Curl in logstash conf

Elastic Stack Logstash
1

Can we use curl option in logstash conf...is this possible or not....

Thank you.

2

You can, but why would you use that?
There is http_poller, or metricbeat or other, better options.

3

Thanks for reply...Actually I want to use update_by_query API which Kibana code given below:
POST sam/products/_update_by_query
{
"query" : {
"constant_score" : {
"filter" : {
"term" : {
"title" : "redmi note 4"
}
}
}
},
"script" : {
"lang":"painless",
"source" : "ctx._source.frequency++"

}
}

I dont know how to run through logstash conf....if you have any sample...it's will be very useful...Below is my logstash query conf...file but I dont know how to use update_by_query API..so I am thinking to use curl in logstash..

input {
elasticsearch {
hosts => "localhost:9200"
index => "queryindex"
query => '
{
"query" : {
"term" : {
"tags" : "solr"
}
}}'
}
}
output {
stdout{
codec => rubydebug
}
csv {
fields => ["id"]
path => "/root/sam/csv-export1.csv"
}
}

Any suggestion you want to give ....

Thank you.

4

So you want to take that query and then the update?

5

Yes warkolm.....but update_by_query is API and I don't know how to use in that logstash conf ....

6

The query in the input looks for solr, but the update is for phones though?

7

No ..actually I just show you my logstash query conf file....above query where I am doing with update_by_query I want to fix in logstash conf file....

8

This is below query with logstash..
input {
elasticsearch {
hosts => "localhost:9200"
index => "sam"
query => '
{
"query" : {
"constant_score" : {
"filter" : {
"term" : {
"title" : "redmi note 4"
}
}
}
},
"script" : {
"lang":"painless",
"source" : "ctx._source.frequency++"

}

}'
}
}
output {
stdout{
codec => json_lines
}
elasticsearch {
action => "_update_by_query"
hosts => ["localhost:9200"]
index => "sam"
document_type => "products"

}
}

9

Hi Shekhar,

I don't think you need to use the update by query option.

Please have a look at:

https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-action

Regards,
N

10

Thanks NerdSec for reply. So I have to write python API...

11

Not required. Just use the elasticsearch output and mention the action as update instead of index.