A minimal Cloudflare worker that behaves like a Splunk HEC collector

worker.js

export default {
  async fetch(request, env, ctx) {
    // Parse the request body as text as it's multiple concatenated JSON documented, ex:
    // {"event":{...},"time":"123"}{"event":{...},"time":"456"}
    let body = await request.text();
    // Extract some request properties
    const requestIP = request.headers.get('CF-Connecting-IP');
    const userAgent = request.headers.get('User-Agent');
    // Convert to valid JSON by wrapping in an array and injecting commas
    let bodyJSON = JSON.parse(`[` + body.replace(/}{"/g, `},{"`) + `]`);
    // Iterate over the events
    for (const [idx, {time, event}] of bodyJSON.entries()) {
      const timeISO = new Date(parseFloat(time) * 1000).toISOString();
      console.log({
        message: `HEC Event ${idx} at ${timeISO} from '${requestIP}' via '${userAgent}'`,
        event: event,
      });
    }
    // Pretend we successfully ingested the event
    return Response.json({
      "text": "Success",
      "code": 0,
    });
  }
};