How to configure a Logstash HTTP output

Routing Logstash events to an HTTP endpoint enables direct delivery into webhook receivers, ingestion APIs, and custom services without a message broker. This pattern is useful when the destination already exposes a REST interface and can accept structured event payloads.

Logstash sends events through a pipeline and hands them to output plugins at the end of processing. The http output plugin serializes each event and issues an HTTP request (commonly POST) to a configured URL, with optional headers and retry behavior to match the receiver’s contract.

Rate limits and non-idempotent endpoints require careful retry settings because repeated requests can create duplicate records. Keep secrets out of pipeline files where possible, and confirm delivery using pipeline stats and service status before relying on the output in production.

1. Install the logstash-output-http plugin when it is not already bundled with the Logstash package.

   $ sudo /usr/share/logstash/bin/logstash-plugin install logstash-output-http
   Using bundled JDK: /usr/share/logstash/jdk
   Validating logstash-output-http
   Resolving mixin dependencies
   Updating mixin dependencies logstash-mixin-http_client
   Bundler attempted to update logstash-mixin-normalize_config_support but its version stayed the same
   Bundler attempted to update logstash-mixin-http_client but its version stayed the same
   Installing logstash-output-http
   Installation successful

2. Create a pipeline configuration file at /etc/logstash/conf.d/60-http-output.conf.

   input {
     file {
       path => "/var/lib/logstash/http-output-test.log"
       start_position => "beginning"
       sincedb_path => "/var/lib/logstash/sincedb-http-output-test"
     }
   }
   
   output {
     if [log][file][path] == "/var/lib/logstash/http-output-test.log" {
       http {
         url => "http://localhost:8081/logstash"
         http_method => "post"
         format => "json"
         headers => {
           "Content-Type" => "application/json"
           "X-Source" => "logstash"
         }
         retry_failed => true
         automatic_retries => 3
       }
     }
   }

   Replace http://localhost:8081/logstash with the destination endpoint; use format json_batch when the receiver supports arrays to reduce request count; avoid hardcoding credentials in pipeline files.

3. Create the test input file referenced by the pipeline.

   $ sudo install -o logstash -g logstash -m 0640 /dev/null /var/lib/logstash/http-output-test.log

4. Test the pipeline configuration.

   $ sudo -u logstash /usr/share/logstash/bin/logstash --path.settings /etc/logstash --path.data /tmp/logstash-configtest --config.test_and_exit
   Configuration OK

   Related: How to test a Logstash pipeline configuration

5. Restart the Logstash service.

   $ sudo systemctl restart logstash

   Related: How to manage the Logstash service with systemctl in Linux

6. Append a test line to the input file to generate an event.

   $ printf 'http-output-test %s\n' "$(date -Iseconds)" | sudo tee -a /var/lib/logstash/http-output-test.log
   http-output-test 2026-01-08T06:56:52+08:00

7. Check pipeline stats for output activity.

   $ curl -s http://localhost:9600/_node/stats/pipelines?pretty | grep -nE '"events"|"out"' | head -n 8
   ##### snipped #####
   17:      "events" : {
   22:        "out" : 231
   68:          "events" : {
   70:            "out" : 0
   81:          "events" : {
   83:            "out" : 0
   94:          "events" : {
   96:            "out" : 0
   ##### snipped #####

   The Logstash Monitoring API commonly listens on http://localhost:9600/ when enabled.