Http input plugin, url with param from field

Elastic Stack Logstash
1

I have a standard logstash config, where I store several fields form a log.

With one field I need to "ask something" to an external API with an specific url pattern, which is:

staticString+variableField+staticString

So, variableField comes from a field previously parsed, called, for example, previousField.

I have this config (one of my several test which, obviously doesn't work):

filter {
    http {
        url => "staticString%{previousField}staticString"
        verb => POST
    }

So the question is, is possible to build an URL with this structure: staticString+previousField+staticString?

2

The code does sprintf the url, so a field reference should get substituted. If you enable log.level debug you will see what URL it is actually using.

3

Yes, sorry, what I'm getting using this: staticString%{previousField}staticString
is:
Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"=>\" at line 27, column 17 (byte 726) after filter {\n http {\n url => \"**https://domain/apiEndPoint/?param=string&param=%{previousField}&param=string**\"\n #query => { \"q\" => \"%{[source]}\n verb => POST\n }\n\n\noutput {\n elasticsearch "

I'm seeing the literal of %{previousField} not its content :frowning:

4

You didn't close the double quotes around %{[source]}

5

strange that part was comented with #
Well I've just deleted and now I can see the final url, and don't know why its like this:
`

"https://domain/apiEndPoint/?param=string&param=%{previousField}&param=string"

I mean, it takes literal value of %{previousField} instead of field's value, what am I doing wrong?

This field comes from an input using Twitter input plugin

`

6

My fault, wrong field, I've selected the correct one and now its working fine, thanks @Badger for your time and patience :slight_smile:

7

But I'm seeing this:

> error during HTTP request {:url=>"https://domain/apiEndPoint/?param=string&param=%{previousField}&param=string", :body=>nil, :client_error=>"Illegal character in query at index 113: https://domain/apiEndPoint/?param=string&param=%{previousField}&param=string"}

But if I copy/paste that url it Works on browser :upside_down_face:

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.