# Http input plugin, url with param from field

**URL:** https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365
**Category:** Logstash
**Created:** [August 3, 2021, 8:06pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365 "2021-08-03T20:06:26Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![cibernicola](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cibernicola/32/85621_2.png) [@cibernicola](https://discuss.elastic.co/u/cibernicola)
#### Post date: [August 3, 2021, 8:06pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365/1 "2021-08-03T20:06:26Z")

</div>

I have a standard logstash config, where I store several fields form a log.

With one field I need to "ask something" to an external API with an specific url pattern, which is:

staticString+variableField+staticString

So, variableField comes from a field previously parsed, called, for example, previousField.

I have this config (one of my several test which, obviously doesn't work):

```auto
filter {
    http {
        url => "staticString%{previousField}staticString"
        verb => POST
    }

```

So the question is, is possible to build an URL with this structure: staticString+previousField+staticString?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 3, 2021, 8:56pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365/2 "2021-08-03T20:56:31Z")

</div>

The code does sprintf the url, so a field reference should get substituted. If you enable log.level debug you will see what URL it is actually using.

---

<div class="post-metadata">

### Author: ![cibernicola](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cibernicola/32/85621_2.png) [@cibernicola](https://discuss.elastic.co/u/cibernicola)
#### Post date: [August 3, 2021, 9:24pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365/3 "2021-08-03T21:24:32Z")

</div>

Yes, sorry, what I'm getting using this: `staticString%{previousField}staticString`  
is:  
`Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"=>\" at line 27, column 17 (byte 726) after filter {\n http {\n url => \" **https://domain/apiEndPoint/?param=string&param=%{previousField}&param=string** \"\n #query => { \"q\" => \"%{[source]}\n verb => POST\n }\n\n\noutput {\n elasticsearch "`

I'm seeing the literal of `%{previousField}` not its content ☹

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 3, 2021, 9:51pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365/4 "2021-08-03T21:51:32Z")

</div>

> [@cibernicola](#):
>
> { "q" =\> "%{[source]}\n verb =\> POST\n }\n\n\noutput {\n elasticsearch "

You didn't close the double quotes around %{[source]}

---

<div class="post-metadata">

### Author: ![cibernicola](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cibernicola/32/85621_2.png) [@cibernicola](https://discuss.elastic.co/u/cibernicola)
#### Post date: [August 3, 2021, 10:08pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365/5 "2021-08-03T22:08:23Z")

</div>

strange that part was comented with #  
Well I've just deleted and now I can see the final url, and don't know why its like this:  
`

`"https://domain/apiEndPoint/?param=string&param=%{previousField}&param=string"`

I mean, it takes literal value of %{previousField} instead of field's value, what am I doing wrong?

This field comes from an input using Twitter input plugin

`

---

<div class="post-metadata">

### Author: ![cibernicola](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cibernicola/32/85621_2.png) [@cibernicola](https://discuss.elastic.co/u/cibernicola)
#### Post date: [August 3, 2021, 10:25pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365/6 "2021-08-03T22:25:31Z")

</div>

My fault, wrong field, I've selected the correct one and now its working fine, thanks @Badger for your time and patience 🙂

---

<div class="post-metadata">

### Author: ![cibernicola](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cibernicola/32/85621_2.png) [@cibernicola](https://discuss.elastic.co/u/cibernicola)
#### Post date: [August 3, 2021, 10:32pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365/7 "2021-08-03T22:32:25Z")

</div>

But I'm seeing this:

`> error during HTTP request {:url=>"https://domain/apiEndPoint/?param=string&param=%{previousField}&param=string", :body=>nil, :client_error=>"Illegal character in query at index 113: https://domain/apiEndPoint/?param=string&param=%{previousField}&param=string"}`

But if I copy/paste that url it Works on browser 🙃

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 31, 2021, 10:32pm UTC](https://discuss.elastic.co/t/http-input-plugin-url-with-param-from-field/280365/8 "2021-08-31T22:32:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
