138.9. HTTP(s) (om_http)

Table of Contents

This module connects to the specified URL in either plain HTTP or HTTPS mode. The module then waits for a response containing a successful status code (200, 201, or 202). If the remote host closed the connection or a timeout is exceeded while waiting for the response, it reconnects and retries the delivery. This HTTP-level acknowledgment ensures that no messages are lost during the transfer. By default, each event is transferred in a single POST request. However, the module can be configured to send event data in batches to reduce the latency caused by the HTTP responses, thus improving throughput.

138.9.1. Batch processing

Starting with NXLog version 5.2, this module takes advantage of an internal batch processing mechanism which is provided by the NXLog core.

Internal batching works by accumulating multiple successive event records produced by an input or processor module into a batch of records. When a batch is full or after a configurable timeout expires, the batch is forwarded to the next module in the route. For it’s own batching functionality, the om_http module now uses the already available batches it receives from the previous module, instead of reorganizing individual event records into batches itself.

Simply put, the new batching functionality works the same as before, with the difference that event records are organized into batches by input and processor modules, whereas in older versions, it was the output modules which did this. Because of this, the FlushInterval and FlushLimit configuration directives have been deprecated for om_http. The same functionality is now provided by the BatchFlushInterval and BatchSize directives, which can be used with all input and processor module(s).

Note	To examine the supported platforms, see the list of installer packages in the Available Modules chapter.

138.9.2. Configuration

The om_http module accepts the following directives in addition to the common module directives. The URL directive is required.

URL: This mandatory directive specifies the URL for the module to POST the event data. If multiple URL directives are specified on new lines, the module works in a failover configuration. If a destination becomes unavailable, the module automatically fails over to the next one. If the last destination becomes unavailable, the module fails over to the first destination.

The module operates in plain HTTP or HTTPS mode depending on the URL provided. If the port number is not explicitly defined in the URL, it defaults to port 80 for HTTP and port 443 for HTTPS.

AddHeader: This optional directive specifies an additional header to be added to each HTTP request or body part (in Multipart batching mode).

BatchMode

This optional directive sets whether the event data should be sent as a single record per POST request or as a batch of multiple records per POST request. The accepted values are:

none: Event data will be sent as a single record per POST request. This is the default setting.
multipart: The generated POST request will use the multipart/mixed content type, where each record will be sent as a separate body part.
multiline: Batched records will be sent as a single HTTP request, one record per line separated by CRLF (\r\n) characters.
binary: Batched records will be sent as a single HTTP request in the NXLog binary format. This is intended to be used with the im_http input module. The binary value is supported as of version 5.3 and requires the receiving im_http module to be version 5.3 or newer.
jsonarray: Each HTTP request will contain a JSON array, with each array element representing a single record formatted as a JSON object.
ndjson: HTTP requests will contain a newline-delimited list of JSON-formatted records (a.k.a., NDJSON). This is similar to using the multiline batch mode together with the to_json() procedure, except that the Content-Type header is set to application/x-ndjson instead of text/plain. In fact, because this batch mode internally tries to detect if the $raw_event field is already formatted as a JSON object, faster performance may be achieved by using BatchMode multiline with to_json() and ContentType application/x-ndjson.

Note

The add_http_header() and set_http_request_path() procedures may cause the current batch to be flushed immediately. For the multiline batching mode, this happens whenever the value of the URL path or the value of an HTTP header changes, because this requires a new HTTP request to be built. In multipart batching mode, only set_http_request_path() will cause a batch flush when the path value changes, because add_http_header() only modifies the HTTP header for the HTTP body part corresponding to the event record that is currently being processed. Pipelining can somewhat alleviate the performance penalty of using these procedures.

Compression: This directive can be used to enable HTTP compression for outgoing POST messages. The possible values are gzip and deflate. By default, compression is disabled. Please note that some HTTP-server software may not accept compressed POST requests. If a server doesn’t support a specific compression method, it may return 415 Unsupported Media Type errors in response to `om_http’s compressed requests.

ContentType: This directive sets the Content-Type HTTP header to the string specified. The Content-Type is set to one of text/plain, application/binary, application/json or application/x-ndjson by default, depending on the value of the BatchMode directive. Note: If the BatchMode directive is set to multipart, then the value specified here will be used as the Content-Type header for each part of the multipart/mixed HTTP request.

FlushInterval: This directive has been deprecated. See Batch processing for details.

FlushLimit: This directive has been deprecated. See Batch processing for details.

HTTPSAllowUntrusted: This boolean directive specifies that the connection should be allowed without certificate verification. If set to TRUE, the connection will be allowed even if the remote HTTPS server presents an unknown or self-signed certificate. The default value is FALSE: the remote HTTPS server must present a trusted certificate.

HTTPSCADir: This specifies the path to a directory containing certificate authority (CA) certificates, which will be used to check the certificate of the remote HTTPS server. The certificate filenames in this directory must be in the OpenSSL hashed format. A remote’s self-signed certificate (which is not signed by a CA) can also be trusted by including a copy of the certificate in this directory.

HTTPSCAFile: This specifies the path of the certificate authority (CA) certificate, which will be used to check the certificate of the remote HTTPS server. To trust a self-signed certificate presented by the remote (which is not signed by a CA), provide that certificate instead.

HTTPSCAThumbprint: This optional directive specifies the certificate thumbprint of the certificate authority (CA), which is used to look up the CA certificate from the Windows certificate store. The hexadecimal fingerprint string can be copied straight from Windows Certificate Manager (certmgr.msc), whitespaces are automatically removed. This directive is only supported on Windows. This directive and the HTTPSCADir and HTTPSCAFile directives are mutually exclusive.

HTTPSCertFile: This specifies the path of the certificate file to be used for the HTTPS handshake.

HTTPSCertKeyFile: This specifies the path of the certificate key file to be used for the HTTPS handshake.

HTTPSCertThumbprint: This optional directive specifies the certificate thumbprint to be used for the SSL handshake. The hexadecimal fingerprint string can be copied straight from Windows Certificate Manager (certmgr.msc), whitespaces are automatically removed. This directive is only supported on Windows. This directive and the HTTPSCertFile and HTTPSCertKeyFile directives are mutually exclusive.

HTTPSCRLDir: This specifies the path to a directory containing certificate revocation lists (CRLs), which will be consulted when checking the certificate of the remote HTTPS server. The certificate filenames in this directory must be in the OpenSSL hashed format.

HTTPSCRLFile: This specifies the path of the certificate revocation list (CRL) which will be consulted when checking the certificate of the remote HTTPS server.

HTTPSKeyPass: With this directive, a password can be supplied for the certificate key file defined in HTTPSCertKeyFile. This directive is not needed for passwordless private keys.

HTTPSSSLCipher: This optional directive can be used to set the permitted SSL cipher list, overriding the default. Use the format described in the ciphers(1ssl) man page.

HTTPSSSLCiphersuites: This optional directive can be used to define the permitted SSL cipher list in case the HTTPSSSLProtocol directive is set to TLSv1.3. Use the same format as in the HTTPSSSLCipher directive.

HTTPSSSLCompression

This boolean directive allows you to enable data compression when sending data over the network. The compression mechanism is based on the zlib compression library. If the directive is not specified, it defaults to FALSE (the compression is disabled).

Note	Some Linux packages (for example, Debian) use the OpenSSL library provided by the OS and may not support the zlib compression mechanism. The module will emit a warning on startup if the compression support is missing. The generic deb/rpm packages are bundled with a zlib-enabled libssl library.

HTTPSSSLProtocol: This directive can be used to set the allowed SSL/TLS protocol(s). It takes a comma-separated list of values which can be any of the following: SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2 and TLSv1.3. By default, the TLSv1.2 and TLSv1.3 protocols are allowed. Note that the OpenSSL library shipped by Linux distributions may not support SSLv2 and SSLv3, and these will not work even if enabled with this directive.

LocalPort: This optional directive specifies the local port number of the connection. If this is not specified, a random high port number will be used, which is not always ideal in firewalled network environments.

Caution

Due to the required TIME-WAIT delay in closing connections, attempts to bind to LocalPort may fail. In such cases, the message Address already in use will be written to nxlog.log. If the situation persists, it could impede network performance.

Pipeline: This boolean directive can be set to TRUE to enable pipelining of multiple HTTP requests from the same batch, meaning that all requests will be sent first, and then all responses from the server will be handled. HTTP pipelining can improve performance by avoiding head-of-line blocking, but not all HTTP servers support it. The default value is FALSE.

Proxy

This optional directive is used to specify the IP address (or hostname) and port number of the HTTP proxy server to be used. The format is hostname:port. If the port number is ommited, it defaults to 80.

Note	The om_http module supports HTTP proxying only. SOCKS4/SOCKS5 proxying is not supported.

ProxyAddress: This directive has been deprecated. Please use the Proxy directive instead.

ProxyPort: This directive has been deprecated. Please use the Proxy directive instead.

Reconnect: This optional directive sets the reconnect interval in seconds. If it is set, the module attempts to reconnect in every defined second. If it is not set, the reconnect interval will start at 1 second and doubles with every attempt. If the duration of the successful connection is greater than the current reconnect interval, then the reconnect interval will be reset to 1 sec.

Caution

The Reconnect directive must be used with caution. If it is used on multiple systems, it can send reconnect requests simultaneously to the same destination, potentially overloading the destination system. It may also cause NXLog to use unusually high system resources or cause NXLog to become unresponsive.

SNI: This optional directive specifies the host name used for Server Name Indication (SNI) in HTTPS mode.

138.9.3. Procedures

The following procedures are exported by om_http.

add_http_header(string name, string value);

Dynamically add a custom HTTP header to HTTP requests.

Note	This function impacts the way batching works. See the BatchMode directive for more information.

reconnect();

Force a reconnection. This can be used from a Schedule block to periodically reconnect to the server.

Caution

The reconnect() procedure must be used with caution. If configured, it can attempt to reconnect after every event sent, potentially overloading the destination system.

set_http_request_path(string path);

Set the path in the HTTP request to the string specified. This is useful if the URL is dynamic and parameters such as event ID need to be included in the URL. Note that the string must be URL encoded if it contains reserved characters.

Note	This function impacts the way batching works. See the BatchMode directive for more information.

138.9.4. Examples

Example 812. Sending Logs over HTTPS

This configuration reads log messages from file and forwards them via HTTPS.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10

  <Output http>
    Module              om_http
    URL                 https://server:8080/
    AddHeader           Auth-Token: 4ddf1d3c9
    HTTPSCertFile       %CERTDIR%/client-cert.pem
    HTTPSCertKeyFile    %CERTDIR%/client-key.pem
    HTTPSCAFile         %CERTDIR%/ca.pem
    HTTPSAllowUntrusted FALSE
    BatchMode           multipart
</Output>

This configuration sends logs via HTTPS in a failover configuration with multiple instances of the URL directive defined on new lines.

nxlog.conf


  1
2
3
4
5
6
7
8
9
10

  <Output http>
    Module  om_http
    URL     https://server:8080/
    URL     https://192.168.1.1:8080/
    URL     https://example.com:8080/
    HTTPSCertFile       %CERTDIR%/client-cert.pem
    HTTPSCertKeyFile    %CERTDIR%/client-key.pem
    HTTPSCAFile         %CERTDIR%/ca.pem
    HTTPSAllowUntrusted FALSE
</Output>

You are here

138.9. HTTP(s) (om_http) | Log Collection Solutions