Filebeat HTTP JSON with epochtime

[seefor (Sif Baksh)]

Can filebeat be configured to pass epoch time every 15 minutes?

filebeat.inputs:

• type: httpjson
  url: https://api.ipify.org/?format=json&t0=epochtime-15minutes&t1=epochtimenow

[kvch (Noémi Ványi)]

No, unfortunately, it's not possible.

[seefor (Sif Baksh)]

Thanks

[Marius_Iversen]

Hello @seefor . The httpjson input will have this functionality in a upcoming release (which release might change over time, just adding that here), adding lots of new features including what you are looking for, the new docs should be available here: HTTP JSON input | Filebeat Reference [7.11] | Elastic

An example for your usecase, if you just want to run a get request (did not test it, so might need some tweaks):

filebeat.inputs:
- type: httpjson
  config_version: 2
  request.url: https://api.ipify.org/?format=json
  request.method: GET
  request.transforms:|
  - set:
        target: url.params.t0
        value: '[[ formatDate (now (parseDuration "-15m")) "UnixDate" ]]'
    - set:
        target: url.params.t1
        value: '[[ formatDate (now) "UnixDate" ]]'

There is lots of other features as well, easier pagination, object splitting, possibility to keep state (like using the timestamp from the last response in the next request etc).

[seefor (Sif Baksh)]

WOW, this is going to be fun!
Thank you so much @Marius_Iversen, do you know when that release drop?

There is lots of other features as well, easier pagination, object splitting, possibility to keep state (like using the timestamp from the last response in the next request etc).

O man you read my mind, I was about to ask that next