Implement proxy-protocol support for beats inputs

[Grraahaam]

Hello Logstash community! 👋🏽

Would it be possible to support proxy-protocol (v1/v2) for beats inputs ?

Use case : Allow logstash to sit behind load balancer or a proxy, with the proxy-protocol enabled

Since #4418 (logstash-plugins/logstash-input-tcp#57) got approved and merged, I was wondering if it could be possible to implement it for the beats input as well ?

I'd love to have this feature, thanks in advance! 👍🏽

[Meddeb-bilel]

Hello
did you find a solution of how to get the client IP if your logstash is behind a proxy?

without proxy and with this configuration of logstash, i got the ip of beats clients:

input {
beats {
port => "5000"
}
}
filter {
mutate {
copy => {"[@metadata][ip_address]" => "[public_ip]"}
}
}
output {
stdout{}
}

the problem is proxy_protocol is not exist in beats input :'( :'(

[Grraahaam]

Hey @Meddeb-bilel !

Yes, I've found a workaround so far, since I'm hosting and managing my applications and the beats within a k8s cluster, I've configured the ingress controller service to forward the real IP to the pods.

This is how my traffic goes : Client -> Loadbalancer -> Ingress Controller -> Pods

You should configure your ingress controller service with annotations provided by your cloud provider (if using one) to forward the real IP, you should have two annotations like those :

• use-hostname
• proxy-protocol-v2

And then since I'm on ingress-nginx, here's the config (Helm) I had to add :

config:
    use-forwarded-headers: "true"
    compute-full-forwarded-for: "true"
    use-proxy-protocol: "true"

[Meddeb-bilel]

Hello,

Sorry but i don't understand you.
for me this is what i have :

winlogbeat ==> HAPROXY ==> Logstash

• winlogbeat config:

output.logstash:
    hosts: ["Ip_Haproxy:5000"]

• HAProxy config:

frontend logstash-frontend
    mode tcp
    bind *:5000 
    option tcplog
    default_backend logstash-backend

backend logstash-backend
    mode tcp
    balance roundrobin
    server logstash1 Ip_Logstash_1:5000 
    server logstash2 Ip_Logstash_2:5000 

• Logstash config:

input {
    beats {
        port => "5000"
    }
}
filter {
    mutate {
        copy => {"[@metadata][ip_address]" => "[public_ip]"}
    }
}
output {
    stdout{}
}

Can You tell me which modification should I make ?