How to set HTTP filter body to whole event

Elastic Stack Logstash
1

Hi guys, just a quick question. I can't seem to find the answer on the docs :confused:

How do I reference the whole event in logstash?

I want to use the HTTP filter to send the whole event to one of our APIs for some quick analysis.

I have tried the below:

        http {
                id => "test-http-01"
                url => "URL"
                verb => "POST"
                connect_timeout => 15
                body => "%{[]}"
                headers => { "Accept" => "application/json" "Content" => "application/json"}
                target_body => "[test]"
                target_headers => "[@metadata][test_response_headers]"
        }

In other HTTP filters, I reference specific fields like [server][name] for example, but how to I get everything? []?

Thanks in advanced!

2

I have not tested it, but you could try something like

ruby { code => 'event.set("[@metadata][body]", event.to_hash)' }

then use

body => "%{[@metadata][body]}"

You might also want to set the body_format option.

3

That worked great! Thank you :slight_smile:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.