tcp

Listen for incoming TCP connections (or write to existing server)

Note that if there is a break in connection, there may be data loss. If a more robust transport is needed, use http (or even rabbitmq).

Field Name	Description	Type	Default
address	The bind address for the socket in ip address:host format.	host:port	-
plain	Extract only the payload, ignoring metadata	bool	false
raw	Do not wrap incoming data in JSON format (i.e. `{"_raw":"some data"})	bool	false
client	Treat as TCP client, not server. Then a server must be listening on the specified port	bool	false
ignore-line-breaks	Do not treat separate lines as distinct events	bool	false
encoding	The encoding for plain text received	string	UTF-8
line-size	The maximum number of bytes after which a linebreak is enforced	integer	10000

address

The bind address for the socket in ip address:host format.

Type: host:port

Example

action:

tcp:
  address: 127.0.0.1:8000

plain

Extract only the payload, ignoring metadata

If this is false, you get these fields in the event, otherwise just contents of _raw

• _raw the data
• source_ip
• source_port
• received_time
• receiver_port
• protocol "#TCP"

Type: bool

Example

action:

tcp:
  address: 127.0.0.1:8000
  plain: true

raw

Do not wrap incoming data in JSON format (i.e. `{"_raw":"some data"})

This is often useful when incoming data is already in JSON format.

Type: bool

Example

action:

tcp:
  address: 127.0.0.1:8000
  raw: true

client

Treat as TCP client, not server. Then a server must be listening on the specified port

Type: bool

ignore-line-breaks

Do not treat separate lines as distinct events

Type: bool

Example

action:

tcp:
  address: 127.0.0.1:8000
  ignore-linebreaks: true

encoding

The encoding for plain text received

Type: string

line-size

The maximum number of bytes after which a linebreak is enforced

Type: integer