I have implemented an irule that uses high speed logging to log HTTP request/response transaction to Splunk. The payload is primarily xml and I need to parse out some fields, which I have done. TCL is not great for doing that kind of parsing but neither is Splunk SPL and I don’t want to ingest the entire request/response payloads just for a few pieces of information. I would prefer to send the data to RabbitMQ and preparse it there before consuming it in Splunk. I have searched DevCentral to see if this has been attempted and I can’t see that it has. I found some RabbitMQ posts but they were regarding load balancing requests to a RabbitMQ cluster. I cannot see that HSL supports AMQP or STOMP, but wanted to check with the DevCentral community to make sure.
