Forum Discussion

Tom_K_185554's avatar
Tom_K_185554
Icon for Nimbostratus rankNimbostratus
Jun 01, 2018

How can I get hsl logging in splunk to be in json format

Hello, I am using the f5.analytics.v3.7.0 Iapps template. I have an irule which I will provide below which we use to send some connection event data to splunk using hsl logging. I have attache...
devops
iApps
iRules
security
Tom_K_185554's avatar
Tom_K_185554
Icon for Nimbostratus rankNimbostratus
Jun 01, 2018
when CLIENT_ACCEPTED {  
   set client "[IP::client_addr]"
   set client_port "[TCP::client_port]"
   set vip [IP::local_addr]
   set vip_local_port [TCP::local_port]
   set remote [IP::remote_addr]
   set remote_port [TCP::remote_port]
   set hsl [HSL::open -proto TCP -pool analytics-iapp-hec-forwarder-tcp-log-stage0]
 }

when SERVER_CONNECTED {
   set client "[IP::client_addr]"
   set client_port "[TCP::client_port]"
   set node "[IP::server_addr]"
   set node_server_port "[TCP::server_port]"
   set self_ip "[serverside {IP::local_addr}]"
   set self_ip_local_port "[serverside {TCP::local_port}]"
   HSL::send $hsl "hsl test Event=SERVER_CONNECTED protocol=tcp client_ip=$client client_port=$client_port vip_ip=$vip vip_port=$vip_local_port snat_ip=$self_ip snat_port=$self_ip_local_port remote_ip=$node remote_port=$node_server_port "
   log local0.info "hsl test Event=SERVER_CONNECTED protocol=tcp client_ip= $client client_port= $client_port vip_ip= $vip vip_port= $vip_local_port snat_ip= $self_ip snat_port= $self_ip_local_port remote_ip= $node remote_port= $node_server_port"
}

when SERVER_CLOSED {
   HSL::send $hsl "hsl test Event=SERVER_CLOSED protocol=tcp client_ip=$client client_port=$client_port vip_ip=$vip vip_port=$vip_local_port snat_ip=$self_ip snat_port=$self_ip_local_port remote_ip=$node remote_port=$node_server_port "
   log local0.info "hsl test Event=SERVER_CLOSED protocol=tcp client_ip= $client client_port= $client_port vip_ip= $vip vip_port= $vip_local_port snat_ip= $self_ip snat_port= $self_ip_local_port remote_ip= $node remote_port= $node_server_port"
}

when CLIENT_CLOSED {  
  HSL::send $hsl "hsl test Event=CLIENT_CLOSED protocol=tcp client_ip=$client client_port=$client_port vip_ip=$vip vip_port=$vip_local_port snat_ip=$self_ip snat_port=$self_ip_local_port remote_ip=$node remote_port=$node_server_port "
  log local0.info "hsl test Event=CLIENT_CLOSED protocol=tcp client_ip= $client client_port= $client_port vip_ip= $vip vip_port= $vip_local_port snat_ip= $self_ip snat_port= $self_ip_local_port remote_ip= $node remote_port= $node_server_port"
}