactive_timeout

    integer

    default: 5

    vaild vaule:

    greater than 0

    The maximum time in seconds to wait for new logs before sending the batch to the logging service. The value should be smaller than buffer_duration.

  • buffer_duration

    integer

    default: 60

    vaild vaule:

    greater than 0

    The maximum time in seconds from the earliest entry allowed before sending the batch to the logging service.

  • retry_delay

    integer

    default: 1

    vaild vaule:

    greater than or equal to 0

    The time interval in seconds to retry sending the batch to the logging service if the batch was not successfully sent.

  • max_retry_count

    integer

    default: 0

    vaild vaule:

    greater than or equal to 0

    The maximum number of unsuccessful retries allowed before dropping the log entries.

Plugin Metadata​

  • log_format

    object

    Custom log format using key-value pairs in JSON format. Values can reference built-in variables.

    In APISIX from 3.15.0, log format nested structures are supported up to five levels deep. In API7 Enterprise, only flat key-value structures are supported; nested structures are not yet supported.

  • log_format_extra

    object

    Additional log fields to overlay on the default log entry, using key-value pairs in JSON format. Values can reference built-in variables. Unlike log_format, which replaces the entire default log entry, log_format_extra keeps the default entry and adds the configured fields on top of it. When log_format is set, log_format_extra is ignored. Available in API7 Enterprise from version 3.9.15.

  • max_pending_entries

    integer

    vaild vaule:

    greater than or equal to 1

    Maximum number of unprocessed entries allowed in the batch processor. When this limit is reached, new entries will be dropped until the backlog is reduced. This helps prevent memory spikes when the logger is slow or unavailable.

    This parameter is available in API7 Enterprise from version 3.8.17 and in APISIX from version 3.15.0.