# Ingesting ECS ndjson via http\_endpoint?
**URL:** https://discuss.elastic.co/t/ingesting-ecs-ndjson-via-http-endpoint/291023
**Category:** Beats
**Tags:** ecs-elastic-common-schema, filebeat
**Created:** [December 6, 2021, 9:13am UTC](https://discuss.elastic.co/t/ingesting-ecs-ndjson-via-http-endpoint/291023 "2021-12-06T09:13:02Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Matthias\_W](https://discuss.elastic.co/u/Matthias_W)
#### Post date: [December 6, 2021, 9:13am UTC](https://discuss.elastic.co/t/ingesting-ecs-ndjson-via-http-endpoint/291023/1 "2021-12-06T09:13:02Z")
Hi,
I have a C++ application with a custom logging framework.
I was able to modify the framework quite easily to produce ECS-formatted JSON messages. Now, I am trying to use FileBeat to load these log messages into Elastic.
The C++ application is already using WinHTTP to call various REST services, so I thought to just use WinHTTP, too, to send the events to FileBeat.
So far, my FileBeat configuration looks like this:
```auto
- type: http_endpoint
enabled: true
listen_address: "0.0.0.0"
listen_port: 5046
content_type: ""
prefix: "json"
preserve_original_event: true
processors:
- decode_json_fields:
fields: ["event.original"]
overwrite_keys: true
expand_keys: true
add_error_key: true
target: ""
- drop_fields:
fields: ["event.original", "json"]
ignore_missing: true
```
However, I feel that there might be a better way.
If I just change `prefix` to `""`, I receive an error message in the Filebeat log that key names cannot be empty.
Any ideas on how this can be improved?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 3, 2022, 11:13am UTC](https://discuss.elastic.co/t/ingesting-ecs-ndjson-via-http-endpoint/291023/2 "2022-01-03T11:13:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.