NXLog User Guide

109.13. HTTP(s) (im_http)

This module can be configured to accept HTTP or HTTPS connections. It expects HTTP POST requests from the client. The event message must be in the request body, and will be available in the $raw_event field. The size of the event message must be indicated with Content-Length header. The module will not close the connection while valid requests are received in order to operate in Keep-Alive mode. It will respond with HTTP/1.1 201 Created to each valid POST request. This acknowledgment ensures reliable message delivery.

109.13.1. Configuration

The im_http module accepts the following directives in addition to the common module directives.

ListenAddr: The module will accept connections on this IP address or a DNS hostname. The default is localhost. (This directive is named "Host" in im_tcp/im_ssl for historical reasons.)

Port: The module instance will listen for incoming connections on this port. The default is port 80.

HTTPSAllowUntrusted: This boolean directive specifies that the remote connection should be allowed without certificate verification. If set to TRUE the remote will be able to connect with an unknown or self-signed certificate. The default value is FALSE: all HTTPS connections must present a trusted certificate.

HTTPSCADir: This specifies the path to a directory containing certificate authority (CA) certificates, which will be used to check the certificate of the remote HTTPS client. The certificate filenames in this directory must be in the OpenSSL hashed format. A remote’s self-signed certificate (which is not signed by a CA) can also be trusted by including a copy of the certificate in this directory.

HTTPSCAFile: This specifies the path of the certificate authority (CA) certificate, which will be used to check the certificate of the remote HTTPS client. To trust a self-signed certificate presented by the remote (which is not signed by a CA), provide that certificate instead.

HTTPSCertFile: This specifies the path of the certificate file to be used for the HTTPS handshake.

HTTPSCertKeyFile: This specifies the path of the certificate key file to be used for the HTTPS handshake.

HTTPSCRLDir: This specifies the path to a directory containing certificate revocation lists (CRLs), which will be consulted when checking the certificate of the remote HTTPS client. The certificate filenames in this directory must be in the OpenSSL hashed format.

HTTPSCRLFile: This specifies the path of the certificate revocation list (CRL) which will be consulted when checking the certificate of the remote HTTPS client.

HTTPSKeyPass: With this directive, a password can be supplied for the certificate key file defined in HTTPSCertKeyFile. This directive is not needed for passwordless private keys.

HTTPSRequireCert: This boolean directive specifies that the remote HTTPS client must present a certificate. If set to TRUE and there is no certificate presented during the connection handshake, the connection will be refused. The default value is TRUE: each connection must use a certificate.

HTTPSSSLCipher: This optional directive can be used to set the permitted SSL cipher list, overriding the default. Use the format described in the ciphers(1ssl) man page.

HTTPSSSLCompression

This boolean directive allows you to enable data compression when sending data over the network. The compression mechanism is based on the zlib compression library. If the directive is not specified, it defaults to FALSE (the compression is disabled).

Note	Some Linux packages (for example, Debian) use the OpenSSL library provided by the OS and may not support the zlib compression mechanism. The module will emit a warning on startup if the compression support is missing. The generic deb/rpm packages are bundled with a zlib-enabled libssl library.

HTTPSSSLProtocol: This directive can be used to set the allowed SSL/TLS protocol(s). It takes a comma-separated list of values which can be any of the following: SSLv2, SSLv3, TLSv1, TLSv1.1, and TLSv1.2. By default, the TLSv1, TLSv1.2, and TLSv1.2 protocols are allowed. Note that the OpenSSL library shipped by Linux distributions may not support SSLv2 and SSLv3, in which case these will not work even if enabled with HTTPSSSSLProtocol.

109.13.2. Fields

The following fields are used by im_http.

$raw_event (type: string): The content received in the POST request.

$MessageSourceAddress (type: string): The IP address of the remote host.

109.13.3. Examples

Example 551. Receiving Logs over HTTPS

This configuration listens for HTTPS connections from localhost. Received log messages are written to file.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

  <Input http>
    Module              im_http
    ListenAddr          127.0.0.1
    Port                8888
    HTTPSCertFile       %CERTDIR%/server-cert.pem
    HTTPSCertKeyFile    %CERTDIR%/server-key.pem
    HTTPSCAFile         %CERTDIR%/ca.pem
    HTTPSRequireCert    TRUE
    HTTPSAllowUntrusted FALSE
</Input>

<Output file>
    Module              om_file
    File                'output.log'
</Output>

<Route http_to_file>
    Path                http => file
</Route>