feat(httpjson): Add structured logging for non-200 HTTP errors

[andrewkroh]

Proposed commit message

Add structured metadata to HTTP error logs in httpjson input to enable filtering and analysis similar to CEL logs. This change:

• Adds httpError struct to capture HTTP status code, message, and body
• Replaces Errorf logging with Errorw structured logging that includes:
  • error.code: HTTP status code
  • error.id: HTTP status message (e.g. 400 Bad Request)
  • error.type: "http"
  • error.message

Relates #45254

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

Example output:

{
  "log.level": "error",
  "@timestamp": "2025-07-30T16:23:50.392-0400",
  "log.logger": "httpjson_test",
  "log.origin": {
    "function": "github.com/elastic/beats/v7/x-pack/filebeat/input/httpjson.run.func1",
    "file.name": "httpjson/input.go",
    "file.line": 250
  },
  "message": "Error while processing http request",
  "input_url": "http://127.0.0.1:56950",
  "error": {
    "message": "failed to collect first response: failed to execute http POST: server responded with status code 400 Bad Request: {\"error\":\"expected method was \"GET\"\"}"
  },
  "error.code": 400,
  "error.id": "400 Bad Request",
  "error.type": "http",
  "ecs.version": "1.6.0"
}

[github-actions]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @andrewkroh? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b filebeat/feat/httpjson-http-code upstream/filebeat/feat/httpjson-http-code
git merge upstream/main
git push upstream filebeat/feat/httpjson-http-code

[github-actions]

@Mergifyio backport 9.0 9.1

[mergify]

backport 9.0 9.1

✅ Backports have been created

Details

• #45656 [9.0](backport #45653) feat(httpjson): Add structured logging for non-200 HTTP errors has been created for branch 9.0
• #45657 [9.1](backport #45653) feat(httpjson): Add structured logging for non-200 HTTP errors has been created for branch 9.1