# Heartbeat: make http check.response.body get negative result based on the match

**URL:** <https://discuss.elastic.co/t/heartbeat-make-http-check-response-body-get-negative-result-based-on-the-match/245332>\
**Category:** Beats\
**Tags:** heartbeat\
**Created:** [August 18, 2020, 2:34am UTC](https://discuss.elastic.co/t/heartbeat-make-http-check-response-body-get-negative-result-based-on-the-match/245332 "2020-08-18T02:34:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lowry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lowry/32/77489_2.png) [@lowry](https://discuss.elastic.co/u/lowry)\
**Post date:** [August 18, 2020, 2:34am UTC](https://discuss.elastic.co/t/heartbeat-make-http-check-response-body-get-negative-result-based-on-the-match/245332/1 "2020-08-18T02:34:28Z")

</div>

Hello everyone,  
Wondering if there's solution for this case:  
We want to do http check over an endpoint: [http://localhost:8080/health](http://localhost:8080/health),  
it returns 3 kinds of response(not json, plain text. just for example)  
“status”: “green”,  
“status”: “yellow”,  
“status”:“red”

Idea is that:

1. HB returns down when "status":"red" in the http check response body.
2. HB returns up when "status":"green" or “status”: “yellow” in the http check response body.

However we can get it done by listing all pattern under http.check.body , like this:

```auto
check.response:
  body:
    - "status" : "green"
    - "status" : "yellow"

```

But if there’s another usecase needs to do the same thing, we have to list all possible patterns too.

So wondering if we can have an uniform solution for this:  
From my perspective, there should be 2 ways:

1. add a new option like `pattern_present` under `check.reponse.body` or under `response`, the same as `response.include_body` to control the final match result based on the pattern matching, like this:

```auto
check.response:
   body:
        pattern_present: false
        - "status": "red"

```

if the value of `pattern_present` is true, the logic of HB is as same as orignial.  
But if it is false, the check result will be success only if this pattern is not in the http check body and it will be fail when the pattern is in the body.

1. make checkBody more powerful, like makes it can support the `condition` like http.check.json.

Fyi, we have to think other solution since the regex in Beats doesn't support negative look:

if setup the negative regexp pattern in HB:

```auto
check.response:
status: 200
body: '((?!"status":"red").)*'

```

Will get this error message in HB’s log:

```auto
2020-08-06T20:26:59.506-0700 ERROR [reload] cfgfile/list.go:94 Error creating runner from config: job err error parsing regexp: invalid or unsupported Perl syntax: `(?!` accessing 'check.response.body' (source:'/ebay/beats/config/monitors.d/debug.yml')

```

Also can refer to this talk in stackoverflow:

> <https://stackoverflow.com/questions/26771592/negative-look-ahead-go-regular-expressions>

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [August 21, 2020, 1:19am UTC](https://discuss.elastic.co/t/heartbeat-make-http-check-response-body-get-negative-result-based-on-the-match/245332/2 "2020-08-21T01:19:50Z")

</div>

This is a great idea for an enhancement. I've written this up as github issue so we can better track it here: [https://github.com/elastic/beats/issues/20728](https://github.com/elastic/beats/issues/20728) . Let's move the conversation there.

---

<div class="post-metadata">

**Author:** ![lowry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lowry/32/77489_2.png) [@lowry](https://discuss.elastic.co/u/lowry)\
**Post date:** [August 21, 2020, 2:49am UTC](https://discuss.elastic.co/t/heartbeat-make-http-check-response-body-get-negative-result-based-on-the-match/245332/3 "2020-08-21T02:49:35Z")

</div>

Thanks Andrew for making this happens.  
Hope we can get a solution for this case.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2020, 4:50am UTC](https://discuss.elastic.co/t/heartbeat-make-http-check-response-body-get-negative-result-based-on-the-match/245332/4 "2020-09-18T04:50:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.