tcp

Listen for incoming TCP connections (or write to existing server)

Note that if there is a break in connection, there may be data loss. If a more robust transport is needed, use http (or even rabbitmq).

Field NameDescriptionTypeDefault
addressBind addressstring-
plainExtract only the payload, ignoring metadataboolfalse
clientTreat as TCP client, not server. Then a server must be listening on this portboolfalse
rawDo not wrap incoming data in JSON format (i.e. `{"_raw":"some data"})boolfalse
ignore-line-breaksDo not treat separate lines as distinct eventsboolfalse

address

Bind address

Type: string

Example

action:

tcp:
  address: 127.0.0.1:8000

plain

Extract only the payload, ignoring metadata

If this is false, you get these fields in the event, otherwise just contents of _raw

  • _raw the data
  • source_ip
  • source_port
  • received_time
  • receiver_port
  • protocol "TCP"

Type: bool

Example

action:

tcp:
  address: 127.0.0.1:8000
  plain: true

client

Treat as TCP client, not server. Then a server must be listening on this port

Type: bool

Example

action:

tcp:
  address: 127.0.0.1:8000
  client: true

raw

Do not wrap incoming data in JSON format (i.e. `{"_raw":"some data"})

This is often useful when incoming data is already in JSON format.

Type: bool

Example

action:

tcp:
  address: 127.0.0.1:8000
  raw: true

ignore-line-breaks

Do not treat separate lines as distinct events

Type: bool

Example

action:

tcp:
  address: 127.0.0.1:8000
  ignore-linebreaks: true