Skip to main content
Version: v4.18


Loads and saves bytes via HTTP.


http [--chunked] [--multipart] [-f|--form] [-j|--json] [-v|--verbose]
[<method>] <url> [<item>..]


The http loader performs a HTTP request and returns the bytes of the HTTP response body. The http saver performs a HTTP request with the request body being the the provided bytes by the previous operator. The diagram below illustrates how loader and saver work:

We modeled the http connector after HTTPie, which comes with an expressive command-line syntax. We recommend to study the HTTPie documentation to understand the full extent of the command-line interface. In many cases, you can perform an exact copy of the HTTPie command line and use it drop-in with the HTTP loader, e.g., the invocation

http PUT X-API-Token:123 foo=bar


from http PUT X-API-Token:123 foo=bar

More generally, if your HTTPie command line is http X then you can write from http X to obtain an event stream or load http X for a byte stream.


Enable chunked transfer encoding. This is equivalent to manually setting the header Transfer-Encoding: chunked.


Encodes the HTTP request body as multipart message.

This automatically sets the Content-Type header to application/form-multipart; X where X contains the MIME part boundary.


Submits the HTTP request body as form.

This automatically sets the Content-Type header to application/x-www-form-urlencoded.


Explicitly sets the Accept header to application/json.


The HTTP method, such as POST or GET.

The argument is optional and its default value depends on the command line:

  • GET for requests without body
  • POST for requests with body

For example, the following operator configurations are identical:

from http GET
from http

Similarly, when we provide data for the request body, the following two invocations are identical:

from http POST foo=bar
from http foo=bar


The HTTP request URL.

The scheme is http:// and can be omitted from the argument. For example, the following two invocations are identical:

from http
from http


A HTTP request item in the form of a key-value pair.

The character separating the key-value pair determines the semantics of the item:

  • key:value a HTTP header with name key and value value
  • key=value a data field in the HTTP request body with key as string key and value as string value
  • key:=value a data field in the HTTP request body with key as string key and value as JSON value

Use \ to escape characters that shouldn't be treated as separators.


Download and process a CSV file:

from read csv

Process a Zstd-compressed Zeek TSV file:

| decompress zstd
| read zeek-tsv

Send a HTTP PUT request with a X-API-Token header and body of {"foo": 42}:

from http PUT X-API-Token:123 foo=42

Send pipeline data as request body in a POST request:

version | to X-API-Token:123

Issue a HTTP GET request every second using an operator modifier for scheduled executions.

every 1s from