The in_http Input plugin enables Fluentd to retrieve records from HTTP POST. The URL path becomes the tag of the Fluentd event log and the POSTed body element becomes the record itself.

Example Configuration

in_http is included in Fluentd's core. No additional installation process is required.
@type http
port 8888
body_size_limit 32m
keepalive_timeout 10s
Please see the Config File article for the basic structure and syntax of the configuration file.

Example Usage

The example below posts a record using the curl command.
$ curl -X POST -d 'json={"action":"login","user":2}'


type (required)

The value must be http.


The port to listen to. Default Value = 9880


The bind address to listen to. Default Value = (all addresses)


The size limit of the POSTed element. Default Value = 32MB


The timeout limit for keeping the connection alive. Default Value = 10 seconds


Add HTTP_ prefix headers to the record. The default is false


Add REMOTE_ADDR field to the record. The value of REMOTE_ADDR is the client's address. The default is false
If your system set multiple X-Forwarded-For headers in the request, in_http uses first one. For example:
X-Forwarded-For: host1, host2
X-Forwarded-For: host3
If send above multiple headers, REMOTE_ADDR value is host1.


White list domains for CORS. Default is no check.
If you set ["domain1", "domain2"] to cors_allow_origins, in_http returns 403 to access from othe domains.


The format of the HTTP body. The default is default.
  • default
Accept records using json= / msgpack= style.
  • regexp
Specify body format by regular expression.
format /^(?<field1>\d+):(?<field2>\w+)$/
If you execute following command:
$ curl -X POST -d '123456:awesome' "http://localhost:8888/test.tag.here"
then got parsed result like below:
json, ltsv, tsv, csv and none are also supported. Check parser plugin overview for more details.

log_level option

The log_level option allows the user to set different levels of logging for each plugin. The supported log levels are: fatal, error, warn, info, debug, and trace.
Please see the logging article for further details.

Additional Features

time query parameter

If you want to pass the event time from your application, please use the time query parameter.
$ curl -X POST -d 'json={"action":"login","user":2}'

Batch mode

If you use default format, then you can send array type of json / msgpack to in_http.
$ curl -X POST -d 'json=[{"action":"login","user":2,"time":1392021185},{"action":"logout","user":2,"time":1392027356}]'
This improves the input performance by reducing HTTP access. Non default format doesn't support batch mode yet. Here is a simple bechmark result on MacBook Pro with ruby 2.3:
msgpack array(10 items)
2100 events/sec
2400 events/sec
10000 events/sec
Tested configuration and ruby script is here.


Why in_http removes '+' from my log?

This is HTTP spec, not fluentd problem. You need to encode your payload properly or use multipart request. Here is ruby example:
# OK
URI.encode_www_form({json: {"message" => "foo+bar"}.to_json})
# NG
"json=#{{"message" => "foo+bar"}.to_json}"
curl command example:
# OK
curl -X POST -H 'Content-Type: multipart/form-data' -F 'json={"message":"foo+bar"}' http://localhost:8888/test.tag.here
# NG
curl -X POST -F 'json={"message":"foo+bar"}' http://localhost:8888/test.tag.here
If this article is incorrect or outdated, or omits critical information, please let us know. Fluentd is a open source project under Cloud Native Computing Foundation (CNCF). All components are available under the Apache 2 License.
Last modified 4yr ago