Filebeat CEL Input: how to pass headers in request?

Elastic Stack Beats
1

I'm trying to pull from an API which has got Digest authentication ONLY enabled. Hence cannot use httpjson

But in input.type of cel, how do I pass request headers like 'Content-Type: application/json' etc?

Below is my sample code,

- type: cel
  auth.digest:
	user: myuser
	password: mypass
  resource.url: https://myapi.com/v3/someapi/
  program: |
    bytes(get(state.url).Body).as(body, {
        "events": [body.decode_json()]
    })
  http_headers:
	Content-Type: "application/json"
	my-key: "my-value"

but the http_headers is getting discarded. Any options to pass on the headers?

2

Are you sure you need to set a content-type on the GET request?

Generally GET requests should not have content-type because they do not have request entity (that is, a body), normally content-type would be set on a PUT/POST request.

You can set the Content-Type for a post/put by providing it as the second parameter to the POST request: post(state.url,"application/json",...)

But I dont think CEL supports this for a GET request and I don't think http_headers is a supported field for CEL inputs.

3

Atlast found a way. CEL is very powerful, but very hard to understand from docs !! doh !
So the concept is

- type: cel
  interval: 10m
  resource: 
    url: "https://myapi.com/v3/someapi/"
  program: |
    bytes(request("GET", state.url)
      .with({"Header": {"Accept": ["application/json"], "my-key": ["my-value"]}})
      .do_request().Body
    ) as(body, { 
            "events" : [body.decode_json()]}
          )
1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.