No 'Access-Control-Allow-Origin- http plugin logstash

[adhikz (adhikar)]

I am current trying to do a JavaScript post to Logstash by using a tcp input.

JavaScript Post

 xhr = new XMLHttpRequest();
 var url = "http://localhost:5043";
 xhr.open("POST", url, true);
 xhr.setRequestHeader("Content-type", "application/json");
 var data = JSON.stringify({"test" : hello});
 xhr.send(data);

Logstash config file

input {
	tcp {
		port => 5043
	}
}

filter{
}

output {
  stdout  { 
		codec => rubydebug
	}
}

Output in console

{
       "message" => "OPTIONS / HTTP/1.1\r",
      "@version" => "1",
    "@timestamp" => "2016-12-15T09:58:54.611Z",
          "host" => "0:0:0:0:0:0:0:1",
          "port" => 55867,
  
}
{
       "message" => "Host: localhost:5043\r",
      "@version" => "1",
    "@timestamp" => "2016-12-15T09:58:54.620Z",
          "host" => "0:0:0:0:0:0:0:1",
          "port" => 55867,
 
}
{
       "message" => "Connection: keep-alive\r",
      "@version" => "1",
    "@timestamp" => "2016-12-15T09:58:54.621Z",
          "host" => "0:0:0:0:0:0:0:1",
          "port" => 55867,
  
}
{
       "message" => "Access-Control-Request-Method: POST\r",
      "@version" => "1",
    "@timestamp" => "2016-12-15T09:58:54.622Z",
          "host" => "0:0:0:0:0:0:0:1",
          "port" => 55867,
    
}
{
       "message" => "Origin: http://atgdev11\r",
      "@version" => "1",
    "@timestamp" => "2016-12-15T09:58:54.623Z",
          "host" => "0:0:0:0:0:0:0:1",
          "port" => 55867,
      
}
{
       "message" => "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36\r",
      "@version" => "1",
    "@timestamp" => "2016-12-15T09:58:54.626Z",
          "host" => "0:0:0:0:0:0:0:1",
          "port" => 55867,
      
}
{
       "message" => "Access-Control-Request-Headers: content-type\r",
      "@version" => "1",
    "@timestamp" => "2016-12-15T09:58:54.634Z",
          "host" => "0:0:0:0:0:0:0:1",
          "port" => 55867,
    
}
{
       "message" => "Accept: */*\r",
      "@version" => "1",
    "@timestamp" => "2016-12-15T09:58:54.651Z",
          "host" => "0:0:0:0:0:0:0:1",
          "port" => 55867,
   
}
{
       "message" => "Referer: http://test/Welcome.jsp\r",
      "@version" => "1",
    "@timestamp" => "2016-12-15T09:58:54.653Z",
          "host" => "0:0:0:0:0:0:0:1",
          "port" => 55867,
  
}
{
       "message" => "Accept-Encoding: gzip, deflate, sdch, br\r",
      "@version" => "1",
    "@timestamp" => "2016-12-15T09:58:54.719Z",
          "host" => "0:0:0:0:0:0:0:1",
          "port" => 55867,

}
{
       "message" => "Accept-Language: en-US,en;q=0.8\r",
      "@version" => "1",
    "@timestamp" => "2016-12-15T09:58:54.720Z",
          "host" => "0:0:0:0:0:0:0:1",
          "port" => 55867,
   
}

I cant seem to see my json data {"test" : hello} passing into logstash could there be something wrong with my logstash.config file ? Please help

I have also tried the following :

input {
http {
port => 5043
}
}

I get the following error is broswser : XMLHttpRequest cannot load http://localhost:5043/. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://test/' is therefore not allowed access.

Please guide me in the right direction as to what I need to look at ? I am very new to the ELK stack

Thanks

[magnusbaeck (Magnus Bäck)]

I'm not sure there's a good way around this right now. AJAX requires the preflight check to pass and the http input doesn't respond to those (maybe it should?), and the tcp input isn't meant to be used for HTTP.

[adhikz (adhikar)]

Hi @magnusbaeck thank you for your response, sorry for the late reply. After some digging I manage to find a solution to this by adding the following to my logstash.conf file :

http {
host => "localhost"
port => 5043
response_headers => {
"Access-Control-Allow-Origin" => "*"
"Content-Type" => "text/plain"
"Access-Control-Allow-Headers" => "Origin, X-Requested-With, Content-Type, Accept"
}
}

I used the http plugin for logstash. Thank you.