HTTP Log

The HTTP Log source runs an HTTP listener that receives logs delivered as POST requests. Any network device or log shipper that can push logs to an HTTP endpoint (commonly called a "LogPush" destination) can deliver records to the collector. By default the request body is parsed as JSON, with an option to ingest the raw request body as unstructured text.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

• A log source or shipper that can send logs to an HTTP endpoint via POST requests.
• The log source must be able to reach the collector over the network. Adjust any firewall rules to allow TCP and HTTP traffic to the configured IP address and port.
• For TLS, a TLS certificate and private key reachable on the collector host.

Configuration

General

Parameter	Type	Default	Description
Listen Address	String	0.0.0.0	The IP address to listen on. Required.
HTTP Port	Integer		TCP port to listen for POST requests on. Required.

Advanced

Parameter	Type	Default	Description
Path	String		The path along the endpoint the receiver should listen to for logs. Useful when the log source also sends other data, such as metrics, to the same endpoint.
Enable TLS	Boolean	false	Enable TLS for the logs server.
Cert File Location	String		Local path to the TLS cert file. Required when TLS is enabled.
Key File Location	String		Local path to the TLS key file. Required when TLS is enabled.
Raw Logs	Boolean	false	When enabled, the request body is not parsed into a structure but saved to the log body as raw text. Available with collector v1.88.1+.

Request Format

By default, the request body must be JSON. The receiver parses each POST request body into one or more structured log records. A request can deliver a single JSON object or a JSON array of objects (a batch), for example:

[
  {
    "timestamp": "2026-06-18T12:00:00Z",
    "severity": "info",
    "message": "user login succeeded",
    "host": "edge-01",
    "client_ip": "203.0.113.10"
  },
  {
    "timestamp": "2026-06-18T12:00:01Z",
    "severity": "warn",
    "message": "rate limit applied",
    "host": "edge-01",
    "client_ip": "203.0.113.42"
  }
]

To ingest the request body verbatim instead of parsing it as JSON, set raw_logs to true. The full body is then stored as unstructured text in the log record body.

Example Configuration

For a basic configuration, only the listen_address and http_port parameters are needed.

Standalone Source

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  id: http
  name: http
spec:
  type: http
  parameters:
    - name: listen_address
      value: '0.0.0.0'
    - name: http_port
      value: '12345'

With TLS enabled

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  id: http
  name: http
spec:
  type: http
  parameters:
    - name: listen_address
      value: '0.0.0.0'
    - name: http_port
      value: '8443'
    - name: path
      value: '/logs'
    - name: enable_listen_tls
      value: 'true'
    - name: listen_tls_cert_file
      value: '/opt/observiq-otel-collector/http.crt'
    - name: listen_tls_key_file
      value: '/opt/observiq-otel-collector/http.key'

Configuration Tips

Path routing

• Set path when the log source also delivers other data, such as metrics, to the same host and port. The receiver then accepts logs only on the configured path.
• Leave path empty to accept POST requests on any path.

Raw versus structured logs

• Leave raw_logs disabled (the default) when the source sends JSON. The receiver parses each request body into a structured log record.
• Enable raw_logs to store the request body verbatim as unstructured text. This is useful for sources that send a non-JSON or proprietary body format.

Troubleshooting

Symptom: No logs arrive at the collector. Solution: Confirm the source can reach the collector on the configured listen_address and http_port, and that firewall rules allow inbound TCP traffic to that port. Verify the source is sending POST requests to the matching path if path is set.

Symptom: Logs arrive but are not parsed into structured fields. Solution: Confirm the request body is valid JSON. If the source sends a non-JSON body, enable raw_logs to ingest the body as raw text instead.

Symptom: TLS connections fail or are refused. Solution: Confirm enable_listen_tls is set and that listen_tls_cert_file and listen_tls_key_file point to valid, readable files on the collector host. Both are required when TLS is enabled.

Related Resources

• Bindplane sources documentation
• Custom Service for Kubernetes collectors