Hi Guys,
input{
filter {@Version " }@timestamp " }@metadata ][index]" => "%{[eventHeader][bpcName]}%{[eventHeader][applicationId]}"} }@metadata ][ObjectCode]" => "%{[eventHeader][applicationId]} %{[eventHeader][objectCode]}"} }@metadata ][action]" => "%{[event][action]}"} }@metadata ][applicationId]" => "%{[eventHeader][applicationId]}"} }@metadata ][itemId]" => "%{[eventData][itemId]}"} }@metadata ][isDeleted]" => "%{[eventData][isDeleted]}"} }@metadata ][action]","INSERT","index"] }@metadata ][action]","Insert","index"] }@metadata ][action]","UPDATE","update"] }@metadata ][action]","Update","update"] }@metadata ][action]","DELETE","delete"] }@metadata ][action]","Delete","delete"] }
ruby {https://dm-dev-authenticationservice-serviceapps-use-rg.azurewebsites.net/api/v1/Token "@metadata ][itemId]"}'@metadata ][applicationId] == "62"http://172.20.188.15:9200 "@metadata ][index]}"@metadata ][ObjectCode]}"@metadata ][action]}"@metadata ][itemId] needs to be replcae in body section@metadata ][itemId]"}'
like body =>
tamilsweet
June 4, 2020, 6:11am
2
Please use formatting so that your question is readable.
I think you just have to change
'{"ClientId":"%[@metadata][itemId]"}'
to
'{"ClientId":"%{[@metadata][itemId]}"}'
Hi Thanks,
for quick responce still its not working for me,@metadata ][itemId]}"}",
tamilsweet
June 4, 2020, 6:23am
4
Can you please format the config in your question?
input{
kafka {
bootstrap_servers => "172.20.188.11:9092,172.20.188.31:9092,172.20.188.30:9092"
topics => ["DS_Test"]
decorate_events => true
group_id => "ds_test"
codec => json
max_poll_records => "100"
consumer_threads => 2
session_timeout_ms => "30000"
auto_offset_reset => "earliest"
client_id => "logstash-ingestion"
}
}
filter {
mutate { remove_field => "@Version" }
mutate { remove_field => "@timestamp" }
mutate { add_field => { "[@metadata][index]" => "%{[eventHeader][bpcName]}%{[eventHeader][applicationId]}"} }
mutate { add_field => { "[@metadata][ObjectCode]" => "%{[eventHeader][applicationId]}%{[eventHeader][objectCode]}"} }
mutate { add_field => { "[@metadata][action]" => "%{[event][action]}"} }
mutate { add_field => { "[@metadata][applicationId]" => "%{[eventHeader][applicationId]}"} }
mutate { add_field => { "[@metadata][itemId]" => "%{[eventData][itemId]}"} }
mutate { add_field => { "[@metadata][isDeleted]" => "%{[eventData][isDeleted]}"} }
mutate { gsub => ["[@metadata][action]","INSERT","index"] }
mutate { gsub => ["[@metadata][action]","Insert","index"] }
mutate { gsub => ["[@metadata][action]","UPDATE","update"] }
mutate { gsub => ["[@metadata][action]","Update","update"] }
mutate { gsub => ["[@metadata][action]","DELETE","delete"] }
mutate { gsub => ["[@metadata][action]","Delete","delete"] }
mutate { remove_field => "[logstash]" }
mutate { remove_field => "[metadata]" }
mutate { remove_field => "[eventHeader]" }
mutate { remove_field => "[event]" }
ruby {
code => '
details_hash = event.get("eventData")
return if details_hash.nil?
details_hash.each do |k, v|
event.set(k,v)
end
event.remove("eventData")
hash = event.to_hash
hash.each {|k,v|
data = event.get(k)
return if data.nil?
event.set(k,v)
}'
}
json{ source=>"message" }
}
input {
http_poller {
urls => {
soap_request => {
method => post
url => "https://dm-dev-authenticationservice-serviceapps-use-rg.azurewebsites.net/api/v1/Token"
headers => {
"Content-Type" => "application/json"
}
body =>
'{"ClientId":"%[@metadata][itemId]"}'
}
}
request_timeout => 60
schedule => { cron => "* * * * * UTC"}
codec => "json"
metadata_target => "http_poller_metadata"
}
}
output{
if [@metadata][applicationId] == "62"
{
elasticsearch {
hosts => "http://172.20.188.15:9200"
user => "elastic"
password => "changeme"
index => "%{[@metadata][index]}"
document_id => "%{[@metadata][ObjectCode]}"
action => "%{[@metadata][action]}"
}
}
stdout { codec => rubydebug { metadata => true} }
}
please find formatted config
I want to assign value to ClientId which is [@metadata ][itemId] value .
I do not think this will work. The url (including the options hash which contains the body option) is passed to the Manticore library that logstash uses. logstash does not sprintf the option before passing it, so sprintf references like this will not get expanded.
system
July 2, 2020, 1:29pm
10
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.