Dynamic fields in request body

Elastic Stack Beats
1

I have a need to generate dynamic content in the request body of http-based heartbeat requests.
I need to generate a unique UUID for each call and also a timstamp based on current time in ISO 8601 format.
e.g.:

check.request.body: '
    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"        
    <soapenv:Header/>
    <soapenv:Body>
        <someRequest>
            <requestID>b804e8b2-a5f3-418b-bc07-d47af32c49f6</requestID
             <requestTimestamp>2019-05-13T10:32:48.000+02:00</requestTimestamp>
...

Any ideas on how to accomplish this?

2

Hi,

In short, as of right now, you can't.
This is not supported by heartbeat but you can open a feature request on github and document your use case.

You could fork heartbeat if you have access to a GO developer or add the feature yourself.
You could also use metricbeat and its http module, either the json metricset or the server metricset. In that case you would write an external program or script and this external process would either push the result into the metricbeat http server metricset OR be polled by metricbeat http json metricset poller.

The external program could be either a script that runs like a cronjob or a systemd timer and once done pushed a json event into metricbeat http server. (The event goes to ES...)

The external program could be a python flask REST app running locally with metricbeat and responding to a metricbeat http json poller, answering with the result of your custom check. (The event goes to ES...)

The external program could do everything and log the result to a file which you point filebeat to so it get sent to ES.

Basically at this point it really depends on the path of least resistance for you and your usecase. I would pick a beat like metricbeat or filebeat and add the rest around it to delegate what I can to a beat and implement only the business logic (UUID and timestamp) in the custom external part.

3

Created a feature request

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.