Heartbeat HTTP Monitor - GET with JSON Body and Response

Elastic Stack Beats
#1

Hello!

I'm trying to get heartbeat to perform an HTTP GET , while combining a JSON body with the GET request to the page.

My goal is to query an elastic index, take the fields and analyze for up/down accordingly.

In the particular instance, I'll query a logstash index for the last 1m to count the amount of logs via use of range query.

What's the proper syntax, or how can I debug a specific monitor.yml for syntax?

See below:

- type: http
  id: logstash_index_stats
  name: logstash_index_stats
  schedule: '@every 1m'
  urls: ["http://localhost:9200/logstash-*/_count"]
  check.request:
    method: GET
    headers:
      'Content-Type': 'application/json'
    body: '{ "query" : { "range": { "@timestamp" : { "gte" : "now-1m", "lte" : "now" } } } }'
  check.response:
    status: [200, 201]
    json:
      - description: check log count
        condition:
		range:
          count.gte: 1
#2

Question, why not use our alerting feature for this? It's purpose built for this exact use case. I've included a screenshot of alerts in the logs app below:

image
image1232×2346 213 KB

#3

Not the intent of the question, but I appreciate the suggestion - which gears an opportunity for "use-case-end-goal".

To reiterate the challenge, what's the proper formatting of HTTP GET w/ JSON BODY with Heartbeat HTTP monitor? Must it be url encoded or back-ticked or escape-char'd somehow ?

Reasons for using heartbeat include the ability to

  • view all up/down in a single dashboard,
  • probe from multiple locations/to multiple locations
  • run 'processors' on the data as it is consumed
  • modify the thresholds of up/down from the .yml structure
    etc, etc
#4

Sorry, to answer the question of handling the body, You'll probably want to use a YAML HereDoc in the literal style:

body: |
  {
    "some": "json"
  }

I will say that It does sound to me like the Logs app may make more sense than heartbeat for the use case you've shown, which is monitoring logstash data, but what you're showing with heartbeat should technically function.

#5

I was able to use the help and this works:

    - type: http
      id: logstash_index_stats
      name: logstash_index_stats
      schedule: '@every 10s'
      urls: ["http://localhost:9200/logstash-*/_count"]
      check.request:
       method: GET
       headers:
        'Content-Type' : 'application/json'
       body: |
        { "query" : { "range": { "@timestamp": { "gte": "now-1m", "lte": "now/m" } } } }
      check.response:
       status: [200, 201]
       json:
        - description: check log count
          condition:
           range:
            count.gte: 1
1 Like