# Logstash to Splunk HTTP Event Collector
**URL:** https://discuss.elastic.co/t/logstash-to-splunk-http-event-collector/130765
**Category:** Logstash
**Created:** [May 6, 2018, 11:48pm UTC](https://discuss.elastic.co/t/logstash-to-splunk-http-event-collector/130765 "2018-05-06T23:48:38Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@sm00thindian](https://discuss.elastic.co/u/sm00thindian)
#### Post date: [May 6, 2018, 11:48pm UTC](https://discuss.elastic.co/t/logstash-to-splunk-http-event-collector/130765/1 "2018-05-06T23:48:39Z")
I'm trying to use logstash to send data directly to an http event collector (HEC). The HEC collector accepts the following correctly. But I'm trying to translate the to the appropriate HTTP Output config for logstash.
curl -k [https://hec.example.com:8088/services/collector/event](https://hec.example.com:8088/services/collector/event) -H "Authorization: Splunk B5A79AAD-D822-46CC-80D1-819F80D7BFB0" -d '{"event": "hello world"}'
{"text": "Success", "code": 0}
Has anyone had success with this?
-krw
---
### Author:  [@sm00thindian](https://discuss.elastic.co/u/sm00thindian)
#### Post date: [May 7, 2018, 7:24pm UTC](https://discuss.elastic.co/t/logstash-to-splunk-http-event-collector/130765/2 "2018-05-07T19:24:48Z")
Nothing huh... Was it because I said the S word?
---
### Author:  [@rcowart](https://discuss.elastic.co/u/rcowart)
#### Post date: [May 7, 2018, 8:24pm UTC](https://discuss.elastic.co/t/logstash-to-splunk-http-event-collector/130765/3 "2018-05-07T20:24:37Z")
There may not be a lot of folks here who use Logstash with Splunk. I can't tell you much about the HTTP output. Splunk did recently announce improved support ingesting from Kafka (about time!), so perhaps you could go...
logstash -\> kafka -\> splunk
Of course many of us here would encourage you to just store the data in Elasticsearch instead of Splunk. 😉
---
### Author:  [@sm00thindian](https://discuss.elastic.co/u/sm00thindian)
#### Post date: [May 9, 2018, 4:13pm UTC](https://discuss.elastic.co/t/logstash-to-splunk-http-event-collector/130765/6 "2018-05-09T16:13:13Z")
I was able to successfully send data directly to the HEC HTTP Event Collector with the following settings. Keys were to use the 'raw' input and to have a valid certificate for the destination. I'm sure a JKS trusted store would work as well. HEC expects JSON, and make sure acknowledgement is off on the HEC side.
```
filter {
ruby { code => "event.set('time', event.get('@timestamp').to_f)" }
mutate {
rename => { "message" => "event" }
}
}
output {
http {
format => "json"
content_type => "application/json"
http_method => "post"
url => "https://xxx.org:8088/services/collector/raw"
cacert => "/ ****valid*** cert_ca.pem"
headers => ['Authorization', 'Splunk 6e2e58ef-fe02-49de-9fd9-xxxxxxxxxxxxxxxxxxx']
}
}
```
The ruby code adds 'time' as epoch in float format and by changing the name of the message to event the receiving collector indexes it automatically.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 6, 2018, 4:13pm UTC](https://discuss.elastic.co/t/logstash-to-splunk-http-event-collector/130765/7 "2018-06-06T16:13:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.