How to variables in log stash http output


(dinesh) #1

I have configuration file where input as csv and output as http.

I want to pass this csv columns as variable to http output.

Please suggest me way how to do that.

Thanks in Advance....


(Magnus Bäck) #2

You should be able to use standard field references like %{name of field} in the options of the http output. If that doesn't work please show us what you've tried.

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references


(Ritesh) #3

I Also have similar issue with Logstash http output 5.x

where my message is like this

headers => {

         }
         format => "message"
	
   message => '{"ID":"%{ID}","requestNumber":"%{requestNumber}","requestTimestamp":"%{requestTimestamp}"}'

with this format, i am not able to get the http output
However if i try using the hardcode value in message, its working perfectly for me


(dinesh) #4

I am also facing same as rkhapre mentioned


(Magnus Bäck) #5

AFAICT from reading the code this should work. How do you know that the fields you're trying to insert exist in the event? Wouldn't it be easier and safer to use format => "json" instead and let Logstash take care of the JSON serialization?


(Ritesh) #6

This message is Raw payload, i cannot change it to format => "json"
if i am making it json then also its not working

You have any working example with http output. Please suggest that


(Magnus Bäck) #7

This message is Raw payload, i cannot change it to format => "json"

So the payload you want to post isn't application/json but text/plain?

if i am making it json then also its not working

Please show what you've tried and what results you get.


(Ritesh) #8

Thanks magnusbaeck

I have resolved it, since i was using some mutate filter and generating new fields, it was not coming perfectly, as the filter it self was wrong. I discovered this in log files

Overall %{name of field} is working for me.

Thanks!


(system) #9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.