---
schema_version: "1"
id: 27ba63d999745e9d36d1103e27c5a711e5022500ea383b628de4eb905aae507d
title: Export Data from Runtime Manager to External Analytics Tools
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-manager/sending-data-from-arm-to-external-analytics-software.md
canonical_url: https://docs.mulesoft.com/runtime-manager/sending-data-from-arm-to-external-analytics-software
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 47aea2c2281b5115fa46a4a218162f8035c6039c6533f023f98f7038a72f5b41
description: MuleSoft Documentation Site
latest: true
---
---
product: Runtime Manager
---

# Export Data from Runtime Manager to External Analytics Tools

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

[![logo hybrid active](/mulesoft/current/en-us/_/img/icons/hybrid-cloud.svg "Hybrid")Hybrid](deployment-strategies#hybrid-deployments)[ ![logo server active](/mulesoft/current/en-us/_/img/icons/server-cloud.svg "Anypoint Platform PCE")Private Cloud Edition](deployment-strategies#anypoint-platform-private-cloud-edition)

You can configure the Runtime Manager agent to export data to external analytics tools.

Using either the Runtime Manager cloud console or Anypoint Platform Private Cloud Edition, you can:

- Send Mule event notifications, including flow executions and exceptions, to Splunk or ELK.

  See [Integrate with Splunk](#integrate-with-splunk) and
  [Integrate with Your ELK Stack](#integrate-with-your-elk-stack).

- Send API Analytics to Splunk or ELK.

  See [Integrate API Analytics with Splunk or ELK](#integrate-api-analytics-with-splunk-or-elk).

If you plan to export your payload’s contents to be logged, consider that not all formats can be
exported. See [Payload Formats and Logging](https://docs.mulesoft.com/runtime-manager/about-logging-of-payload-formats).

Sending data to third-party tools is not supported for applications deployed on
[CloudHub](https://docs.mulesoft.com/cloudhub/). You can use the CloudHub custom log appender to integrate with your
logging system. See
[Integrate with Your Logging System Using Log4j](https://docs.mulesoft.com/cloudhub/custom-log-appender).

## Prerequisites

Ensure that the following software is installed:

- Mule runtime engine

  To forward events from API analytics to both an external tool and Anypoint Platform, the following
  version is required:

  - Mule version 4.2.0 or later

- API gateway standalone version 2.1.0 or later

- Runtime Manager agent 1.2.0 or later

  To send data to Splunk using the HTTP Event Collector or over TCP, Runtime Manager agent 1.3.1 or
  later is required.

  For information about updating the agent, see
  [Install or Update the Runtime Manager Agent](https://docs.mulesoft.com/runtime-manager/installing-and-configuring-runtime-manager-agent).

### Splunk Prerequisites

To send data to Splunk using the HTTP Event Collector, you must first set up the data input and
obtain a token from Splunk:

1.  Sign in to your Splunk account.

2.  Navigate to **Settings** > **Data Inputs**.

3.  For the **HTTP Event Collector** type, click **Add new**.

    ![Add new option for the HTTP Event Collector in the Splunk Data Inputs page](/mulesoft/current/en-us/runtime-manager/_images/hybrid-export-splunk-config-http-collector.png)

    Figure 1. The arrow shows the **Add new** option for the HTTP Event Collector in the Splunk Data
    Inputs page.

4.  Follow the steps to set up the data input and obtain the token.

To send data to Splunk over TCP, you must first enable the input source in Splunk:

1.  Sign in to your Splunk account.

2.  Navigate to **Settings** > **Data Inputs**.

3.  For the **TCP** type, click **Add new**.

    ![Add new option for TCP in the Splunk Data Inputs page](/mulesoft/current/en-us/runtime-manager/_images/hybrid-export-splunk-config-tcp.png)

    Figure 2. The arrow shows the **Add new** option for TCP in the Splunk Data Inputs page.

4.  Follow the steps to set up the data input.

For more information about setting up data inputs, see the
[Splunk documentation](https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/WhatSplunkcanmonitor).

## Logging-Level Options

The following logging levels are available when configuring integration with Splunk or ELK:

Business Events

Flow start or end, async messages, exceptions, and custom events

Tracking

Business Events plus exception strategy, and endpoint messages

Debug

Tracking plus message processor begin and end

## Integrate with Splunk

With [Splunk](https://www.splunk.com/), you can capture and index Mule event notification data into
a searchable repository from which you can then generate graphs, reports, alerts, dashboards, and
visualizations.

1.  [Configure the Agent in Your Splunk Instance](#configure-the-agent-in-your-splunk-instance).

2.  [Configure Splunk Integration in Runtime Manager](#configure-splunk-integration-in-runtime-manager).

### Configure the Agent in Your Splunk Instance

To integrate with Splunk, you must create and configure a new source type on your Splunk instance
that can parse the HTTP events sent by the Runtime Manager agent.

1.  If necessary, create the `$SPLUNK_HOME/opt/splunk/etc/system/local/props.conf` file.

2.  Append the following source type to the `props.conf` file:

    ```yaml
    [mule]
    TRUNCATE = 0
    LINE_BREAKER = ([\r\n]+)
    SHOULD_LINEMERGE = false
    INDEXED_EXTRACTIONS = JSON
    KV_MODE = JSON
    category = Mule Splunk Integration
    description = Mule Agent event information
    ```

3.  Restart your Splunk instance for your changes to take effect.

### Configure Splunk Integration in Runtime Manager

To send Mule event notifications from the Runtime Manager agent to Splunk:

1.  If you plan to send data to Splunk using the HTTP Event Collector or over TCP, check the
    [Splunk Prerequisites](#splunk-prerequisites).

2.  From Anypoint Platform, select **Runtime Manager**.

3.  Click the **Servers** tab.

4.  Click the **Type** column to display the details pane for the server you want to configure.

5.  Click **Manage Server**.

6.  Click the **Plugins** tab:

    ![Event Tracking options](/mulesoft/current/en-us/runtime-manager/_images/hybrid-export-splunk-elk.png)

    Figure 3. The screenshot shows (**1**) the **Event Tracking** options, (**2**) the **Level**
    menu, and (**3**) the gear icon on the server **Plugins** tab.

7.  Under **Event Tracking**, enable **Splunk**.

8.  Select the type of information to send from the **Level** menu.

    See [Logging-Level Options](#logging-level-options).

9.  Click the gear icon to specify your Splunk configuration:

    ![Protocol option](/mulesoft/current/en-us/runtime-manager/_images/hybrid-export-splunk-configure.png)

    Figure 4. The screenshot shows (**1**) the protocol option, (**2**) the data input types, and
    (**3**) the **Show more options** switch in the Splunk configuration window.

    See [Splunk Configuration Options](#splunk-configuration-options).

10. Specify the host (IP address or hostname) and management port of the server where Splunk is
    running.

    - To send data to Splunk using the REST API, select **Rest API** and enter the username and
      password for your Splunk account.

    - To send data to Splunk over TCP, select **tcp** from the menu and enter the username and
      password for your Splunk account.

    - To send data to Splunk using the HTTP Event Collector, select **HTTP Event Collector** and
      paste the token from Splunk in the **Token** field:

      ![HTTP Event Collector option and Token field in the Splunk configuration window](/mulesoft/current/en-us/runtime-manager/_images/hybrid-export-splunk-configure-http.png)

      Figure 5. The screenshot shows (**1**) the **HTTP Event Collector** option and (**2**) the
      **Token** field in the Splunk configuration window.

11. If you want, click **Show more options** to specify formatting properties for the sent data:

    ![Expanded options in the Splunk configuration window](/mulesoft/current/en-us/runtime-manager/_images/hybrid-export-splunk-configure-advanced.png)

    Figure 6. The arrow shows the expanded options in the Splunk configuration window.

    See [Splunk Configuration Options](#splunk-configuration-options).

    The **SSL Protocol** option applies only to the REST API data input type.

    > [!IMPORTANT] If you set values for the Splunk index, Splunk source, and Splunk source type
    > when you registered your data input in Splunk, any values you specify in this window overwrite
    > those values.

12. Click **Apply** to save your changes.

### Splunk Configuration Options

Splunk integration includes the following configuration options:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Field</th><th>Description</th><th>Default Value</th></tr></thead><tbody><tr><td><p>Username (Required)</p></td><td><p>Username to connect to Splunk</p></td><td></td></tr><tr><td><p>Password (Required)</p></td><td><p>Password associated with the Splunk username</p></td><td></td></tr><tr><td><p>host (Required)</p></td><td><p>IP address or hostname of the server where Splunk is running</p></td><td></td></tr><tr><td><p>port</p></td><td><p>Splunk management port</p></td><td><p>8089</p></td></tr><tr><td><p>protocol</p></td><td><div><div><p>Protocol for the connection to the Splunk management port</p></div><div><p>Possible values are http, https, and tcp.</p></div></div></td><td><p>https</p></td></tr><tr><td><p>SSL Protocol (REST API only)</p></td><td><div><div><p>SSL Security Protocol to use for the HTTPS connection</p></div><div><p>Possible values are TLSv1_2, TLSv1_1, TLSv1, and SSLv3.</p></div></div></td><td><p>TLSv1_2</p></td></tr><tr><td><p>Splunk Index</p></td><td><div><div><p>Name of the Splunk index to send all events to</p></div><div><p>If the index doesn’t exist, the internal handler creates it if the permissions associated with the username are adequate.</p></div></div></td><td><p>main</p></td></tr><tr><td><p>Splunk Source</p></td><td><p>The source used for events sent to Splunk</p></td><td><p>mule-events</p></td></tr><tr><td><p>Splunk Type</p></td><td><p>The source type used for events sent to Splunk</p></td><td><p>mule</p></td></tr><tr><td><p>Date Format</p></td><td><p>Date format to use to format the timestamp</p></td><td><p>yyyy-MM-dd’T’HH:mm:ssSZ</p></td></tr></tbody></table>

## Integrate with Your ELK Stack

The ELK (Elasticsearch, Logstash, Kibana) stack enables you to store, search, and analyze the log
data.

You can configure the Runtime Manager agent to send event notifications from Mule flows to a
configurable log file. Logstash first captures and indexes the data. Then, you can use Elasticsearch
and Kibana to generate graphs, reports, alerts, dashboards, and visualizations.

### Configure the Log File for Your ELK Stack

To send event notifications to the folder from which your ELK stack reads:

1.  From Anypoint Platform, select **Runtime Manager**.

2.  Click the **Servers** tab.

3.  Click the **Type** column to display the details pane for the server you want to configure.

4.  Click **Manage Server**.

5.  Click the **Plugins** tab:

    ![Event Tracking options](/mulesoft/current/en-us/runtime-manager/_images/hybrid-export-splunk-elk.png)

    Figure 7. The screenshot shows (**1**) the **Event Tracking** options, (**2**) the **Level**
    menu, and (**3**) the gear icon on the server **Plugins** tab.

6.  Select the type of information to send from the **Level** menu.

    See [Logging-Level Options](#logging-level-options).

7.  Under **Event Tracking**, enable **ELK**.

8.  Click the gear icon to configure the log file location for ELK:

    ![Log file location and Show more options switch in the ELK configuration window](/mulesoft/current/en-us/runtime-manager/_images/hybrid-export-elk-configure.png)

    Figure 8. The screenshot shows (**1**) the log file location and (**2**) the **Show more
    options** switch in the ELK configuration window.

    The default location is `$MULE_HOME/logs/events.log`, where `$MULE_HOME` is the location
    specified by the `-Dmule.home` parameter in the `wrapper.conf` file. To change the default
    location, specify the absolute path for the location of your ELK log file, such as
    `/var/logs/elk/events.log`. The specified directory, such as `/var/logs/elk`, must exist.

9.  If you want, click **Show more options** to specify additional properties for the log file:

    ![Expanded options in the ELK configuration window](/mulesoft/current/en-us/runtime-manager/_images/hybrid-export-elk-configure-advanced.png)

    Figure 9. The arrow shows the expanded options in the ELK configuration window.

10. Click **Apply** to save your changes.

> [!NOTE] The event tracking log file (`$MULE_HOME/logs/events-%d{yyyy-dd-MM}-%i.log`) is not
> automatically deleted. You must manually delete the logs periodically.

## Integrate API Analytics with Splunk or ELK

To integrate API Analytics with Splunk or ELK:

1.  [Configure the API Gateway](#configure-the-api-gateway).

2.  [Configure API Analytics to Connect with Splunk or ELK](#configure-api-analytics-to-connect-with-splunk-or-elk).

> [!WARNING] If you configure the API gateway `wrapper.conf` (Step 1) but don’t assign an external
> destination for your data (Step 2), the analytics data accumulates in a queue in the API gateway
> server, which could cause the system to crash.

### Configure the API Gateway

To set up the connection to external analytics tools, configure the API gateway:

1.  In your API gateway standalone directory, open the `conf/wrapper.conf` file.

    The `.<n>` value in the code snippets refers to an integer that is unique within `wrapper.conf`.

2.  Ensure that the following property is set to `true` and that the line is uncommented:

    ```java
    wrapper.java.additional.<n>=-Danypoint.platform.analytics_enabled=true
    ```

3.  Remove the URL from the following line:

    ```java
    wrapper.java.additional.<n>=-Danypoint.platform.analytics_base_uri=https://analytics-ingest.anypoint.mulesoft.com
    ```

    The line now looks like the following:

    ```java
    wrapper.java.additional.<n>=-Danypoint.platform.analytics_base_uri=
    ```

4.  For Anypoint Platform Private Cloud Edition, change the `anypoint.platform.on_prem` parameter to
    `true`:

    ```java
    wrapper.java.additional.<n>=-Danypoint.platform.on_prem=true
    ```

    If you are using the Runtime Manager cloud console, leave this parameter set to the default
    value, `false`.

#### Configure Multiple Consumers

For Mule versions 4.2.0 and later, you can forward events to both an external tool and Anypoint
Platform.

To configure multiple consumers, add the following line to the `wrapper.conf` file:

```java
wrapper.java.additional.<n>=-Danypoint.platform.analytics_multiple_consumers_enabled=true
```

### Configure API Analytics to Connect with Splunk or ELK

After you configure your API gateway, configure Splunk or ELK in Runtime Manager:

1.  From Anypoint Platform, select **Runtime Manager**.

2.  Click the **Servers** tab.

3.  Click the **Type** column to display the details pane for the server you want to configure.

4.  Click **Manage Server**.

5.  Click the **Plugins** tab:

    ![API Analytics options on the server Plugins tab.](/mulesoft/current/en-us/runtime-manager/_images/hybrid-export-api-analytics.png)

    Figure 10. The arrow shows the **API Analytics** options on the server **Plugins** tab.

6.  Under **API Analytics**, enable **ELK** or **Splunk**.

7.  Click the gear icon and continue with Step 8 in the following sections to complete the
    configuration:

    - [Configure Splunk Integration in Runtime Manager](#configure-splunk-integration-in-runtime-manager)

    - [Configure the Log File for Your ELK Stack](#configure-the-log-file-for-your-elk-stack)

## See Also

- [Encrypt Passwords in an Existing mule-agent.yml File](https://docs.mulesoft.com/runtime-manager/installing-and-configuring-runtime-manager-agent#encrypt_password)

- [Servers, Server Groups, and Clusters](https://docs.mulesoft.com/runtime-manager/managing-servers)

- [Monitor Applications and Servers](https://docs.mulesoft.com/runtime-manager/monitoring)

- [Deploy to Your Servers](https://docs.mulesoft.com/runtime-manager/deploying-to-your-own-servers)

- [Manage Deployed Applications](https://docs.mulesoft.com/runtime-manager/managing-deployed-applications)

- [Manage Applications on Your Servers](https://docs.mulesoft.com/runtime-manager/managing-applications-on-your-own-servers)

- [Anypoint Platform Private Cloud Edition](https://docs.mulesoft.com/private-cloud/latest/)

- [Runtime Manager REST API](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/arm-rest-services)