diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 7c161b640bc..8ba973c8c63 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -109,6 +109,7 @@ is collected by it.
 - Ensure winlog input retains metric collection when handling recoverable errors. {issue}36479[36479] {pull}36483[36483]
 - Revert error introduced in {pull}35734[35734] when symlinks can't be resolved in filestream. {pull}36557[36557]
 - Fix ignoring external input configuration in `take_over: true` mode {issue}36378[36378] {pull}36395[36395]
+- Add validation to http_endpoint config for empty URL {pull}36816[36816] {issue}36772[36772]
 
 *Heartbeat*
 
diff --git a/x-pack/filebeat/input/http_endpoint/config.go b/x-pack/filebeat/input/http_endpoint/config.go
index 48fa51bd00b..e073302ef10 100644
--- a/x-pack/filebeat/input/http_endpoint/config.go
+++ b/x-pack/filebeat/input/http_endpoint/config.go
@@ -32,7 +32,7 @@ type config struct {
 	ResponseBody          string                  `config:"response_body"`
 	ListenAddress         string                  `config:"listen_address"`
 	ListenPort            string                  `config:"listen_port"`
-	URL                   string                  `config:"url"`
+	URL                   string                  `config:"url" validate:"required"`
 	Prefix                string                  `config:"prefix"`
 	ContentType           string                  `config:"content_type"`
 	SecretHeader          string                  `config:"secret.header"`
@@ -51,8 +51,6 @@ func defaultConfig() config {
 	return config{
 		Method:        http.MethodPost,
 		BasicAuth:     false,
-		Username:      "",
-		Password:      "",
 		ResponseCode:  200,
 		ResponseBody:  `{"message": "success"}`,
 		ListenAddress: "127.0.0.1",
@@ -60,14 +58,6 @@ func defaultConfig() config {
 		URL:           "/",
 		Prefix:        "json",
 		ContentType:   "application/json",
-		SecretHeader:  "",
-		SecretValue:   "",
-		HMACHeader:    "",
-		HMACKey:       "",
-		HMACType:      "",
-		HMACPrefix:    "",
-		CRCProvider:   "",
-		CRCSecret:     "",
 	}
 }
 
diff --git a/x-pack/filebeat/input/http_endpoint/config_test.go b/x-pack/filebeat/input/http_endpoint/config_test.go
new file mode 100644
index 00000000000..d91f832e5da
--- /dev/null
+++ b/x-pack/filebeat/input/http_endpoint/config_test.go
@@ -0,0 +1,63 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package http_endpoint
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	confpkg "github.com/elastic/elastic-agent-libs/config"
+)
+
+func Test_validateConfig(t *testing.T) {
+	testCases := []struct {
+		name      string // Sub-test name.
+		config    config // Load config parameters.
+		wantError string // Expected error
+	}{
+		{
+			name: "empty URL",
+			config: config{
+				URL:          "",
+				ResponseBody: `{"message": "success"}`,
+				Method:       http.MethodPost,
+			},
+			wantError: "string value is not set accessing 'url'",
+		},
+		{
+			name: "invalid method",
+			config: config{
+				URL:          "/",
+				ResponseBody: `{"message": "success"}`,
+				Method:       "random",
+			},
+			wantError: "method must be POST, PUT or PATCH: random",
+		},
+		{
+			name: "invalid ResponseBody",
+			config: config{
+				URL:          "/",
+				ResponseBody: "",
+				Method:       http.MethodPost,
+			},
+			wantError: "response_body must be valid JSON",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			c := confpkg.MustNewConfigFrom(tc.config)
+			config := defaultConfig()
+			err := c.Unpack(&config)
+
+			// Validate responses
+			if assert.Error(t, err) {
+				assert.Contains(t, err.Error(), tc.wantError)
+			}
+		})
+	}
+}