Send HTTP Requests
Send HTTP Requests sends one HTTP/1.1 request for each matching message. The method is the selected endpoint’s Request type (POST or PUT). Use it for webhooks, ticketing APIs, SMS gateways, and other HTTP integrations.
| The feature reads messages from syslog storage, not from the collector as they arrive. The collector keeps writing to storage even if this feature is slow, suspended, or failing — storage acts as a large buffer so collection is not blocked. |
Common Feature, Data Fields, and Filter settings are described in Managing Features. This page covers the HTTP Request section.
HTTP Request
| Setting | Description |
|---|---|
HTTP endpoint |
Named endpoint from Server Configuration (Server toolbar → Server → Server Configuration…). The endpoint holds host, TLS, authentication, and Request type (POST or PUT). Create endpoints there if the list is No HTTP endpoints. |
Resource path |
Path on that server. Message fields are allowed. Example: |
For URL-safe field values in the path, use {FIELD|EscURL} (escape modifier).
|
Request Body
Simple mode uses a single HTTP request body template.
Example: {MESSAGE|70}.
Click Switch to Advanced Mode to define several Request Body Sections. Each section has:
-
a Section filter (blank = all messages that already passed the feature filter)
-
an HTTP request body template
Every matching section’s template is applied, in listed order, and the results are concatenated into one request body. The feature still sends one request per syslog message — not one request per section.
| If no section matches, the request is still sent with an empty body. |
Use several sections when originators need different request formats, or when the payload should differ by severity — for example a high-priority SMS for Emergency and a standard SMS for Alert–Error. If each section is a complete JSON object, keep the section filters mutually exclusive so only one matches.
Several sections also cover a composite body: optional parts that should appear only under certain conditions. Add a section per part; every matching part is included.
JSON Body
When the request body is JSON, put syslog fields inside JSON string values and apply EscJSON so quotes, backslashes, and line breaks in the syslog text do not break the JSON.
{{"from":"{ORIGINATOR_ID|EscJSON}","sev":{SEVERITY_NUM},"msg":"{MESSAGE|EscJSON}"}}
In HTTP request body, a single { starts a syslog field, not a JSON object.
Write a literal brace as {{ or }} so the JSON object’s outer braces are copied to the request.
|
Notes
-
The HTTP request is sent from the Syslog Watcher Server computer, not from Manager. DNS, firewall, and TLS to the endpoint must work there.
-
Authentication, TLS, and Request type are set on the HTTP endpoint in Server Configuration, not on this feature.
-
A failed request marks the feature Failed on the Server tab and is retried. A message is not skipped until the request succeeds.