The in_http Input plugin enables Fluentd to retrieve records from HTTP POST. The URL path becomes the tag of the Fluentd event log and the POSTed body element becomes the record itself.

Example Configuration

in_http is included in Fluentd's core. No additional installation process is required.

  @type http
  port 8888
  body_size_limit 32m
  keepalive_timeout 10s

Please see the Config File article for the basic structure and syntax of the configuration file.

Example Usage

The example below posts a record using the curl command.

$ curl -X POST -d 'json={"action":"login","user":2}'


type (required)

The value must be http.


The port to listen to. Default Value = 9880


The bind address to listen to. Default Value = (all addresses)


The size limit of the POSTed element. Default Value = 32MB


The timeout limit for keeping the connection alive. Default Value = 10 seconds


Add HTTP_ prefix headers to the record. The default is false


Add REMOTE_ADDR field to the record. The value of REMOTE_ADDR is the client's address. The default is false

If your system set multiple X-Forwarded-For headers in the request, in_http uses first one. For example:

X-Forwarded-For: host1, host2
X-Forwarded-For: host3

If send above multiple headers, REMOTE_ADDR value is host1.


White list domains for CORS. Default is no check.

If you set ["domain1", "domain2"] to cors_allow_origins, in_http returns 403 to access from othe domains.


The format of the HTTP body. The default is default.

  • default

Accept records using json= / msgpack= style.

  • regexp

Specify body format by regular expression.

format /^(?<field1>\d+):(?<field2>\w+)$/

If you execute following command:

$ curl -X POST -d '123456:awesome' "http://localhost:8888/"

then got parsed result like below:


json, ltsv, tsv, csv and none are also supported. Check parser plugin overview for more details.

log_level option

The log_level option allows the user to set different levels of logging for each plugin. The supported log levels are: fatal, error, warn, info, debug, and trace.

Please see the logging article for further details.

Additional Features

time query parameter

If you want to pass the event time from your application, please use the time query parameter.

$ curl -X POST -d 'json={"action":"login","user":2}'

Batch mode

If you use default format, then you can send array type of json / msgpack to in_http.

$ curl -X POST -d 'json=[{"action":"login","user":2,"time":1392021185},{"action":"logout","user":2,"time":1392027356}]'

This improves the input performance by reducing HTTP access. Non default format doesn't support batch mode yet. Here is a simple bechmark result on MacBook Pro with ruby 2.3:



msgpack array(10 items)

2100 events/sec

2400 events/sec

10000 events/sec

Tested configuration and ruby script is here.


Why in_http removes '+' from my log?

This is HTTP spec, not fluentd problem. You need to encode your payload properly or use multipart request. Here is ruby example:

# OK
URI.encode_www_form({json: {"message" => "foo+bar"}.to_json})

# NG
"json=#{{"message" => "foo+bar"}.to_json}"

curl command example:

# OK
curl -X POST -H 'Content-Type: multipart/form-data' -F 'json={"message":"foo+bar"}' http://localhost:8888/

# NG
curl -X POST -F 'json={"message":"foo+bar"}' http://localhost:8888/

If this article is incorrect or outdated, or omits critical information, please let us know. Fluentd is a open source project under Cloud Native Computing Foundation (CNCF). All components are available under the Apache 2 License.

Last updated