# Filter on TCP input plugin

**URL:** <https://discuss.elastic.co/t/filter-on-tcp-input-plugin/197083>\
**Category:** Logstash\
**Created:** [August 28, 2019, 10:15am UTC](https://discuss.elastic.co/t/filter-on-tcp-input-plugin/197083 "2019-08-28T10:15:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DZ1](https://avatars.discourse-cdn.com/v4/letter/d/b487fb/32.png) [@DZ1](https://discuss.elastic.co/u/DZ1)\
**Post date:** [August 28, 2019, 10:15am UTC](https://discuss.elastic.co/t/filter-on-tcp-input-plugin/197083/1 "2019-08-28T10:15:47Z")

</div>

I am fetching input using the TCP input plugin. I am hitting TCP endpoint with an API so while fetching data from the endpoint it fetches data like header information (Content-length, User-Agent etc) . So is there any way for fetching the only body of request?  
Here are my configs for input plugin:

````auto
input {
	tcp {
		port => 5000
	}
}

filter {
  mutate {
      remove_field => ["host", "@version", "@timestamp", "port"]
  }
}

output {
      stdout { }
      kafka {
        bootstrap_servers => "kafka:9092"
        topic_id => "Topic"
     }
}```
````

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 28, 2019, 11:45am UTC](https://discuss.elastic.co/t/filter-on-tcp-input-plugin/197083/2 "2019-08-28T11:45:03Z")

</div>

The tcp input has no conception of headers vs. body. It just reads lines of data. Perhaps an http input would be a better fit for your use case.

---

<div class="post-metadata">

**Author:** ![DZ1](https://avatars.discourse-cdn.com/v4/letter/d/b487fb/32.png) [@DZ1](https://discuss.elastic.co/u/DZ1)\
**Post date:** [August 28, 2019, 12:03pm UTC](https://discuss.elastic.co/t/filter-on-tcp-input-plugin/197083/3 "2019-08-28T12:03:24Z")

</div>

@ [Badger] Thank you. I will check that

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 25, 2019, 12:03pm UTC](https://discuss.elastic.co/t/filter-on-tcp-input-plugin/197083/4 "2019-09-25T12:03:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.