HTTP connector

Class: http — JSON over HTTP. Sources poll or receive pushed payloads and publish to a stream; sinks subscribe to a stream and POST batches to a REST endpoint.

Create and edit under Sources and Sinks. Advanced Settings may expose more runtime options depending on deployment and permissions.

Source and sink behavior

Role	Behavior
Source	HTTP client (often GET polling) pulls or receives JSON and emits events to the connector stream.
Sink	HTTP client sends event batches to endpoint (typically POST).
Streams	Upstream processing must publish to the stream the sink subscribes to; the source writes the stream tasks consume (Streams).

Defaults (Core): if method is unset, GET for sources and POST for sinks.

Required fields

Every connector row

Field	Required	Notes
name	Yes	Display name; id derived from it.
class	Yes	Must be http.
stream	Yes	Resolved stream id.
type	Yes	source or sink from the screen used at create time.
config	Yes	Class-specific object; see below.

Class http — required configuration

Setting	Required	Notes
endpoint	Yes	HTTP(S) URL for poll or delivery.

Create connector

1. Open Sources or Sinks → Create.
2. Set Class to HTTP, set name, stream behavior, and Enabled.
3. Enter endpoint and method appropriate for poll vs delivery.
4. Add auth, TLS, intervals, and batching from Common configuration when needed.
5. Save, then wire the stream into tasks / pipelines.

Source (UI)

The HTTP source connector form.

UI field	Connector setting
Endpoint (required)	endpoint
Method	method (e.g. GET for polling sources)

Sink (UI)

Same Config layout on Create New Sink; titles and primary button differ.

The HTTP sink connector form.

UI field	Connector setting
Endpoint (required)	endpoint
Method	method (usually POST for sinks)

Configuration

Request and delivery

• method, endpoint, interval_ms, timeout_seconds, retry_attempts — Poll cadence, verbs, and client behavior.

Authentication

• authentication — Bearer, basic, API key headers, and related fields for your IdP.

Payload batching

• batch — max_events, timeout_ms, max_bytes for grouped reads or posts.

Compression and TLS

• compression, compression_threshold, tls — Optional payload compression and HTTPS trust / mTLS.

Runtime behavior

• Connectors run after deployment; Disabled connectors do not call remote HTTP.
• Sources respect poll intervals and timeouts; sinks flush batches per batch and retry policy.
• Downstream stream wiring must match task sink_streams / source_stream expectations.

Performance and operational notes

• Keep timeouts below upstream SLAs; tune retry_attempts to avoid thundering herds.
• Cap batch sizes to endpoint and body limits.
• Use TLS verification in production; document any custom trust stores.

Related pages

• Sources · Sinks
• Splunk connector — shared HEC-style URL patterns where applicable
• Architecture — Connectors