ElasticWriter: Add basic auth support for Elasticsearch behind an HTTP proxy

refs #5538

diff --git a/doc/09-object-types.md b/doc/09-object-types.md
index f3bf882abfb018c6d4cac37220deb6a5a2aa0449..5c11b4af9dbd6b7e64d402ec1bda51272799c16b 100644 (file)
--- a/doc/09-object-types.md
+++ b/doc/09-object-types.md
@@ -1000,6 +1000,8 @@ Configuration Attributes:
   enable_send_perfdata   | **Optional.** Send parsed performance data metrics for check results. Defaults to `false`.
   flush_interval         | **Optional.** How long to buffer data points before transfering to Elasticsearch. Defaults to `10`.
   flush_threshold        | **Optional.** How many data points to buffer before forcing a transfer to Elasticsearch.  Defaults to `1024`.
+  username               | **Optional.** Basic auth username if Elasticsearch is hidden behind an HTTP proxy.
+  password               | **Optional.** Basic auth password if Elasticsearch is hidden behind an HTTP proxy.
 
 Note: If `flush_threshold` is set too low, this will force the feature to flush all data to Elasticsearch too often.
 Experiment with the setting, if you are processing more than 1024 metrics per second or similar.

diff --git a/lib/perfdata/elasticwriter.cpp b/lib/perfdata/elasticwriter.cpp
index 667dafbb86e70be4be8b144e8e73e3b4da224001..c8f50aba67817f7c6fd8bb764467573a44fa531f 100644 (file)
--- a/lib/perfdata/elasticwriter.cpp
+++ b/lib/perfdata/elasticwriter.cpp
@@ -27,6 +27,7 @@
 #include "icinga/checkcommand.hpp"
 #include "base/tcpsocket.hpp"
 #include "base/stream.hpp"
+#include "base/base64.hpp"
 #include "base/json.hpp"
 #include "base/utility.hpp"
 #include "base/networkstream.hpp"
@@ -422,12 +423,19 @@ void ElasticWriter::SendRequest(const String& body)
        req.AddHeader("Accept", "application/json");
        req.AddHeader("Content-Type", "application/json");
 
+       /* Send authentication if configured. */
+       String username = GetUsername();
+       String password = GetPassword();
+
+       if (!username.IsEmpty() && !password.IsEmpty())
+               req.AddHeader("Authorization", "Basic " + Base64::Encode(username + ":" + password));
+
        req.RequestMethod = "POST";
        req.RequestUrl = url;
 
 #ifdef I2_DEBUG /* I2_DEBUG */
        Log(LogDebug, "ElasticWriter")
-           << "Sending body: " << body;
+           << "Sending request" << ((!username.IsEmpty() && !password.IsEmpty()) ? " with basic auth " : "" )  << body;
 #endif /* I2_DEBUG */
 
        try {
@@ -451,6 +459,20 @@ void ElasticWriter::SendRequest(const String& body)
        }
 
        if (resp.StatusCode > 299) {
+               if (resp.StatusCode == 401) {
+                       /* More verbose error logging with Elasticsearch is hidden behind a proxy. */
+                       if (!username.IsEmpty() && !password.IsEmpty()) {
+                               Log(LogCritical, "ElasticWriter")
+                                   << "401 Unauthorized. Please ensure that the user '" << username
+                                   << "' is able to authenticate against the HTTP API/Proxy.";
+                       } else {
+                               Log(LogCritical, "ElasticWriter")
+                                   << "401 Unauthorized. The HTTP API requires authentication but no username/password has been configured.";
+                       }
+
+                       return;
+               }
+
                Log(LogWarning, "ElasticWriter")
                    << "Unexpected response code " << resp.StatusCode;
 
@@ -459,6 +481,7 @@ void ElasticWriter::SendRequest(const String& body)
                        resp.Parse(context, true);
 
                String contentType = resp.Headers->Get("content-type");
+
                if (contentType != "application/json") {
                        Log(LogWarning, "ElasticWriter")
                            << "Unexpected Content-Type: " << contentType;

diff --git a/lib/perfdata/elasticwriter.ti b/lib/perfdata/elasticwriter.ti
index 430bb402cb9f9362e0addc1cc6b58e431ae85a71..023d9e349e621bc14a2f40dbfa7544de9ab1eb8e 100644 (file)
--- a/lib/perfdata/elasticwriter.ti
+++ b/lib/perfdata/elasticwriter.ti
@@ -19,6 +19,8 @@ class ElasticWriter : ConfigObject
        [config] bool enable_send_perfdata {
                default {{{ return false; }}}
        };
+       [config] String username;
+       [config] String password;
 
        [config] int flush_interval {
                default {{{ return 10; }}}