logstash-input-http 3.10.11-java → 3.11.0-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec9cbf6e38c706ab12e7fe22012a9d1396d0830ecd1284c3164df64c73b851ff
-  data.tar.gz: '0084adb55ed70f573f56c2f69aad29cdefd995cf295531a5b362a5747052845a'
+  metadata.gz: 53d4010498cef37711a3510964978b4976d44a6d90df48a5e0d4b449c4c41f1b
+  data.tar.gz: 0eb2c879fca5fe8df5712a4473c5fcfa073fc8d9089658e8b0563f8e3d4d4f1b
 SHA512:
-  metadata.gz: 826b06a29df17eb8bf8b43e1ae8e235c8f16ed458f411542011e386662a20089f9e76422902109528986d640fc28f73e005f38db8ed48d69c4794959edfabf53
-  data.tar.gz: a2757855136c663e1e259415d81b2df70e83eef24085a0772fb0b65cbb1eb0ce4d5bf996e96ae65d49185d2e43ba7cd59b1f80923f60b381b8b423b6bd004bec
+  metadata.gz: e3b6c7260038efc0a58d9319812f902bf4f198cd1d92fcd5c5584e11fd2af3a9d9854a075a494237f98f7d0d286bf11fc3c1876f46b26246bd71ab90eecb1533
+  data.tar.gz: 5df99103b34fd6848355532f1e4beeb70a669fb975966ccc4ccd9e39dc11c35c1a40d202a3f6b30953c3f816ac881d36820530afb4c7060ba2498ce03e3e653d

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 3.11.0
+  - Implements a functionality to log HTTP traffic, disabled by default. To unable switch on debug logs. [#237](https://github.com/logstash-plugins/logstash-input-http/pull/237) 
+
 ## 3.10.11
   - Fix to use the `Content-type` declared charset to decode the request body [#232](https://github.com/logstash-plugins/logstash-input-http/pull/232)
 

data/VERSION

@@ -1 +1 @@
-3.10.11
+3.11.0

data/docs/index.asciidoc

@@ -90,6 +90,33 @@ Values in `additional_codecs` are prioritized over those specified in the
 `codec` option. That is, the default `codec` is applied only if no codec
 for the request's content-type is found in the `additional_codecs` setting.
 
+[id="plugins-{type}s-{plugin}-wire-logging"]
+==== Enable wire logging
+This plugin could log all requests and responses passing through the socket after TLS decoding.
+This functionality helps troubleshoot issues in the processing pipeline that standard 
+external traffic captures, such as `tcpdump`, cannot resolve.
+By default it's disabled, to dump received and sent payloads post-TLS decoding, enable debug logging 
+for `org.logstash.plugins.inputs.http.util.WireLogger`.
+Note: Payloads exceeding 4 KB are automatically truncated to prevent excessive log file growth.
+If you want to set a different limit, then in {ls} `config/jvm.options` configure a value for the system property `logstash.httpinput.wire.dump.size`.
+
+[source,text]
+-----
+-Dlogstash.httpinput.wire.dump.size=512
+-----
+If you want to remove any limit, at the risk of polluting {ls} logs, set it to `0`.
+Admitted values are only integers greater or equals to 0.
+
+To enable it start {ls} in debug mode or configure the `config/log4j2.properties` to include:
+
+[source,text]
+-----
+logger.httpwire.name = org.logstash.plugins.inputs.http.util.WireLogger
+logger.httpwire.level = DEBUG
+-----
+
+WARNING: when this log is enabled the payload is dumped, so if contains secretes those are exposed in {ls} logs.
+
 [id="plugins-{type}s-{plugin}-options"]
 ==== Http Input Configuration Options
 

data/lib/logstash/inputs/http.rb

@@ -204,6 +204,8 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
 
     validate_ssl_settings!
 
+    validate_dump_size_system_property!
+    
     if @user && @password
       token = Base64.strict_encode64("#{@user}:#{@password.value}")
       @auth_token = "Basic #{token}"
@@ -297,6 +299,12 @@ class LogStash::Inputs::Http < LogStash::Inputs::Base
       [http_host, nil]
     end
   end
+  
+  def validate_dump_size_system_property!
+    java_import org.logstash.plugins.inputs.http.util.WireLogger
+    WireLogger.validate_dump_size_property
+  end
+  private :validate_dump_size_system_property!
 
   def validate_ssl_settings!
     ssl_config_name = original_params.include?('ssl') ? 'ssl' : 'ssl_enabled'

data/lib/logstash-input-http_jars.rb

@@ -9,4 +9,4 @@ require_jar('io.netty', 'netty-transport', '4.1.136.Final')
 require_jar('io.netty', 'netty-buffer', '4.1.136.Final')
 require_jar('io.netty', 'netty-resolver', '4.1.136.Final')
 require_jar('io.netty', 'netty-common', '4.1.136.Final')
-require_jar('org.logstash.plugins.input.http', 'logstash-input-http', '3.10.11')
+require_jar('org.logstash.plugins.input.http', 'logstash-input-http', '3.11.0')

data/spec/inputs/http_spec.rb

@@ -55,50 +55,42 @@ describe LogStash::Inputs::Http do
     end
 
     describe "handling overflowing requests with a 429" do
-      let(:logstash_queue_size) { rand(10) + 1 }
-      let(:max_pending_requests) { rand(5) + 1 }
-      let(:threads) { rand(4) + 1 }
+      let(:logstash_queue_size) { 1 }
+      let(:max_pending_requests) { 1 }
+      let(:threads) { 1 }
       let(:logstash_queue) { SizedQueue.new(logstash_queue_size) }
       let(:client_options) { {
-        "request_timeout" => 0.1,
-        "connect_timeout" => 3,
-        "socket_timeout" => 0.1
+        request_timeout: 5,
+        connect_timeout: 3,
+        socket_timeout: 0.5
       } }
 
       let(:config) { { "port" => port, "threads" => threads, "max_pending_requests" => max_pending_requests } }
 
       context "when sending more requests than queue slots" do
         it "rejects additional incoming requests with HTTP 429" do
-          # these will queue and return 200
-          logstash_queue_size.times.each do |i|
+          # fill the pipeline queue so the next push blocks the server worker
+          logstash_queue_size.times do
             response = client.post("http://127.0.0.1:#{port}", :body => '{}').call
             expect(response.code).to eq(200)
           end
 
-          # these will block
-          blocked_calls = (threads + max_pending_requests).times.map do
-            Thread.new do
-              begin
-                {:result => client.post("http://127.0.0.1:#{port}", :body => '{}').call}
-              rescue Manticore::SocketException, Manticore::SocketTimeout => e
-                {:exception => e}
-              end
+          # a blocked request holds its slot even after the client times out, so sending
+          # sequentially fills every worker and backlog slot before the next 429
+          blocked = 0
+          response = nil
+          deadline = Time.now + 30
+          until response && response.code == 429
+            raise "server never returned 429 (blocked=#{blocked})" if Time.now > deadline
+            begin
+              response = client.post("http://127.0.0.1:#{port}", :body => '{}').call
+            rescue Manticore::SocketTimeout
+              blocked += 1
             end
           end
 
-          sleep 1 # let those requests go, but not so long that our block-detector starts emitting 429's
-
-          # by now we should be rejecting with 429 since the backlog is full
-          response = client.post("http://127.0.0.1:#{port}", :body => '{}').call
           expect(response.code).to eq(429)
-
-          # ensure that our blocked connections did block
-          aggregate_failures do
-            blocked_calls.map(&:value).each do |blocked|
-              expect(blocked[:result]).to be_nil
-              expect(blocked[:exception]).to be_a_kind_of Manticore::SocketTimeout
-            end
-          end
+          expect(blocked).to eq(threads + max_pending_requests)
         end
       end
     end
@@ -109,9 +101,9 @@ describe LogStash::Inputs::Http do
       let(:threads) { rand(4) + 1 }
       let(:logstash_queue) { SizedQueue.new(logstash_queue_size) }
       let(:client_options) { {
-        "request_timeout" => 0.1,
-        "connect_timeout" => 3,
-        "socket_timeout" => 0.1
+        request_timeout: 5,
+        connect_timeout: 3,
+        socket_timeout: 1
       } }
 
       let(:config) { { "port" => port, "threads" => threads, "max_pending_requests" => max_pending_requests } }

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: logstash-input-http
 version: !ruby/object:Gem::Version
-  version: 3.10.11
+  version: 3.11.0
 platform: java
 authors:
 - Elastic
 bindir: bin
 cert_chain: []
-date: 2026-07-29 00:00:00.000000000 Z
+date: 2026-08-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstash-core-plugin-api
@@ -176,7 +176,7 @@ files:
 - vendor/jar-dependencies/io/netty/netty-resolver/4.1.136.Final/netty-resolver-4.1.136.Final.jar
 - vendor/jar-dependencies/io/netty/netty-transport-native-unix-common/4.1.136.Final/netty-transport-native-unix-common-4.1.136.Final.jar
 - vendor/jar-dependencies/io/netty/netty-transport/4.1.136.Final/netty-transport-4.1.136.Final.jar
-- vendor/jar-dependencies/org/logstash/plugins/input/http/logstash-input-http/3.10.11/logstash-input-http-3.10.11.jar
+- vendor/jar-dependencies/org/logstash/plugins/input/http/logstash-input-http/3.11.0/logstash-input-http-3.11.0.jar
 homepage: http://www.elastic.co/guide/en/logstash/current/index.html
 licenses:
 - Apache License (2.0)