cancel
Showing results for 
Search instead for 
Did you mean: 

High Speed Logging to RabbitMQ

Kurt_D_Kite
Nimbostratus
Nimbostratus

Hi,

 

I have implemented an irule that uses high speed logging to log HTTP request/response transaction to Splunk. The payload is primarily xml and I need to parse out some fields, which I have done. TCL is not great for doing that kind of parsing but neither is Splunk SPL and I don’t want to ingest the entire request/response payloads just for a few pieces of information. I would prefer to send the data to RabbitMQ and preparse it there before consuming it in Splunk. I have searched DevCentral to see if this has been attempted and I can’t see that it has. I found some RabbitMQ posts but they were regarding load balancing requests to a RabbitMQ cluster. I cannot see that HSL supports AMQP or STOMP, but wanted to check with the DevCentral community to make sure.

 

Thanks,

Kurt

0 REPLIES 0