How log to Splunk Enterprise with HttpEventCollector in Java/Maven/Vaadin?

Code

First we need to add the required packages to our project. We do this by adding the references to ‘pom.xml‘.

...
<repository>
  <id>splunk-artifactory</id>
  <name>Splunk Releases</name>
  <url>https://splunk.jfrog.io/splunk/ext-releases-local</url>
</repository>
...
</repositories>

Now we need to tell Maven the dependencies we actually want:

<dependencies>
...
<dependency>
  <groupId>ch.qos.logback</groupId>
  <artifactId>logback-classic</artifactId>
  <version>1.2.10</version>
</dependency>
<dependency>
  <groupId>com.splunk.logging</groupId>
  <artifactId>splunk-library-javalogging</artifactId>
  <version>1.8.0</version>
</dependency>
...
</dependencies>

Place the following content in a file called ‘logback.xml’. Read more here.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <appender name="socket" class="com.splunk.logging.TcpAppender">
        <RemoteHost>127.0.0.1</RemoteHost>
        <Port>8088</Port>
        <layout class="ch.qos.logback.classic.PatternLayout">
            <pattern>%thread %level: %msg%n</pattern>
        </layout>
    </appender>
    <logger name="splunk.logger" additivity="false" level="INFO">
        <appender-ref ref="socket"/>
    </logger>
    <root level="INFO">
        <appender-ref ref="socket"/>
    </root>
    <appender name="http" class="com.splunk.logging.HttpEventCollectorLogbackAppender">
        <url>${SPLUNK_URL}</url>
        <token>${SPLUNK_TOKEN}</token>
        <source>${SPLUNK_SOURCE}</source>
        <sourcetype>_json</sourcetype>
        <messageFormat>text</messageFormat>
        <middleware>HttpEventCollectorUnitTestMiddleware</middleware>
        <layout class="ch.qos.logback.classic.PatternLayout">
            <pattern>%msg</pattern>
        </layout>
    </appender>
    <logger name="splunk.logger" additivity="false" level="INFO">
        <appender-ref ref="http"/>
    </logger>
    <root level="INFO">
        <appender-ref ref="http"/>
    </root>
</configuration>

You can now pass the URL, Source (for filtering your logs) and Token using environment variables or a different way. See ‘variable substitution‘.