Getting error while pulling data from an API in Logstash

Elastic Stack Logstash
1

Hey there, can any help me resolve this problem,
I am parsing Cloudflare audit logs via its API, I am putting here my code chunk of .conf file for Logstash plugin input,filter and output. Also, attaching a error screenshot at the end of the message.

I understand it is a regex error, but I want to understand if there is any way I can pass "-" (hyphen).

# The # character at the beginning of a line indicates a comment. Use
# comments to describe your configuration.
input {
        http_poller
        {
                urls => {
                        method => "GET"
                        cloudflare => " https://api.cloudflare.com/client/v4/user/audit_logs"
                {
                    headers => {
                        X-Auth-Email => "email@redacted.com"
                        X-Auth-Key => "api_key"
                        Content-Type => "application/json"
                    }
                }
                }
        }
}
# optional.
filter {
        json
        {
            source => "message"
        }
}
output {
        stdout { codec => rubydebug }
}

Selection_049
Selection_0491849×348 70.6 KB

2

Surround your header names with double quotes.

3

I changed it with double quotes, Now it is giving
[FATAL] 2020-11-10 06:32:38.962 [LogStash::Runner] runner - The given configuration is invalid. Reason: undefined method get for #<Java::OrgLogstashConfigIrImperative::PluginStatement:0x3108d1e1>

4

Is there a stacktrace for that error?

5

I tried to run with --config.debug for detailed error message.

[ERROR] 2020-11-11 07:07:12.982 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"NoMethodError", :message=>"undefined method `get' for #<Java::OrgLogstashConfigIrImperative::PluginStatement:0x7378a09a>", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:227:in `expr'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:219:in `expr'", "/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:150:in `expr'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:114:in `expr_attributes'", "/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:92:in `expr'", "org/jruby/RubyArray.java:2577:in `map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:85:in `expr'", "/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:64:in `block in compile'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/compiler/lscl.rb:62:in `compile'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:36:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:183:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:44:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357:in `block in converge_state'"]}
6

can anyone help me on this issue ?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.