Http input return code

Elastic Stack Logstash
1

Hi,

I am testing the http input plugin with logstash 5.6 and I didn't find a way to answer something else than "ok". For instance, could something in the logstash pipeline filter control what to send back (e.g. an error if the payload isn't a valid one).

I saw another discussion (issue #48) on the Github http input plugin repository, but this was related to errors with the pipeline output. In my case, checking for validity could be done "immediately".

Thanks

1 Like
2

I had a look at the code. The question you need to answer is "What/how will you decide what is valid and what is not valid?"

If the payload should be JSON and sometimes it is not then you can use the JSON codec - any invalid JSON will raise an error and the input will return a 500 http status reply.
The only way to have anything other than 200 be returned is to have a codec that raises an error if the payload is not valid. So if you need more complex validation than an existing codec can provide then you need to create a own custom codec.

3

Thanks for your answer.

Actually, what I am looking for is to use the request path to decode the payload with specific filters and decide where to output data to. If the request path isn't valid (not one I am expecting), or even, if the specific filters don't match, I would like to send an error back instead of "ok".

I will have to find other ways to report such errors back. Currently, I am storing such invalid data into a specific index, but I was looking for a way to send immediate feedback.

4

I understand your validation requirements.
The http response will be sent to the client as soon as the event has been created and put in the internal queue - this means you will not be able to use Logstash filters to change the http response because by the time the filter operate on the event the http request/response is finished.

If by "filters" you mean validation check done in a custom codec then that is do-able.

For this validation you will need a custom codec

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.