Custom HTTP Endpoint Log integration
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless Observability
Generally available
Serverless Security
Generally available
Stack
9.0+
Generally available since 9.0
| Version | 2.5.0 (View all) |
| Subscription level What's this? |
Basic |
| Developed by What's this? |
Elastic |
| Minimum Kibana version(s) | 9.0.0 8.15.0 |
The custom HTTP Endpoint Log integration initializes a listening HTTP server that collects incoming HTTP POST requests containing a JSON body. The body must be either an object or an array of objects. Any other data types will result in an HTTP 400 (Bad Request) response. For arrays, one document is created for each object in the array.
These are the possible response codes from the server.
| HTTP Response Code | Name | Reason |
|---|---|---|
| 200 | OK | Returned on success. |
| 400 | Bad Request | Returned if JSON body decoding fails. |
| 401 | Unauthorized | Returned when basic auth, secret header, or HMAC validation fails. |
| 405 | Method Not Allowed | Returned if methods other than POST are used. |
| 406 | Not Acceptable | Returned if the POST request does not contain a body. |
| 415 | Unsupported Media Type | Returned if the Content-Type is not application/json. |
| 500 | Internal Server Error | Returned if an I/O error occurs reading the request. |
Custom ingest pipelines may be added by adding the name to the pipeline configuration option, creating custom ingest pipelines can be done either through the API or the Ingest Node Pipeline UI (use the global search field to search for "ingest pipelines").
Changelog
| Version | Details | Minimum Kibana version |
|---|---|---|
| 2.5.0 | Enhancement (View pull request) Update Kibana constraint to support 9.0.0. |
9.0.0 8.15.0 |
| 2.4.0 | Enhancement (View pull request) Note support for base64-encoded HMAC headers. |
8.15.0 |
| 2.3.1 | Bug fix (View pull request) Improve HMAC configuration documentation. |
8.14.0 |
| 2.3.0 | Enhancement (View pull request) Make CEL program configuration available. |
8.14.0 |
| 2.2.1 | Bug fix (View pull request) Pass preserve_original_event state to input. |
8.14.0 |
| 2.2.0 | Enhancement (View pull request) ECS version updated to 8.11.0. Modified the field definitions to remove ECS fields made redundant by the ecs@mappings component template. |
8.14.0 |
| 2.1.0 | Enhancement (View pull request) Provide request tracing support. Enhancement (View pull request) Added test for end-to-end ACK behaviour. Bug fix (View pull request) Clarify supported HMAC header format. |
8.12.0 |
| 2.0.0 | Enhancement (View pull request) Converted package to input type. |
8.12.0 |
| 1.16.0 | Enhancement (View pull request) Allow user selection of HTTP method. |
8.12.0 |
| 1.15.0 | Enhancement (View pull request) Set sensitive values as secret. |
8.12.0 |
| 1.14.1 | Enhancement (View pull request) Changed owners |
8.0.0 7.16.0 |
| 1.14.0 | Enhancement (View pull request) ECS version updated to 8.11.0. |
8.0.0 7.16.0 |
| 1.13.0 | Enhancement (View pull request) ECS version updated to 8.10.0. |
8.0.0 7.16.0 |
| 1.12.0 | Enhancement (View pull request) The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest. |
8.0.0 7.16.0 |
| 1.11.0 | Enhancement (View pull request) Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. |
8.0.0 7.16.0 |
| 1.10.0 | Enhancement (View pull request) Update package to ECS 8.9.0. |
8.0.0 7.16.0 |
| 1.9.1 | Bug fix (View pull request) Fix handling of include header config. |
8.0.0 7.16.0 |
| 1.9.0 | Enhancement (View pull request) Update package to ECS 8.8.0. |
8.0.0 7.16.0 |
| 1.8.0 | Enhancement (View pull request) Update package-spec version to 2.7.0. |
8.0.0 7.16.0 |
| 1.7.0 | Enhancement (View pull request) Update package to ECS 8.7.0. |
8.0.0 7.16.0 |
| 1.6.1 | Enhancement (View pull request) Added categories and/or subcategories. |
8.0.0 7.16.0 |
| 1.6.0 | Enhancement (View pull request) Update package to ECS 8.6.0. |
8.0.0 7.16.0 |
| 1.5.0 | Enhancement (View pull request) Added infrastructure category. |
8.0.0 7.16.0 |
| 1.4.0 | Enhancement (View pull request) Update package to ECS 8.5.0. |
8.0.0 7.16.0 |
| 1.3.0 | Enhancement (View pull request) Update package to ECS 8.4.0 |
8.0.0 7.16.0 |
| 1.2.0 | Enhancement (View pull request) Update package to ECS 8.3.0. |
8.0.0 7.16.0 |
| 1.1.0 | Enhancement (View pull request) Update ECS to 8.2 |
8.0.0 7.16.0 |
| 1.0.1 | Enhancement (View pull request) Update readme |
8.0.0 7.16.0 |
| 1.0.0 | Enhancement (View pull request) Initial Release |
— |