HTTP Source

The http_server source (also available as http) creates an HTTP server that accepts log data via POST requests. It supports authentication, TLS, compression, and multiple encoding formats.

Configuration

[sources.http_endpoint]
type = "http_server"
address = "0.0.0.0:8080"

Parameters

address

string

required

Socket address to listen on. Must include a port.

address = "0.0.0.0:80"
# or
address = "localhost:8080"

path

string

default:"/"

URL path on which to accept requests.

path = "/logs"

strict_path

boolean

default:"true"

Whether to treat the path as absolute or prefix-based.When false, requests to any path starting with path are accepted.

strict_path = false
path = "/api"
# Accepts /api/v1/logs, /api/v2/logs, etc.

method

string

default:"POST"

HTTP method to accept.Options: GET, POST

method = "POST"

response_code

integer

default:"200"

HTTP status code to return on successful requests.

response_code = 202

headers

array

default:"[]"

List of HTTP headers to include in log events. Supports wildcards.

headers = ["User-Agent", "X-Custom-*", "*"]

query_parameters

array

default:"[]"

List of URL query parameters to include in log events. Supports wildcards.

query_parameters = ["source", "environment", "*"]

path_key

string

default:"path"

Field name for the request URL path.

path_key = "request_path"

host_key

string

Field name for the remote IP address.

host_key = "client_ip"

framing

object

Framing configuration for splitting byte streams.

[sources.http.framing]
method = "newline_delimited"

decoding

object

Decoding configuration for parsing messages.

[sources.http.decoding]
codec = "json"

auth

object

HTTP authentication configuration.

[sources.http.auth]
username = "admin"
password = "secret"

tls

object

TLS configuration for HTTPS.

[sources.http.tls]
enabled = true
crt_file = "/path/to/cert.pem"
key_file = "/path/to/key.pem"

acknowledgements

boolean

default:"false"

Enable end-to-end acknowledgements.

acknowledgements = true

Output Schema

The HTTP source produces log events with the following fields:

Field	Type	Description
`message`	string	The decoded request body
`path`	string	Request URL path
`host`	string	Client IP address (if `host_key` is set)
`timestamp`	timestamp	When the request was received
`source_type`	string	Always “http_server”
Custom headers	varies	Headers matching the `headers` configuration
Query parameters	varies	Parameters matching the `query_parameters` configuration

Examples

Basic HTTP Server

[sources.http_logs]
type = "http_server"
address = "0.0.0.0:8080"
path = "/logs"

HTTPS with Authentication

[sources.secure_http]
type = "http_server"
address = "0.0.0.0:8443"
path = "/v1/logs"

[sources.secure_http.auth]
username = "vector"
password = "${HTTP_PASSWORD}"

[sources.secure_http.tls]
enabled = true
crt_file = "/etc/vector/tls/server.crt"
key_file = "/etc/vector/tls/server.key"

JSON Decoding with Headers

[sources.json_http]
type = "http_server"
address = "0.0.0.0:8080"
headers = ["User-Agent", "X-Request-ID", "X-Forwarded-For"]

[sources.json_http.decoding]
codec = "json"

Query Parameter Extraction

[sources.parameterized]
type = "http_server"
address = "0.0.0.0:8080"
query_parameters = ["application", "environment", "version"]
path_key = "endpoint"

Multiple Paths with Wildcards

[sources.flexible_http]
type = "http_server"
address = "0.0.0.0:8080"
path = "/api"
strict_path = false
headers = ["*"]
query_parameters = ["*"]

Newline-Delimited Text

[sources.text_http]
type = "http_server"
address = "0.0.0.0:8080"

[sources.text_http.framing]
method = "newline_delimited"

[sources.text_http.decoding]
codec = "bytes"

Custom Response Code

[sources.async_http]
type = "http_server"
address = "0.0.0.0:8080"
response_code = 202
acknowledgements = true

How It Works

Request Processing

Client sends HTTP POST request to the configured path
Vector authenticates the request (if auth is configured)
Request body is decompressed (if Content-Encoding header is present)
Body is decoded according to the framing and decoding configuration
Metadata (headers, query params, path) is added to each event
Events are sent through the pipeline
HTTP response is returned (200 or configured response_code)

Compression

The source automatically decompresses requests with:

Content-Encoding: gzip
Content-Encoding: deflate
Content-Encoding: gzip, deflate (multiple encodings)

Authentication

Basic HTTP authentication is supported:

Authorization: Basic <base64(username:password)>

Unauthorized requests receive a 401 response.

Acknowledgements

When acknowledgements are enabled:

Vector waits for events to be delivered to sinks before responding
Failed deliveries result in 400 response
Successful deliveries result in configured response_code

Performance

Can handle thousands of requests per second
Performance depends on request size and decoding complexity
Consider using a load balancer for high-traffic scenarios
Keep-alive connections improve throughput

Best Practices

Use HTTPS in production with valid certificates
Enable authentication for public-facing endpoints
Configure specific paths rather than accepting all paths
Use acknowledgements = true for critical data
Monitor HTTP error rates via Vector’s internal metrics
Set appropriate response_code for async processing (e.g., 202)
Use wildcard header/query extraction sparingly
Configure rate limiting at the load balancer level
Test failure scenarios to ensure proper error handling
Use structured logging (JSON) for better downstream processing

Sending Data

Using curl

# Plain text
curl -X POST http://localhost:8080/logs \
  -d "This is a log line"

# JSON
curl -X POST http://localhost:8080/logs \
  -H "Content-Type: application/json" \
  -d '{"message": "Hello", "level": "info"}'

# Multiple lines
curl -X POST http://localhost:8080/logs \
  -d "Line 1\nLine 2\nLine 3"

# With authentication
curl -X POST http://localhost:8080/logs \
  -u "username:password" \
  -d "Authenticated log"

Sources

Transforms

Sinks

VRL

CLI

API

Configuration

Parameters

Output Schema

Examples

Basic HTTP Server

HTTPS with Authentication

JSON Decoding with Headers

Query Parameter Extraction

Multiple Paths with Wildcards

Newline-Delimited Text

Custom Response Code

How It Works

Request Processing

Compression

Authentication

Acknowledgements

Performance

Best Practices

Sending Data

Using curl

Build docs developers (and LLMs) love

Sources

Transforms

Sinks

VRL

CLI

API

​Configuration

​Parameters

​Output Schema

​Examples

​Basic HTTP Server

​HTTPS with Authentication

​JSON Decoding with Headers

​Query Parameter Extraction

​Multiple Paths with Wildcards

​Newline-Delimited Text

​Custom Response Code

​How It Works

​Request Processing

​Compression

​Authentication

​Acknowledgements

​Performance

​Best Practices

​Sending Data

​Using curl

Build docs developers (and LLMs) love

Configuration

Parameters

Output Schema

Examples

Basic HTTP Server

HTTPS with Authentication

JSON Decoding with Headers

Query Parameter Extraction

Multiple Paths with Wildcards

Newline-Delimited Text

Custom Response Code

How It Works

Request Processing

Compression

Authentication

Acknowledgements

Performance

Best Practices

Sending Data

Using curl