Logstash HTTP Input and Monitoring API binding without authentication boundary

Answer to the posed questions

1. Does the HTTP Input plugin require external network controls for authentication when the host is unspecified?

The Logstash HTTP Input plugin has no built‑in authentication mechanism. When the host setting is omitted or set to 0.0.0.0, the plugin binds to all available network interfaces. The official Logstash documentation states that security for this endpoint must be enforced externally—through OS firewalls, network segmentation, or reverse‑proxy authentication.

2. Is api.bind_address independent of the HTTP Input plugin’s host setting for access control?

Yes. The Monitoring API is configured via logstash.yml using the api.bind_address directive. This address determines where the API listens and is unrelated to the http input plugin’s host setting. Changing one does not affect the other; both are separate listening sockets.

3. What is the documented permission boundary for the Monitoring API in OSS builds?

In the open‑source distribution, the Monitoring API is unauthenticated by default. The only boundary is the network reachability defined by api.bind_address and any external controls (firewalls, reverse proxies). There is no internal role‑based or credential‑based access control in the OSS build.

Practical steps for local development

1. Limit the HTTP Input to localhost:

   input {
     http {
       host => "127.0.0.1"
       port => 8080
     }
   }
   

2. Restrict the Monitoring API to the loopback interface:

   api:
     bind_address: 127.0.0.1:9600
   

3. For environments where external access is required, place a reverse proxy (NGINX, Envoy, etc.) in front of Logstash and enable basic auth or token‑based authentication there.
4. Alternatively, use OS firewall rules to allow only trusted IP ranges to reach the chosen bind addresses.
5. After changing bind settings, restart Logstash to apply the new configuration.

Verification checklist

• netstat -tunlp | grep logstash or ss -tunlp | grep logstash to confirm listening interfaces.
• Attempt a curl from an external network segment to http://ip:8080 and http://ip:9600/_node/metrics to test reachability.
• Review logstash.yml to verify the api.bind_address value.

Missing diagnostic detail

To tailor the recommendation further, could you confirm whether you are using the standard OSS Logstash build or an Enterprise edition? Enterprise builds introduce optional security plugins that may alter the authentication model.