This module connects to the specified URL in either plain HTTP or HTTPS mode. The module then waits for a response containing a successful status code (200, 201, or 202). All HTTP response codes other than 200, 201 and 202 are treated as errors, and by default, they are handled by resending the affected event records. If the remote host closed the connection or a timeout is exceeded while waiting for the response, it reconnects and retries the delivery. This HTTP-level acknowledgment ensures that no messages are lost during the transfer. By default, each event is transferred in a single POST request. However, the module can be configured to send event data in batches to reduce the latency caused by the HTTP responses, thus improving throughput.
This mandatory directive specifies the URL for the module to POST the event data. If multiple URL directives are specified on new lines, the module works in a failover configuration. If a destination becomes unavailable, the module automatically fails over to the next one. If the last destination becomes unavailable, the module fails over to the first destination.
The module operates in plain HTTP or HTTPS mode depending on the URL provided. If the port number is not explicitly defined in the URL, it defaults to port 80 for HTTP and port 443 for HTTPS.
This optional directive specifies an additional header to be added to each HTTP request or body part (in
This optional directive sets whether the event data should be sent as a single record per POST request or as a batch of multiple records per POST request. The accepted values are:
Event data will be sent as a single record per POST request. This is the default setting.
The generated POST request will use the
multipart/mixedcontent type, where each record will be sent as a separate body part.
Batched records will be sent as a single HTTP request, one record per line separated by CRLF (
Batched records will be sent as a single HTTP request in the NXLog binary format. This is intended to be used with the im_http input module. The
binaryvalue is supported as of version 5.3 and requires the receiving im_http module to be version 5.3 or newer.
Each HTTP request will contain a JSON array, with each array element representing a single record formatted as a JSON object.
HTTP requests will contain a newline-delimited list of JSON-formatted records (a.k.a., NDJSON). This is similar to using the
multilinebatch mode together with the to_json() procedure, except that the
Content-Typeheader is set to
text/plain. In fact, because this batch mode internally tries to detect if the
$raw_eventfield is already formatted as a JSON object, faster performance may be achieved by using
The add_http_header() and
may cause the current batch to be flushed immediately. For the
batching mode, this happens whenever the value of the URL path or the
value of an HTTP header changes, because this requires a new HTTP
request to be built. In
multipart batching mode, only
set_http_request_path() will cause a batch flush when the path value
add_http_header() only modifies the HTTP header for the
HTTP body part corresponding to the event record that is currently being
processed. Pipelining can somewhat alleviate
the performance penalty of using these procedures.
This directive can be used to enable HTTP compression for outgoing HTTP messages. The possible values are
deflate. By default, compression is disabled. Please note that some HTTP-server software may not accept compressed HTTP requests. If a server doesn’t support a specific compression method, it may return
415 Unsupported Media Typeerrors in response to `om_http’s compressed requests. However, if a server supports RFC7694, the compression method specified through this directive is only used as a hint; if the server doesn’t support the same compression method, a different method will be used instead, picked from the last server-sent Accept-Encoding header value.
This directive sets the Content-Type HTTP header to the string specified. The Content-Type is set to one of
application/x-ndjsonby default, depending on the value of the BatchMode directive. Note: If the BatchMode directive is set to
multipart, then the value specified here will be used as the Content-Type header for each part of the
This directive sets HTTP request method. The possible values are
PUT. The default value is
This directive has been deprecated. See Batch processing for details.
This directive has been deprecated. See Batch processing for details.
HTTP basic authorization username.
HTTP basic authorization password.
|HTTP authorization works only when both parameters are set.
This boolean directive specifies whether the connection should be allowed with an expired certificate. If set to
TRUE, the connection will be allowed even if the remote server presents an expired certificate. The default is
FALSE: the remote server must present a certificate that is not expired.
This boolean directive specifies that the connection should be allowed regardless of the certificate verification results. If set to
TRUE, the connection will be allowed with any unexpired certificate provided by a server. The default value is
FALSE: the remote server must present a trusted certificate.
This directive specifies a path to a directory containing certificate authority (CA) certificates. These certificates will be used to verify the certificate presented by the remote server. The certificate files must be named using the OpenSSL hashed format, i.e. the hash of the certificate followed by .0, .1 etc. To find the hash of a certificate using OpenSSL:
$ openssl x509 -hash -noout -in ca.crt
For example if the certificate hash is
e2f14e4a, then the certificate filename should be
e2f14e4a.0. If there is another certificate with the same hash then it should be named
e2f14e4a.1and so on.
A remote server’s self-signed certificate (which is not signed by a CA) can also be trusted by including a copy of the certificate in this directory.
Unix-like operating systems use the
/etc/ssl/certspath as their default for certificates. Windows uses the Windows Certificate Store as a default path for certificates. MacOS uses the Keychain Access Application as the default store for certificates.
This specifies the path of the certificate authority (CA) certificate that will be used to verify the certificate presented by the remote server. A remote server’s self-signed certificate (which is not signed by a CA) can be trusted by specifying the remote server certificate itself. In case of certificates signed by an intermediate CA, the certificate specified must contain the complete certificate chain (certificate bundle).
This optional directive specifies the thumbprint of the certificate authority (CA) certificate that will be used to verify the certificate presented by the remote server. The hexadecimal fingerprint string can be copied from Windows Certificate Manager (certmgr.msc). Whitespaces are automatically removed. The certificate must be added to a Windows certificate store that is accessible by NXLog. This directive is only supported on Windows and is mutually exclusive with the HTTPSCADir and HTTPSCAFile directives.
This optional boolean directive, when set to
TRUE, enables the loading of all available Windows certificates into NXLog, for use during remote certificate verification. Any required certificates must be added to a Windows certificate store that NXLog can access. This directive is mutually exclusive with the HTTPSCAThumbprint, HTTPSCADir and HTTPSCAFile directives.
This specifies the path of the certificate file that will be presented to the remote server during the HTTPS handshake.
This specifies the path of the private key file that was used to generate the certificate specified by the HTTPSCertFile directive. This is used for the HTTPS handshake.
This optional directive specifies the thumbprint of the certificate that will be presented to the remote server during the HTTPS handshake. The hexadecimal fingerprint string can be copied from Windows Certificate Manager (certmgr.msc). Whitespaces are automatically removed. The certificate must be imported to the
Local Computer\Personalcertificate store in PFX format for NXLog to find it. To create a PFX file from the certificate and private key using OpenSSL:
$ openssl pkcs12 -export -out server.pfx -inkey server.key -in server.pem
This directive specifies a path to a directory containing certificate revocation list (CRL) files. These CRL files will be used to check for certificates that were revoked and should no longer be accepted. The files must be named using the OpenSSL hashed format, i.e. the hash of the issuer followed by .r0, .r1 etc. To find the hash of the issuer of a CRL file using OpenSSL:
$ openssl crl -hash -noout -in crl.pem
For example if the hash is
e2f14e4a, then the filename should be
e2f14e4a.r0. If there is another file with the same hash then it should be named
e2f14e4a.r1and so on.
This specifies the path of the certificate revocation list (CRL) which will be used to check for certificates that have been revoked and should no longer be accepted. Example to generate a CRL file using OpenSSL:
$ openssl ca -gencrl -out crl.pem
This directive specifies the passphrase of the private key specified by the HTTPSCertKeyFile directive. A passphrase is required when the private key is encrypted. Example to generate a private key with Triple DES encryption using OpenSSL:
$ openssl genrsa -des3 -out server.key 2048
This directive is not needed for passwordless private keys.
This optional directive can be used to set the permitted SSL cipher list, overriding the default. Use the format described in the ciphers(1ssl) man page. For example specify
RSA:!COMPLEMENTOFALLto include all ciphers with RSA authentication but leave out ciphers without encryption.
|If RSA or DSA ciphers with Diffie-Hellman key exchange are used, DHFile can be set for specifying custom dh-parameters.
This optional directive can be used to set the permitted cipher list for TLSv1.3. Use the same format as in the HTTPSSSLCipher directive. Refer to the OpenSSL documentation for a list of valid TLS v1.3 cipher suites. The default value is:
This boolean directive allows you to enable data compression when sending data over the network. The compression mechanism is based on the zlib compression library. If the directive is not specified, it defaults to
FALSE: compression is disabled.
Some Linux packages (for example, Debian) use the OpenSSL library provided by the OS and may not support the zlib compression mechanism. The module will emit a warning on startup if the compression support is missing. The generic deb/rpm packages are bundled with a zlib-enabled libssl library.
This directive can be used to set the allowed SSL/TLS protocol(s). It takes a comma-separated list of values which can be any of the following:
TLSv1.3. By default, the
TLSv1.3protocols are allowed. Note that the OpenSSL library shipped by Linux distributions may not support
SSLv3, and these will not work even if enabled with this directive.
This optional directive specifies the local port number of the connection. If this is not specified, a random high port number will be used, which is not always ideal in firewalled network environments.
Due to the required
TIME-WAITdelay in closing connections, attempts to bind to
LocalPortmay fail. In such cases, the message
Address already in usewill be written to
nxlog.log. If the situation persists, it could impede network performance.
This optional block directive can be used to specify a group of statements to handle HTTP errors. All HTTP response codes other than 200, 201 and 202 are treated as errors, and by default, they are handled by resending the affected event records. OnError can be used to perform custom error handling. For example, event records which are rejected by the receiver with a known HTTP error code, possibly due to unrecoverable formatting errors, can be droppped or rerouted. Note that if the original HTTP request contains multiple records (a batch), the rerouting breaks the batch up and sends one record per HTTP request. Only one OnError block directive can be specified per om_http module instance. The following sub-directives can be used inside this block.
This optional directive specifies the statements to execute when om_http receives an HTTP error response. Like the normal Exec directive, OnError Exec can be specified as a normal directive or as a block directive. The get_response_code() and get_retry_count() functions can be used inside OnError Exec.
This optional directive specifies the maximum number of times that an event record can be re-sent in case of HTTP errors. When this limit is reached, the event record will be dropped. By default, the module will always try to resend failed records, until they succeed or are dropped via OnError Exec. This directive is basically just a shortcut for
drop()-ing records whenever the retry count reaches a certain limit. Note that using this directive can result in unexpected data loss, so it should be used sparingly.
This boolean directive can be set to
TRUEto enable pipelining of multiple HTTP requests from the same batch, meaning that all requests will be sent first, and then all responses from the server will be handled. HTTP pipelining can improve performance by avoiding head-of-line blocking, but not all HTTP servers support it. The default value is
This optional directive is used to specify the IP address (or hostname) and port number of the HTTP proxy server to be used. The format is
hostname:port. If the port number is ommited, it defaults to 80.
The om_http module supports HTTP proxying only. SOCKS4/SOCKS5 proxying is not supported.
This directive has been deprecated. Please use the Proxy directive instead.
This directive has been deprecated. Please use the Proxy directive instead.
This optional directive sets the reconnect interval in seconds. If it is set, the module attempts to reconnect in every defined second. If it is not set, the reconnect interval will start at 1 second and doubles with every attempt. If the duration of the successful connection is greater than the current reconnect interval, then the reconnect interval will be reset to 1 sec.
The Reconnect directive must be used with caution. If it is used on multiple systems, it can send reconnect requests simultaneously to the same destination, potentially overloading the destination system. It may also cause NXLog to use unusually high system resources or cause NXLog to become unresponsive.
This optional directive specifies the hostname used for Server Name Indication (SNI) in HTTPS mode. If not specified, it defaults to the hostname in the URL directive.
The following functions are exported by om_http.
Returns the last received HTTP response code for the current record. Note that due to batching, the same response code value may be returned for multiple event records, when the retry count is
0. After the first HTTP error is received for a batch request, that request is split into separate requests per record, so the response code can be assumed to be per-record only when the retry count is greater than
0. This function can only be used inside OnError Exec blocks.
Returns the retry count for the current record. The retry count starts at
0when processing the first HTTP response received for a batched request, and is incremented by
1for every subsequent response for the same record. This function can only be used inside OnError Exec blocks.
The following procedures are exported by om_http.
Force a reconnection. This can be used from a Schedule block to periodically reconnect to the server.
The reconnect() procedure must be used with caution. If configured, it can attempt to reconnect after every event sent, potentially overloading the destination system.
Set the path in the HTTP request to the string specified. This is useful if the URL is dynamic and parameters such as event ID need to be included in the URL. Note that the string must be URL encoded if it contains reserved characters.
This function impacts the way batching works. See the BatchMode directive for more information.
This configuration reads log messages from file and forwards them via HTTPS.
AddHeader Auth-Token: 4ddf1d3c9
This configuration sends logs via HTTPS in a failover configuration with multiple instances of the URL directive defined on new lines.
This configuration reads log messages from file and forwards them via HTTP. An OnError block processes the response code and if the first retry fails, it performs one of these actions:
If the HTTP status code is between 400 and 415, the record is converted to JSON and rerouted to file. NXLog will not attempt to resend this record.
If the HTTP status code is 700, the record is dropped. NXLog will not attempt to resend this record.
For any other HTTP status code, NXLog will attempt to resend the record according to the RetryLimit sub-directive.
$response_code = get_response_code();
$retry_count = get_retry_count();
if $retry_count > 0
if $response_code >= 400 and $response_code <= 415
# 400 - 415: convert to JSON and reroute record
$event_message = $raw_event;
else if $response_code == 700
# 700: drop record
Path file => http
Path null => failed_logs
The following JSON object shows an event that was rerouted to file by the configuration above.
"event_message": "Aug 11 11:40:48 NXLog-Server-1 systemd: Starting NXLog daemon..."