# How to connect with GLPI API?

**URL:** <https://discuss.elastic.co/t/how-to-connect-with-glpi-api/371242>\
**Category:** Logstash\
**Created:** [November 29, 2024, 3:00pm UTC](https://discuss.elastic.co/t/how-to-connect-with-glpi-api/371242 "2024-11-29T15:00:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sebastien\_jacques](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sebastien_jacques/32/139602_2.png) [@sebastien\_jacques](https://discuss.elastic.co/u/sebastien_jacques)\
**Post date:** [November 29, 2024, 3:00pm UTC](https://discuss.elastic.co/t/how-to-connect-with-glpi-api/371242/1 "2024-11-29T15:00:46Z")

</div>

Hi

I come to seek your help.  
I configured my logstash to retrieve data from my "alert2" index.  
it works. My goal is that when an event from this index arrives with the name "root-connection", it will create a ticket in glpi.

except that I still have the same problem with a return: missing session\_token.

Here's where I am :

```auto
input {
  beats {
    port => "5044"
  }
  elasticsearch {
    hosts => ["http://x.x.x.x:9200"]
    user => "myusername"
    password => "mypassword"
    index => "alert2"
  }
}

filter {
  if [fields][source] == "client" or [fields][source] == "server" {
    grok {
      match => { 
        "message" => "%{TIMESTAMP_ISO8601:date} %{HOUR:heure}:%{MINUTE:mn}:%{SECOND:secondes} %{USERNAME:username} %{DATA:reseau_source} %{IP:ip_destination} %{GREEDYDATA:message}" 
      }
    }
  }

  if [_index] == "alert2" {
    # Initialisation de la session
    http {
      url => "http://x.x.x.x:80/apirest.php/initSession"
      verb => "POST"
      headers => {
        "Content-Type" => "application/json"
        "app-token" => "GLPIAPPTOKEN"
      }
      target_body => '{"login": "userlogin", "password": "userpassword"}'
    }

    # Extraction du session_token
    json {
      source => "message"
      target => "session_response"
    }

    # Ajout du session_token aux événements
    mutate {
      add_field => { "session-token" => "%{[session_response][session_token]}" }
    }
  }
}

output {
  if [fields][source] == "client" {
    elasticsearch {
      hosts => ["http://x.x.x.x:9200"]
      user => "username"
      password => "password"
      index => "client-logs-%{+YYYY.MM.dd}"
    }
  } else if [fields][source] == "server" {
    elasticsearch {
      hosts => ["http://x.x.x.x:9200"]
      user => "username"
      password => "password"
      index => "server-logs-%{+YYYY.MM.dd}"
    }
  }

  if [name] == "root_connection" {
    # Création du ticket
    http {
      url => "http://x.x.x.x:80/apirest.php/Ticket"
      http_method => "post"
      format => "json"
      headers => {
        "Content-Type" => "application/json"
        "session_token" => "Bearer %{session-token}"
        "app-token" => "GLPI APPTOKEN"
      }
      message => '{"name": "Alerte de sécurité détectée", "content": "sécurité compromise", "status": 1, "priority": 1, "requesters_id": 4}'
      codec => "json"
    }
  }

  stdout {
    codec => rubydebug
  }
}

```

Thanks  
thanks for your help

---

<div class="post-metadata">

**Author:** ![joaocamara](https://avatars.discourse-cdn.com/v4/letter/j/ee59a6/32.png) [@joaocamara](https://discuss.elastic.co/u/joaocamara)\
**Post date:** [February 5, 2025, 6:27pm UTC](https://discuss.elastic.co/t/how-to-connect-with-glpi-api/371242/2 "2025-02-05T18:27:17Z")

</div>

Hi Jacques,  
I am facing some problems to integrate GLPI to ELK, could you please help me?  
joao.camara@cyberco.com.br