Does heartbeat have the ability to capture response headers directly?

Elastic Stack Beats
1

Hello,

I'm currently wondering if Heartbeat has the ability to capture response headers instead of just checking for them, i.e. the event of heartbeat checking an url and then parsing the response headers to elastic.

It would be nice if heartbeat had the possibility to do "http.response.header.contents: always, on error, never"

Is this possible or is it required to combine the inputs form a heartbeat and packetbeat instance, and then create an index pattern?

2

Not currently, but it's a relatively easy add. I've created https://github.com/elastic/beats/pull/18327 to track this.

The PR as written just lets you turn them on or off. Is there a reason you'd only want them on error? Headers tend to be quite small. We created on_error for the body because the contents by default store up to 2KiB.

3

Thank you Andrew.

There was no particular reason for them to be on_error. i am not very experienced with elastic yet so i am not thinking correctly at certain moments. but a certain part of our organisation was wondering if capturing the response headers are possible.

thanks again! Hoping this will be merged or available in the future!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.