Add Netty handler to log HTTP wire traffic

[andsel]

Release notes

Implements a functionality to log HTTP traffic. It's enabled by enabling debug log.

What does this PR do?

• Created new WireLogger Netty handler to log information about channel opening/closing and dumping read and write traffic.
• Truncate the dumped content to 4KB or can be customised by setting logstash.httpinput.wire.dump.size Java system property.
• Updated client channel initializer to include such handler.
• Updates Java target and source compatibility to use HttpClient provided by JDK standard library since version 11.

Why is it important/What is the impact to the user?

As a user that want's to debug his data flow I need to be able to track what's effectively sent to the HTTP input socket.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files (and/or docker env variables)
• I have added tests that prove my fix is effective or that my feature works

Author's Checklist

• [ ]

How to test this PR locally

Run a Logstash pipeline which includes an HTTP input filter enabling the logger in config/log4j2.properties with:

logger.httpwire.name = org.logstash.plugins.inputs.http.util.WireLogger
logger.httpwire.level = DEBUG

Related issues

• Closes Log wire traffic #236

Use cases

Given some issue with the messages received from an HTTP input I want to enable debug logging to check what's in transit on the TCP level, after the TLS layer.

Logs

Produced logs for gzipped content:

[2026-08-18T09:16:07,087][DEBUG][org.logstash.plugins.inputs.http.util.WireLogger][main] Opening connection /127.0.0.1:50455
[2026-08-18T09:16:07,091][DEBUG][org.logstash.plugins.inputs.http.util.WireLogger][main] << /127.0.0.1:50455 : POST / HTTP/1.1[\r][\n]Content-Type: application/json[\r][\n]Content-Encoding: gzip[\r][\n]Accept-Encoding: gzip, x-gzip, deflate[\r][\n]Host: localhost:8080[\r][\n]Content-Length: 40[\r][\n]Connection: keep-alive[\r][\n]User-Agent: Apache-HttpClient/5.4.3 (Java/21.0.10)[\r][\n][\r][\n][0x1F][0x8B][0x08][0x00][0x00][0x00][0x00][0x00][0x00][0xFF][0xAB]V[0xCA]M-.NLOU[0xB2]RP[0xCA]H[0xCD][0xC9][0xC9]W[0xAA][0x05][0x00]![0xC3][0x0E][0x9F][0x14][0x00][0x00][0x00]
[2026-08-18T09:16:07,111][DEBUG][org.logstash.plugins.inputs.http.util.WireLogger][main] >> /127.0.0.1:50455 : HTTP/1.1 200 OK[\r][\n]content-length: 2[\r][\n]content-type: text/plain[\r][\n][\r][\n]ok
[2026-08-18T09:16:07,115][DEBUG][org.logstash.plugins.inputs.http.util.WireLogger][main] Closing connection /127.0.0.1:50455

Produced logs for plain content:

[2026-08-18T09:17:05,264][DEBUG][org.logstash.plugins.inputs.http.util.WireLogger][main] Opening connection /127.0.0.1:50466
[2026-08-18T09:17:05,266][DEBUG][org.logstash.plugins.inputs.http.util.WireLogger][main] << /127.0.0.1:50466 : POST / HTTP/1.1[\r][\n]Content-Type: application/json[\r][\n]Accept-Encoding: gzip, x-gzip, deflate[\r][\n]Host: localhost:8080[\r][\n]Content-Length: 20[\r][\n]Connection: keep-alive[\r][\n]User-Agent: Apache-HttpClient/5.4.3 (Java/21.0.10)[\r][\n][\r][\n]{"message": "hello"}
[2026-08-18T09:17:05,633][DEBUG][org.logstash.plugins.inputs.http.util.WireLogger][main] >> /127.0.0.1:50466 : HTTP/1.1 200 OK[\r][\n]content-length: 2[\r][\n]content-type: text/plain[\r][\n][\r][\n]ok
[2026-08-18T09:17:05,641][DEBUG][org.logstash.plugins.inputs.http.util.WireLogger][main] Closing connection /127.0.0.1:50466

[github-actions]

Changelog and Version Management

No changelog or version changes detected. You can either update them manually or use a comment command to update them automatically on merge:

/pr_prepare release:<patch|minor|major> — bump version + update changelog
/pr_prepare changelog:add — changelog entry only (no version bump)

/pr_prepare release:patch
- Add the changelog entry here
  - (Additional details can be provided in multiple lines, respecting markdown formatting)

Omit the entry line to use the PR title. If multiple commands are posted, the last one wins.

[donoghuc]

Overall this looks good and works as advertised. Have a couple small suggestions.

Also, will this be a new minor release?

[andsel]

Also, will this be a new minor release?

Given that's a new feature, I think it has to be a new minor.

[donoghuc]

Super small typo other than that this is g2g in a minor release.

[andsel]

/pr_prepare release:minor

• Implements a functionality to log HTTP traffic, disabled by default. To unable switch on debug logs.