Kong Splunk Log

The Kong Splunk Log plugin is a modified version of the HTTP Log plugin that has been refactored and tailored to work with Splunk.

We recommend enabling the Splunk Logging plugin at a global level.

You can install the Kong Splunk Log plugin via LuaRocks. A Lua plugin is distributed in .rock format, which is a self-contained package that can be installed locally or from a remote server.

1. Install the Kong Splunk Log plugin:

   luarocks install kong-splunk-log
   

2. Update your loaded plugins list in Kong Gateway.

   In your kong.conf, append kong-splunk-log to the plugins field. Make sure the field isn’t commented out.

   plugins = bundled,kong-splunk-log
   

3. Restart Kong Gateway:

   kong restart
   

The plugin requires the SPLUNK_HOST environment variable. This is how we define the host="" log field in Splunk:

export SPLUNK_HOST="example.company.com"

Make the environment variable accessible by an Nginx worker by adding this line to your nginx.conf:

env SPLUNK_HOST;