http

The in_http Input plugin enables Fluentd to retrieve records from HTTP POST. The URL path becomes the tag of the Fluentd event log and the POSTed body element becomes the record itself.

Example Configuration

in_http is included in Fluentd's core. No additional installation process is required.

<source>
  @type http
  port 8888
  bind 0.0.0.0
  body_size_limit 32m
  keepalive_timeout 10s
</source>

Please see the Config File article for the basic structure and syntax of the configuration file.

Example Usage

The example below posts a record using the curl command.

$ curl -X POST -d 'json={"action":"login","user":2}'
  http://localhost:8888/test.tag.here;

Parameters

type (required)

The value must be http.

port

The port to listen to. Default Value = 9880

bind

The bind address to listen to. Default Value = 0.0.0.0 (all addresses)

body_size_limit

The size limit of the POSTed element. Default Value = 32MB

keepalive_timeout

The timeout limit for keeping the connection alive. Default Value = 10 seconds

add_http_headers

Add HTTP_ prefix headers to the record. The default is false

add_remote_addr

Add REMOTE_ADDR field to the record. The value of REMOTE_ADDR is the client's address. The default is false

If your system set multiple X-Forwarded-For headers in the request, in_http uses first one. For example:

X-Forwarded-For: host1, host2
X-Forwarded-For: host3

If send above multiple headers, REMOTE_ADDR value is host1.

cors_allow_origins

White list domains for CORS. Default is no check.

If you set ["domain1", "domain2"] to cors_allow_origins, in_http returns 403 to access from othe domains.

format

The format of the HTTP body. The default is default.

• default

Accept records using json= / msgpack= style.

• regexp

Specify body format by regular expression.

format /^(?<field1>\d+):(?<field2>\w+)$/

If you execute following command:

$ curl -X POST -d '123456:awesome' "http://localhost:8888/test.tag.here"

then got parsed result like below:

{"field1":"123456","field2":"awesome}

json, ltsv, tsv, csv and none are also supported. Check parser plugin overview for more details.

log_level option

The log_level option allows the user to set different levels of logging for each plugin. The supported log levels are: fatal, error, warn, info, debug, and trace.

Please see the logging article for further details.

Additional Features

time query parameter

If you want to pass the event time from your application, please use the time query parameter.

$ curl -X POST -d 'json={"action":"login","user":2}'
  "http://localhost:8888/test.tag.here?time=1392021185"

Batch mode

If you use default format, then you can send array type of json / msgpack to in_http.

$ curl -X POST -d 'json=[{"action":"login","user":2,"time":1392021185},{"action":"logout","user":2,"time":1392027356}]'
  http://localhost:8888/test.tag.here;

This improves the input performance by reducing HTTP access. Non default format doesn't support batch mode yet. Here is a simple bechmark result on MacBook Pro with ruby 2.3:

json	msgpack	msgpack array(10 items)
2100 events/sec	2400 events/sec	10000 events/sec

Tested configuration and ruby script is here.

FAQ

Why in_http removes '+' from my log?

This is HTTP spec, not fluentd problem. You need to encode your payload properly or use multipart request. Here is ruby example:

# OK
URI.encode_www_form({json: {"message" => "foo+bar"}.to_json})

# NG
"json=#{{"message" => "foo+bar"}.to_json}"

curl command example:

# OK
curl -X POST -H 'Content-Type: multipart/form-data' -F 'json={"message":"foo+bar"}' http://localhost:8888/test.tag.here

# NG
curl -X POST -F 'json={"message":"foo+bar"}' http://localhost:8888/test.tag.here

If this article is incorrect or outdated, or omits critical information, please let us know. Fluentd is a open source project under Cloud Native Computing Foundation (CNCF). All components are available under the Apache 2 License.