NimbostratusSend Client HTTP Request to Pool And Send HTTP Response From BIG-IP to Client.
Good day everyone.
We are starting a F5 XC POV and I'm currently focused on external logging to Graylog.
XC is sending log messages via HTTPS to a BIG-IP VIP.
Graylog doesn't support HTTP JSON messages. However we've configured a Raw/Plaintext TCP input and it is processing received messages great with the help of some pipeline rules.
Graylog however isn't sending any HTTP response, which I understand why but that is what I'm trying to see if I can overcome. I am seeing XC repeatedly sending the same log messages. I'm assuming because it never receives a HTTP 200 response. Seems like reasonable behavior.
So XC is sending messages properly and Graylog is consuming them properly.
Because there isn't any option I can see to get Graylog to generate a HTTP response I am exploring options to get the BIG-IP to send the response with an iRule.
I read to the following doc:
https://clouddocs.f5.com/api/irules/HTTP__respond.html
Snip from that: Generates a response to the client as if it came from the server. If the command runs on the client side, it sends the response to the client without any load balancing taking place. If the command runs on the server side, the content from the actual server is discarded and replaced with the information provided.
I am hanging my hopes on getting the bold comment working. But I don't know if this requires a server-side response to behave properly.
I started with following iRule:
when HTTP_REQUEST_SEND {
serverside {
HTTP::respond 200 -version 1.1 noserver
}
}
I'm POST'ing some JSON via cURL I've seen sent from XC. I see the log message in Graylog without the iRule in place and cURL eventually times out expected.
When I put the above iRule in place and execute the same cURL test I get a HTTP 200 response from the BIG-IP however I don't see the log message in Graylog. I've verified with a server-side packet capture on the BIG-IP the HTTP post is never sent to Graylog. This obviously explains why I don't see it in Graylog.
I've tried several variants of the above iRule. For example, I tried the clientside context even though the documentation clearly states I should get the behavior I'm seeing. I tried putting the HTTP::respond in different events, HTTP_RESPONSE for example. But I am not able to find the correct approach to get the BIG-IP to send the HTTP POST to Graylog and send the HTTP 200 to the client.
I'm hoping someone is able to either confirm this is even possible or provide some guidance to get the BIG-IP to send the HTTP POST to Graylog and send the HTTP 200 to the client.
Thank you kindly in advance.
