Filebeat CEL Input: how to pass headers in request?

I'm trying to pull from an API which has got Digest authentication ONLY enabled. Hence cannot use httpjson

But in input.type of cel, how do I pass request headers like 'Content-Type: application/json' etc?

Below is my sample code,

- type: cel
	user: myuser
	password: mypass
  program: |
    bytes(get(state.url).Body).as(body, {
        "events": [body.decode_json()]
	Content-Type: "application/json"
	my-key: "my-value"

but the http_headers is getting discarded. Any options to pass on the headers?

Are you sure you need to set a content-type on the GET request?

Generally GET requests should not have content-type because they do not have request entity (that is, a body), normally content-type would be set on a PUT/POST request.

You can set the Content-Type for a post/put by providing it as the second parameter to the POST request: post(state.url,"application/json",...)

But I dont think CEL supports this for a GET request and I don't think http_headers is a supported field for CEL inputs.

Atlast found a way. CEL is very powerful, but very hard to understand from docs !! doh !
So the concept is

- type: cel
  interval: 10m
    url: ""
  program: |
    bytes(request("GET", state.url)
      .with({"Header": {"Accept": ["application/json"], "my-key": ["my-value"]}})
    ) as(body, { 
            "events" : [body.decode_json()]}

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.