Anyone having any luck with creating JMS Input with HEC (HTTP Event Collector) mode (output_type)?
I am getting HTTP 400 Bad request error when the messages are sent to the queue.
Below is my Input.
Let me know if i am doing anything wrong.
inputs.conf
[ jms://queue/queue_name]
browse_frequency = -1
browse_mode = all
browse_queue_only = 0
destination_pass = password
destination_user = username
durable= 0
hec_batch_mode = 0
hec_https = 1
hec_port = 8088
hec_token = token
index = hadoopmon
index_message_header = 0
index_message_properties = 0
init_mode = jndi
jms_connection_factory_name = SplunkQConnectionFactory
jndi_initialcontext_factory = com.sun.jndi.fscontext.RefFSContextFactory
jndi_pass = password
jndi_provider_url = binding file location
jndi_user = username
message_handler_impl = com.splunk.modinput.jms.custom.handler.BodyOnlyMessageHandler
output_type = hec
source = queue/queue_name
sourcetype = hadoopmon_dev
strip_newlines = 1
We found the issue at our side. Un check - Indexer acknowledgement.
Hello,
Did you find any solution to this issue. unfortunately, we have the same problem .:(
Thanks.