Skip to main content
Version: 3.3.0

tcp

Listen for incoming TCP connections (or write to existing server)

Note that if there is a break in connection, there may be data loss. If a more robust transport is needed, use http (or even rabbitmq).

Field NameDescriptionTypeDefault
addressThe bind address for the socket in ip address:host format.host:port-
plainExtract only the payload, ignoring metadataboolfalse
rawDo not wrap incoming data in JSON format (i.e. `{"_raw":"some data"})boolfalse
clientTreat as TCP client, not server. Then a server must be listening on the specified portboolfalse
ignore-line-breaksDo not treat separate lines as distinct eventsboolfalse
encodingThe encoding for plain text receivedstringUTF-8
line-sizeThe maximum number of bytes after which a linebreak is enforcedinteger10000

address

The bind address for the socket in ip address:host format.

Type: host:port

Example

action:

tcp:
address: 127.0.0.1:8000

plain

Extract only the payload, ignoring metadata

If this is false, you get these fields in the event, otherwise just contents of _raw

  • _raw the data
  • source_ip
  • source_port
  • received_time
  • receiver_port
  • protocol "#TCP"

Type: bool

Example

action:

tcp:
address: 127.0.0.1:8000
plain: true

raw

Do not wrap incoming data in JSON format (i.e. `{"_raw":"some data"})

This is often useful when incoming data is already in JSON format.

Type: bool

Example

action:

tcp:
address: 127.0.0.1:8000
raw: true

client

Treat as TCP client, not server. Then a server must be listening on the specified port

Type: bool

ignore-line-breaks

Do not treat separate lines as distinct events

Type: bool

Example

action:

tcp:
address: 127.0.0.1:8000
ignore-linebreaks: true

encoding

The encoding for plain text received

Type: string

line-size

The maximum number of bytes after which a linebreak is enforced

Type: integer