Simple question - http input plugin

Elastic Stack Logstash
1

Hi there,
I have a kind of newbie question regarding the http input plugin.
The option host says: The host or ip to bind. I changed the default value from 0.0.0.0 to 192.168.56.112. On this ip I have a virtual box test elastic cluster. So after restricting it to this port I send this from my attached client host having this ip 192.168.56.1:
curl -H 'Content-Type: application/json' -XPUT -i 'http://192.168.56.112:8080' --data '{ "TypeID": 100, "quantity": 200 }'
I was expecting to see NO new event in elasticsearch since I restricted the host plugin to 192.168.56.112, but the event DID arrive.
Therefore my question: What is the function of the host parameter??
Thank you very much.

2

If I'm understanding this, it's early morning...

Host on the input plugin is what IP to "listen" for traffic. The default is to listen on all. "netstat -anp | grep 'LISTEN'" should show port 8080 listening on 192.168.56.112 but not on localhost.

3

The host option controls what ip the http input listens on. You cannot control which ips clients connect from.

4

To get it clear for me, this is what I have defined and running:
...
http{
host => "192.168.56.112"
port => 8080
codec => json
}
...
netstat -anp | grep 'LISTEN'
tcp6 0 0 192.168.56.112:8080 :::* LISTEN 2195/java

Does it then has actually a practical relevance what kind of IP I defnine in host? The client as sender will always send to the server IP ...112 on the port 8080 in this case.
Thank you for your insights!
cheers

5

I think every server I have ever worked on has had multiple IP addresses. The host option determines which of those addresses the input will bind to. 192.168.56.112 is very different to 127.0.0.1...

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.