[Filebeat] Input for messages over a websocket connection

[dylanvdbrink]

Hi,

I am currently looking into some ingester that will redirect incoming messages on a websocket connection to stdout. Filebeat does exactly what we need except it lacks a websocket input. If added it will have a new input configuration option. E.g.:

filebeat.inputs:
- type: websocket
  host: "0.0.0.0:9000"

My use case is a web application that consists of a backend and frontend, both running inside OpenShift. All our backend logging is sent to stdout which eventually ends up in Kibana (probably by some OpenShift integration with Logstash, forgive me for not knowing this exactly, I am not part of the team that set this up). We also want our frontend logging to be delivered to Kibana in the same way (by sending the logs to stdout). As the client runs in the browser (and it cannot send logs to stdout on the container/server), we would like some service/container that sets up a websocket server so that our frontend clients can connect to and send logs to.

Filebeat does support HTTP and TCP. But AFAIK a browser is not capable of setting up a raw TCP connection and we prefer a websocket over HTTP because of the efficiency. We could also use something like https://github.com/novnc/websockify but it would be nice if filebeat could do this without any other software.

Please let me know if this is within the scope of Filebeat as I do understand this is somewhat of an edge use case.

BTW; I did see #30991, but I think that issue is more related to a specific service and in that issue Filebeat would initiate the websocket, whereas here we want the client to initiate it.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!