logstash-input-http icon indicating copy to clipboard operation
logstash-input-http copied to clipboard

Avoid existing data (if present) in the received json event from being overwritten by added ECS metadata.

Open kxs-who opened this issue 2 years ago • 0 comments

According to the documentation (https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http.html#plugins-inputs-http-ecs_metadata), the following ECS metadata is populated by the http input plugin:

  • Host IP address
  • Complete HTTP headers
  • HTTP version
  • client user agent
  • host domain and port
  • HTTP method
  • Query path
  • Request content length
  • Request mime type

The following issue was logged because the host field was being overwritten: https://github.com/logstash-plugins/logstash-input-http/issues/61 We would like the http input plugin to have a way to prevent overwriting not just the host metadata but all metadata.

kxs-who avatar Feb 07 '23 18:02 kxs-who