nginx Proxy for Splunk HEC

nginx.conf

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {

  log_format  '$remote_addr - $remote_user [$time_local] '
                           '"$request" $status $body_bytes_sent '
                           '"$http_referer" "$http_user_agent" "$gzip_ratio"';

    server {
        # Enable SSL for default HEC port 8088
        #listen 8088 ssl;
        listen 8888;

        # Configure default Splunk Enterprise certificate.
        # Private key is included in server.pem so use it in both settings.
	      #ssl_certificate     server.pem;
    	  #ssl_certificate_key server.pem;

        location /hec {
          proxy_pass            http://tmuth-mbp17:8088/services/collector;
          proxy_read_timeout    90;
          proxy_connect_timeout 90;
          proxy_redirect        off;
          proxy_set_header      Host $host;
          proxy_set_header      X-Real-IP $remote_addr;
          proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;

          # wrap the event body for splunk
          proxy_set_body        "{\"event\":$request_body}";
          # Add the Splunk token into the Authorization header
          proxy_set_header      Authorization "Splunk 15F2903F-4851-4AD2-B4A3-320A65D4C2C1";
        }
    }
}