Unique Identifier for irules Http response
With code for an irule below is there a way I can set a unique identifier for the data coming back. I ask because when the logs are ingested into Splunk we would like to know which header came with which request, but each response header is on a different line and show up as different requests in Splunk. Thanks
when HTTP_RESPONSE {
set LogString "Client [IP::client_addr]:[TCP::client_port]"
log local0. "============================================="
log local0. "$LogString (response) - status: [HTTP::status]"
foreach aHeader [HTTP::header names] {
log local0. "$aHeader: [HTTP::header value $aHeader]"
}
log local0. "============================================="
}
richarc With the iRule logging each time you receive an HTTP response this will be a significant amount of log entries. You might be better off with one logging line and having the server insert a unique ID per client rather than the F5. If you are using UIE persistence you might be able to do the following and use Splunk to merge the request and response somehow.
when HTTP_REQUEST priority 500 { set value [persist lookup uie [list $myVar any virtual]] log local0. "HTTP reqeust client ID: ${value}" } when HTTP_RESPONSE priority 500 { set value [persist lookup uie [list $myVar any virtual]] log local0. "HTTP resposne client ID: ${value}" }