# How to pass variable base parameter in http\_poller logstash input plugin

**URL:** https://discuss.elastic.co/t/how-to-pass-variable-base-parameter-in-http-poller-logstash-input-plugin/298621
**Category:** Logstash
**Created:** [March 2, 2022, 1:33pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-base-parameter-in-http-poller-logstash-input-plugin/298621 "2022-03-02T13:33:58Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Purushottam22](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/purushottam22/32/92715_2.png) [@Purushottam22](https://discuss.elastic.co/u/Purushottam22)
#### Post date: [March 2, 2022, 1:33pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-base-parameter-in-http-poller-logstash-input-plugin/298621/1 "2022-03-02T13:33:58Z")

</div>

Hi All,

Can you please help me with below issue,

I am trying to hit two rest api for below two conditions:

1. First is used for providing the login credentials and it will give an response as session id.
2. I have to use the session id which i get as a first api response in second api hit to will pull actual data using rest api

Sample API requests:  
First api: curl -i -k --header "Authorization: Basic cWFAcWE6cWE=" [https://computer.network.net/attunityenterprisemanager/api/v1/login](https://computer.network.net/attunityenterprisemanager/api/v1/login)

second api: CURL.EXE -i -k --header "SessionID: wCo0\_KvjEUFROvfHF5KGrw" [https://computer.network.net/attunityenterprisemanager/api/v1/security/audit\_trail?start\_timestamp={start\_timestamp}&end\_timestamp={end\_timestamp}](https://computer.network.net/attunityenterprisemanager/api/v1/security/audit_trail?start_timestamp=%7Bstart_timestamp%7D&end_timestamp=%7Bend_timestamp%7D)

can anyone help me how can i pass the session id in second api header as a variable value?

@ [Badger](https://discuss.elastic.co/u/Badger) [@elastic\_team](https://discuss.elastic.co/groups/elastic_team) Elastic Team Member

Kindly assist

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 2, 2022, 8:16pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-base-parameter-in-http-poller-logstash-input-plugin/298621/2 "2022-03-02T20:16:41Z")

</div>

You cannot do that using an http\_poller input. You will have to use http filters. You can drive the schedule using a heartbeat input

```
heartbeat { interval => 60 }

```

If you can do a login for every audit\_trail request then just use two http filters. If you need to use a single session for everything then you will need to use a single worker thread, and I think you will need to set pipeline.ordered to be true. Maybe something like

```
ruby {
    code => '
        if ! @@sessionId
            event.set("[@metadata][needId]", true)
        end
    '
}

if ! [@metadata][needId] {
    ruby { code => 'event.set([@metadata][id]", @@sessionId)' }
else
    http {
        # Make the call to api/v1/login
    }
    # Parse the session id from the response into [@metadata][id]
    ruby { code => '@@sessionId = event.get("[@metadata][id]")' }
end
http {
    # Make the call to audit_trail
}

```

Note the use of a variable with class scope (@@) so that multiple ruby filters can share it. `[@metadata]` is a field on the event that is ignored by most outputs, so it is useful for temporary variables.

If sessions expire then you will need to add code that sets `@@sessionId` back to nil just before that happens.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 4, 2022, 12:24pm UTC](https://discuss.elastic.co/t/how-to-pass-variable-base-parameter-in-http-poller-logstash-input-plugin/298621/4 "2022-04-04T12:24:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
