Alternative to capture_body

[Bhavani_Ananth]

Hello Team,

There is a new requirement wherein we need to parse a certain tracking number that is part of the http url or part of the request body.

The one in the url can be easily retrieved.(http.url and using logstash parsing)
Is there a way to retrieve the same from the request body without enabling capture_body option as the latter has performance implications.

Please do let me know if any other options are available.
Thanks in advance for your help!

The following are some details related to the elastic stack,
Kibana version: 7.8.1

Elasticsearch version: 7.8.1.

APM Server version: 7.8.1

APM Agent language and version: Java, 1.18

Browser version:

Original install method (e.g. download page, yum, deb, from source, etc.) and version: yum

Fresh install or upgraded from other version? fresh install

Is there anything special in your setup? No

Regards,
Bhavani

[Sylvain_Juge]

Hi @Bhavani_Ananth ,

It is not possible to capture something from the request body without capturing the whole body.
For the performance implications, if you haven´t already doing an experiment is the best way to know if that's actually an issue in your use-case as it all depends on the actual application load, the request body size, ...

But, by reading your use-case description:

• you are already using Elastic APM Agent (version 1.18 is very old, you should update it)
• you need to capture a tracking ID that might be provided through the request body or URL

Here it sounds to be a perfect use-case to use the Agent public API, in particular it could allow to capture the tracking ID by using the transaction custom context:

String trackingId = ""; // get tracking ID from your application code
ElasticApm.currentTransaction().addCustomContext("tracking_id", trackingId);