How can i restrict only http post api requests to logstash

Elastic Stack Logstash
1

Hi All,

i want to restrict only https POST call to be accepted by logstash

for which i did multiple options in http input section as shown below:

input {
  http {
    port => 5400
        ssl_enabled => true
        ssl_certificate_authorities => ["/etc/gd_#######.crt"]
        ssl_certificate => "/etc/non-p##-#######.crt"
        ssl_key => "/etc/non-p###-#########.key"
        ssl_client_authentication => "required"
        method => "POST"
}
}

but i am getting following error

[ERROR][logstash.inputs.http ] Unknown setting 'method' for http
[2024-02-20T11:53:51,047][ERROR][logstash.agent ] Failed to execute action {

any help or pointers would be appreciated
Thanks

2

You are getting this error because there is no such method option for the http input.

What you want to do is not possible, you will need to have something like a proxy in front of logstash to limit it if you want.

3

Or drop everything which is not method POST:

filter{
# with ECS schema
 if [http][method] != "POST" {
 drop {}
 }
}
1 Like
4

Thanks ,

this will drop the request silently but will not inform anything to client

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.