NLog.Targets.HttpClient 6.1.4-Preview4

NLog.Targets.HttpClient

NLog HttpClient target for sending log events to an HTTP or HTTPS endpoint.

• Supports HTTP POST, GET, and custom HTTP methods.
• Batch multiple log events into a single HTTP request.
• Supports batching as JSON arrays or Newline Delimited JSON (NDJSON).
• GZip compression
• Custom request headers
• HTTP authentication
• Client certificates (mTLS)
• HTTP proxy support.

If having trouble with output, then check NLog InternalLogger for clues. See also Troubleshooting NLog.

Register Extension

NLog will only recognize the type-alias HttpClient when loading from an NLog.config file after registering the extension:

<extensions>
    <add assembly="NLog.Targets.HttpClient"/>
</extensions>

Alternative - register from code using the fluent configuration API:

LogManager.Setup().SetupExtensions(ext => {
    ext.RegisterTarget<NLog.Targets.HttpClientTarget>();
});

Configuration Example

<targets>
    <target xsi:type="HttpClient"
            name="http"
            url="https://api.example.com/logs"
            layout="${json-encode:${message}}" />
</targets>

<rules>
    <logger name="*" minlevel="Info" writeTo="http" />
</rules>

Parameters

Custom Headers

Additional HTTP headers can be configured:

<target xsi:type="HttpClient"
        name="http"
        url="https://api.example.com/logs">

    <header name="X-Api-Key" layout="${gdc:item=ApiKey}" />
    <header name="X-Environment" layout="Production" />

</target>

Client Certificates (mTLS)

Mutual TLS authentication can be enabled using a client certificate:

<target xsi:type="HttpClient"
        name="http"
        url="https://secure.example.com/logs"
        sslCertificateFile="client.pfx"
        sslCertificatePassword="secret" />

Retry Behavior

The target treats the following status codes as transient failures, that can be retried:

• 408 Request Timeout
• 429 Too Many Requests
• 5xx Server Errors

Client-side failures such as 400 Bad Request are not retried.

Splunk HTTP Event Collector (HEC)

SplunkLayout from the NLog.Targets.Network package can be used together with the HttpClient target to send events to the Splunk HEC /services/collector/event endpoint using newline-delimited JSON (NDJSON).

SplunkLayout renders the complete HEC event, including the outer time, host, source, sourcetype, index, and nested event fields.

The Authorization header is mandatory for Splunk HEC: Authorization: Splunk <hec-token>

<nlog>
<extensions>
    <add assembly="NLog.Targets.HttpClient"/>
    <add assembly="NLog.Targets.Network"/>
</extensions>
<targets>
    <target xsi:type="HttpClient"
            name="splunk"
            url="https://splunk-host:8088/services/collector/event"
            batchSize="100">
        <layout xsi:type="SplunkLayout" />

        
        <header name="Authorization" layout="Splunk ${configsetting:Splunk.Token}" />
    </target>
</targets>

<rules>
    <logger name="*" minlevel="Info" writeTo="splunk" />
</rules>
</nlog>

Notes

• The target internally reuses a single HttpClient instance to take advantage of connection pooling.
• The HttpClient instance is periodically recycled (every 5 minutes) to detect DNS changes while still benefiting from pooled connections.