Http_poller REST API authentication token

Elastic Stack Logstash
1

Hello,
I'm trying to use logstasth http_poller plugin to get some events from a rest API method.
Before calling the events API methods, I should call the login method and get a token from its response. While I use the events API, I have to provide the token I just got from the login method.
Can I have some example how to do it?

2

Here is an example

input {
  http_poller {
    urls => {
      my-api-poller => {
        method => get
		cacert => "/home/my-user/my-ssl.io.cert.cer"
		pool_max => 1
		pool_max_per_route => 1
		keepalive => true
		automatic_retries => 1
		socket_timeout => 60
        url => "https://my-api-url"
        headers => {
          Accept => "application/json"
		  Authorization => "Bearer my-token"
        }
     }
    }
    request_timeout => 60
	schedule => { every => "15m"}
    codec => "json"
    metadata_target => "my-assets"
  }
}
3

thanks Yassine,
I have two methods to call:

  1. Login method - which is givving me the token and its reponse headers. and then call the second method
  2. GetEvents method - which is needed for the token from the Login method.

At your example:

  1. Where is the login method call?
  2. Where is the GetEvents method should be placed?
  3. How can I pass the token from the login call to the GetEvents call?
  4. 'my-token' - Am I need to use it somewhere?
4

in this case, you can use the input plugin http_poller to get the token
then use that token with the filter plugin http to get your events

5

thanks. Any example for this solution?

6

The input use http_poller for authentification and getting a token

input {
  http_poller {
    urls => {
      my-api-poller => {
        method => get
		cacert => "/home/my-user/my-ssl.io.cert.cer"
		pool_max => 1
		pool_max_per_route => 1
		keepalive => true
		automatic_retries => 1
		socket_timeout => 60
        url => "https://my-api-url"
        headers => {
          Accept => "application/json"
		  Authorization => "Basic username:password"
        }
     }
    }
    request_timeout => 60
	schedule => { every => "15m"}
    codec => "json"
    metadata_target => "my-token"
  }
}

In the filter section of your LS config, you need to access the field my-token et get the token from the response
Then use this token as part of http filter

http {
  body_format => "json"
  follow_redirects => false
  body => {
    "attribute" => "%{[attribute_value]}"
  }
  url => "my-api-url/GetEvents"
  verb => "POST" --- or GET !
  headers => [ "Authorization", "Bearer ${My-token}" ]
  target_body => "[@metadata][api_response]"
  target_headers => "[@metadata][api_headers]" 
}

...

Hope this can help

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.