Request-log webhook

POST every request line to a URL you run.

What it is Pushes the per-request log line to an HTTPS endpoint as it finishes.

When to use it Request logs belong in a log pipeline or SIEM you already operate.

CategoryExporter StatusAvailable Built-inNo install step

Overview

The request-log webhook is the PUSH half for logs: as each request finishes, Busbar builds one JSON line (timestamp, ingress protocol, pool, outcome, latency) and POSTs it to the HTTPS URL you configured.

Because export: is a named map, the same module can back several instances: two webhooks shipping to two different URLs (application logs and a SIEM) is an ordinary deployment, and each instance carries its own auth_header, its own delivery timeout, and its own in-flight cap. That is precisely what the older type-keyed block could not express.

Delivery never sits on the request path. Each instance spawns its own bounded delivery task behind an admission gate: when a collector stalls, deliveries are shed and counted rather than queued without limit, and no error from a sink can ever change what a caller gets back. Telemetry must not affect serving.

The URL is SSRF-guarded and https://-only. This exporter also absorbs the retired generic-webhook exporter: its only extra was an auth header, which is now just a setting here, and its other reason to exist (a second webhook target) is what naming two instances gives you.

Turn it on

Compiled into the core binary; nothing to download. Name one instance per target under the top-level export: map:

export:
  req-log:
    module: request-log-webhook
    streams: [logs]
    settings: { url: "https://logs.example.com/busbar" }
  req-siem:
    module: request-log-webhook
    streams: [logs]
    settings:
      url: "https://siem.internal/ingest"
      delivery_timeout_secs: 2
      max_inflight_deliveries: 128

The map KEYS (req-log, req-siem) are instance names you choose; module: is which exporter backs each. Add an auth_header: { name, value } to either instance when the collector needs one; its value rides the config’s ${VAR} env interpolation, so the token is never stored literally. New in busbar 1.5.3; it replaces the retired observability.request_log_webhook_url (see the migration).

Settings

Setting	Required	Default	Description
`url`	Yes	—	The webhook target. `https://`-only and SSRF-guarded, so a sink cannot be pointed at cloud metadata or a private host.
`auth_header`	No	—	An optional `{ name, value }` header applied to every delivery from THIS instance. The `value` rides the config’s `${VAR}` env interpolation, so a secret is never stored literally.
`max_inflight_deliveries`	No	`64`	Max concurrent deliveries for this instance. Beyond it, lines are shed and counted rather than queued; a stalled collector must not grow memory without bound.
`delivery_timeout_secs`	No	`2`	Per-delivery timeout, applied PER INSTANCE, so a slow SIEM and a fast local collector can carry different deadlines.

Built into the core: configured under export:, never downloaded.

← Back to the Plugin Store