Add fields to log message using HttpEventCollectorLogbackAppender

curl -k https://<host>:443/services/collector/event -H "Authorization: Splunk <token>" -d '{"event": "Hello, world!", "sourcetype": "test-sourcetype", "host": "test-host", "source": "test-source", "fields":{"app_id":"999999999"}}'

I am trying to replicate the log event above using the HttpEventCollectorLogbackAppender. I can send everything to Splunk except the "fields".

I can see that there is a fields property being added in HecJsonSerializer, and that is for metadata not in the MetadataTags.HEC_TAGS set. I think this is what I need, but I can't figure out a way to add metadata outside that Set through the XML configuration. The metadata is list fixed in lines 75-88 of HttpEventCollectorLogbackAppender.java. How can we add metadata like in the curl request above without having to extend HttpEventCollectorLogbackAppender?

Start with HecJsonSerializer and the metadata handling in HttpEventCollectorLogbackAppender.java, especially lines 75-88, then trace how metadata is read from XML configuration. Compare the appender's generated event with the curl example's fields object. Done means XML configuration can supply metadata outside MetadataTags.HEC_TAGS without requiring a subclass.