Receive Authorization Header Logstash Http Input Plugin


I am using the HTTP input plugin to receive data from the postman with Basic Auth enabled, "Authorization" header is available in the postman response but when I print the data in logstash I don't see the Authorization header available.

Can someone help so I can receive the Authorization field in the headers list to my logstash?


input {
  http_poller {
    urls => {
      postman => {
        method => get
        url => ""
        headers => {
            "Authorization" => "Basic cG9zdG1hbjpwYXNzd29yZA=="
            "Content-Type" => "application/json"
    schedule => { cron => "* * * * * UTC"}
    codec => "json"
output {
        stdout { codec => rubydebug }


    "authenticated" => true,
         "@version" => "1",
       "@timestamp" => 2020-12-02T19:26:00.891Z

If you are talking about the same postman basic authentication it only returns the authenticated field. Are you able to share your config and what you anticipate the return to be?

1 Like

I have a very vague recollection that the Authorization header is special, and gets consumed by the http server. There is another forum post that suggests this is true, however, I have poked around in github and cannot find anything in logstash or netty that consumes it.

Sadly I cannot find the thread I recall from a couple of years ago on this subject.

Hi Aaron

My HTTP Post and header fields in postman look like this :

Below Logstash config receives data from the postman and displays it

input {
        http {
                port => 7030
                user => "user"
                password => "password"

output {
        stdout{codec => rubydebug}

Output Displayed on logsatsh console where I don't see Authorization field:

      "headers" => {
           "http_accept" => "*/*",
         "cache_control" => "no-cache",
       "http_user_agent" => "PostmanRuntime/7.24.1",
             "http_host" => "lostash_dns:7030",
       "accept_encoding" => "gzip, deflate, br",
          "http_version" => "HTTP/1.1",
            "connection" => "keep-alive",
         "postman_token" => "e430b354-e60c-478f-81ee-761ea0339590",
        "content_length" => "0",
          "request_path" => "/",
        "request_method" => "POST"
         "host" => "",
     "@version" => "1",
   "@timestamp" => 2020-12-03T07:01:00.211Z,
      "message" => ""

Expected Output for me is the field Authorization available in Postman should be received at logstash.

Thanks in advance :slight_smile:


Got it.

I would not expect the authorization field to be returned in Logstash. I couldn't find anything to verify this but I'd think it would be a security concern logging your authorization credentials.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.