Receive Authorization Header Logstash Http Input Plugin

Elastic Stack Logstash
1

Hi,

I am using the HTTP input plugin to receive data from the postman with Basic Auth enabled, "Authorization" header is available in the postman response but when I print the data in logstash I don't see the Authorization header available.

Can someone help so I can receive the Authorization field in the headers list to my logstash?

Thanks,
Sai

2 
input {
  http_poller {
    urls => {
      postman => {
        method => get
        url => "https://postman-echo.com/basic-auth"
        headers => {
            "Authorization" => "Basic cG9zdG1hbjpwYXNzd29yZA=="
            "Content-Type" => "application/json"
        }
     }
    }
    schedule => { cron => "* * * * * UTC"}
    codec => "json"
  }
}
output {
        stdout { codec => rubydebug }
}

returns

{
    "authenticated" => true,
         "@version" => "1",
       "@timestamp" => 2020-12-02T19:26:00.891Z
}

If you are talking about the same postman basic authentication it only returns the authenticated field. Are you able to share your config and what you anticipate the return to be?

1 Like
3

I have a very vague recollection that the Authorization header is special, and gets consumed by the http server. There is another forum post that suggests this is true, however, I have poked around in github and cannot find anything in logstash or netty that consumes it.

Sadly I cannot find the thread I recall from a couple of years ago on this subject.

4

Hi Aaron

My HTTP Post and header fields in postman look like this :

image
image1519×674 58.7 KB

Below Logstash config receives data from the postman and displays it

input {
        http {
                port => 7030
                user => "user"
                password => "password"
        }
}

output {
        stdout{codec => rubydebug}
}

Output Displayed on logsatsh console where I don't see Authorization field:

{
      "headers" => {
           "http_accept" => "*/*",
         "cache_control" => "no-cache",
       "http_user_agent" => "PostmanRuntime/7.24.1",
             "http_host" => "lostash_dns:7030",
       "accept_encoding" => "gzip, deflate, br",
          "http_version" => "HTTP/1.1",
            "connection" => "keep-alive",
         "postman_token" => "e430b354-e60c-478f-81ee-761ea0339590",
        "content_length" => "0",
          "request_path" => "/",
        "request_method" => "POST"
   },
         "host" => "192.xxx.xxx.xx",
     "@version" => "1",
   "@timestamp" => 2020-12-03T07:01:00.211Z,
      "message" => ""
}

Expected Output for me is the field Authorization available in Postman should be received at logstash.

Thanks in advance :slight_smile:

Regadrs,
Sai

5

Got it.

I would not expect the authorization field to be returned in Logstash. I couldn't find anything to verify this but I'd think it would be a security concern logging your authorization credentials.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.