I'm new to the ELK stack and I'd like to know if there's a way to filter the logs in filebeat using a processor that checks some values from an external REST API, and based on the response, it drops or sends the events to elasticsearch. I tried using the script processor and an XMLHttpRequest inside it, but it doesn't seem to work, probably due to the implementation of ECMAScript that is used.
Does anyone have a suggestion?
U can use the httpjson input, HTTP JSON input | Filebeat Reference [7.14] | Elastic
Thanks for your answer, but I wasn't clear explaining my situation. I use filebeat to collect the logs outputted from a machine's syslog. I need to be able to filter those messages based on the state of the REST APIs that are generated from a server that is not linked in any way to the first machine.
Hope this explains the issue better.
Gotcha. Can u provide a sample of what you're trying to do?
Here's the idea. Drop or pass each new syslog based on the values of the JSON response fetched from the server.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.