# Httpjson Input Config Issue

**URL:** https://discuss.elastic.co/t/httpjson-input-config-issue/299909
**Category:** Beats
**Tags:** fleet, filebeat
**Created:** [March 17, 2022, 2:59am UTC](https://discuss.elastic.co/t/httpjson-input-config-issue/299909 "2022-03-17T02:59:39Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![bm11100](https://avatars.discourse-cdn.com/v4/letter/b/b3f665/32.png) [@bm11100](https://discuss.elastic.co/u/bm11100)
#### Post date: [March 17, 2022, 2:59am UTC](https://discuss.elastic.co/t/httpjson-input-config-issue/299909/1 "2022-03-17T02:59:39Z")

</div>

I am using the Fleet integration for httpjson to attempt to pull down API logs.

The request I am mimicking in the config is the curl request below (which works correctly).

```auto
curl --location --request POST 'https://api.jumpcloud.com/insights/directory/v1/events' \
--header 'Content-Type: application/json' \
--header 'x-org-id: xxxxxx' \
--header 'x-api-key: xxxxxxxxxxxxxxxx' \
--data-raw '{"service": ["all"], "start_time": "2022-03-01T14:00:00Z"}'

```

In the Fleet config for the integration, I am setting the request transforms, like so -

```auto
- set:
    target: header.Content-Type
    value: 'application/json'
- set:
    target: header.x-org-id
    value: 'xxxxxxxx'
- set:
    target: header.x-api-key
    value: 'xxxxxxxxxxxxxxxx'
- set:
    target: body.service
    value: ["all"]
- set:
    target: body.start_time
    value: '2022-03-15T14:00:00Z'

```

I've tried all variations of the below, which I think may be the issue, including `"all"`, `"[all]"`, `all`, `[all]`, but to no avail.

```auto
- set:
    target: body.service
    value: all

```

I continue to get errors like this one.

```auto
[elastic_agent.filebeat][error] Error while processing http request: failed to execute http client.Do: server responded with status code 400: {"message":"Unable to parse JSON request body Invalid service: \u0026[34 97 108 108 34] json: cannot unmarshal string into Go value of type []model.ServiceEnum"}

```

Can anyone assist in what I may be doing wrong, so I can correctly get the integration pulling logs from the API endpoint?

---

<div class="post-metadata">

### Author: ![marc.guasch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marc.guasch/32/74642_2.png) [@marc.guasch](https://discuss.elastic.co/u/marc.guasch)
#### Post date: [March 18, 2022, 11:34am UTC](https://discuss.elastic.co/t/httpjson-input-config-issue/299909/2 "2022-03-18T11:34:13Z")

</div>

Hello! If you need the value to be an array, you can try [append](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_append) instead of set:

```auto
- append:
    target: body.service
    value: "all"

```

Let me know if that works!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 15, 2022, 1:35pm UTC](https://discuss.elastic.co/t/httpjson-input-config-issue/299909/3 "2022-04-15T13:35:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.