Package org.logevents.observers

Class HumioLogEventObserver

  • All Implemented Interfaces:
    LogEventObserver
    public class HumioLogEventObserver
extends ElasticsearchLogEventObserver
    Publishes asynchronously to Humio Elasticsearch Bulk API

    Sample configuration

     observer.humio=HumioLogEventObserver
 observer.humio.elasticsearchUrl=http://localhost:9200
 observer.humio.elasticsearchUrlPath=api/v1/ingest/elastic-bulk
 observer.humio.elasticsearchAuthorizationHeader=repositoryId injectApiToken
 observer.humio.index=my-test-index
 observer.humio.idleThreshold=PT2S
 observer.humio.cooldownTime=PT1S
 observer.humio.maximumWaitTime=PT30S
 observer.humio.suppressMarkers=PERSONAL_DATA
 observer.humio.formatter.excludedMdcKeys=secret

    Elasticsearch configuration

    • elasticsearchUrl should point to where the elasticsearch API lives. It should contain an URI scheme and authority.
    • elasticsearchUrlPath should point to the http path where the Elasticsearch Bulk API lives.

    Authorization

    The configurable elasticsearchAuthorizationHeader is the value the client will include as Authorization header when communicating with elasticsearchUrl. It is not to be confused by Basic authentication. If you need basic authentication you need to remember to provide its configuration value as 'Basic base64encodedValueHere'.

    See Also:
    RFC3986 #section3 about URI syntax