# Curl a webservice using ruby filter

**URL:** <https://discuss.elastic.co/t/curl-a-webservice-using-ruby-filter/166734>\
**Category:** Logstash\
**Created:** [February 1, 2019, 12:40pm UTC](https://discuss.elastic.co/t/curl-a-webservice-using-ruby-filter/166734 "2019-02-01T12:40:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ruby.gem](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@ruby.gem](https://discuss.elastic.co/u/ruby.gem)\
**Post date:** [February 1, 2019, 12:40pm UTC](https://discuss.elastic.co/t/curl-a-webservice-using-ruby-filter/166734/1 "2019-02-01T12:40:26Z")

</div>

Hello,

Im trying to consume some events from a webservice with curl using ruby code in logstash filter. The service requires an ip address to be supplied with -d switch.

`curl -s -XPOST -d 'ip=151.101.0.81' 'http://api.greynoise.io:8888/v1/query/ip'`

input {"ip":"151.101.0.81"} into the code snippet, it doesnt work as expected. Might be missing something in the ruby section.

```
input { stdin { codec => json_lines } }

filter { 

 ruby {
 init => "
   require 'net/http'
   require 'uri'
   require 'json'
 "
 code => "
   uri = URI.parse('http://api.greynoise.io:8888/v1/query/ip')
   request = Net::HTTP::Post.new(uri)
   request.set_form_data(
     "ip" => event.get('[ip]'),
   )

   response = Net::HTTP.get_response(uri)
   if response.code == '200'
     result = JSON.parse(response.body)
     event.set('[graynoise_status]', result)
   else
     event.set('[graynoise_status]', 'ERROR reaching greynoise service')
     end
    "
  }
}

output {
   stdout { codec => "rubydebug" }
 }
```

---

<div class="post-metadata">

**Author:** ![ruby.gem](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@ruby.gem](https://discuss.elastic.co/u/ruby.gem)\
**Post date:** [February 1, 2019, 12:46pm UTC](https://discuss.elastic.co/t/curl-a-webservice-using-ruby-filter/166734/2 "2019-02-01T12:46:56Z")

</div>

@Badger has always been super helpful in the past 🙂

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 1, 2019, 10:26pm UTC](https://discuss.elastic.co/t/curl-a-webservice-using-ruby-filter/166734/3 "2019-02-01T22:26:30Z")

</div>

> [@ruby.gem](#):
>
> request.set\_form\_data( "ip" =\> event.get('[ip]'), )

This needs to be a hash, and if you want to use double quotes you need to escape them.

```
request.set_form_data( { 'ip' => event.get('[ip]') } )

```

> [@ruby.gem](#):
>
> response = Net::HTTP.get\_response(uri)

You need to request the request you have just built, and this does not do that.

```
            http = Net::HTTP.new(uri.host, uri.port)
            response = http.request(request)

```

---

<div class="post-metadata">

**Author:** ![ruby.gem](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@ruby.gem](https://discuss.elastic.co/u/ruby.gem)\
**Post date:** [February 1, 2019, 10:39pm UTC](https://discuss.elastic.co/t/curl-a-webservice-using-ruby-filter/166734/4 "2019-02-01T22:39:50Z")

</div>

Thank you. Was able to create the correct request using this tool - [https://jhawthorn.github.io/curl-to-ruby/](https://jhawthorn.github.io/curl-to-ruby/).

The working filter:

```auto
filter {

  ruby {
     init => "
       require 'net/http'
       require 'uri'
       require 'json'
     "
     code => "
       uri = URI.parse('http://api.greynoise.io:8888/v1/query/ip')
       request = Net::HTTP::Post.new(uri)
       request.set_form_data(
        { 'ip' => event.get('[ip]') }
       )

     req_options = {
       use_ssl: uri.scheme == 'https',
     }

     response = Net::HTTP.start(uri.hostname, uri.port, req_options) do |http|
       http.request(request)
     end

       if response.code == '200'
         result = JSON.parse(response.body)
         event.set('[graynoise_status]', result)
       end
     "
   }

}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 1, 2019, 10:39pm UTC](https://discuss.elastic.co/t/curl-a-webservice-using-ruby-filter/166734/5 "2019-03-01T22:39:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.