HTTP Filter --- Body Syntax

Elastic Stack Logstash
1

Hello,

I'm trying to use an HTTP filter with a POST and body and I'm having a hard time nailing down the syntax.

The JSON body which I can get working using postman is as follows:

{
  "filters": [
      {
        "days": "30",
        "domain": ".google.ca",
        "type": "domain-contains"
      }
  ]
}

My logstash config is currently...

filter {
  http {
    url => "https://192.168.1.1:3780/api/3/sonar_queries/search"
    verb => "POST"
    body => { "filters": [ { "days": "30", "domain": "%{[domain]}", "type": "domain-contains" } ] }
    body_format => "json"
    user => "logstash"
    password => "testing"
    cacert => "/etc/logstash/internetconsole.pem"
    id => "sonar"
    target_body => "[sonar]"
  }
}

I'm receiving the following error:

:exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"=>\" at line 16, column 24 (byte 302) after filter

Any help would be appreciated! Thank you.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.