Input HTTP_Poller Body with field issue


I'm using the http_poller plugin as input where I perform a SOAP Call to an external system. It works perfectly fine while using a fixed body. However, the body contains date fields which must be the date of today. I can't get it to work to use previously defined fields in the body. I've created a small conf file, as shown below:

input {
  http_poller {
	add_field => {"[basedateSOAP]" => "%{+YYYY-MM-dd}"}
	add_field => {"[requestSOAP]" => '<soapenv:Envelope xmlns:soapenv=""><soapenv:Header></soapenv:Header><soapenv:Body><type><Start_Date>%{[basedateSOAP]}</Start_Date><End_Date>%{[basedateSOAP]}</End_Date></type></soapenv:Body></soapenv:Envelope>'}
	urls => { 
	soap_request => {
	method => post
	url => "https:/"
	headers => {
	"Content-Type" => "text/xml; charset=utf-8"
	#body => '<soapenv:Envelope xmlns:soapenv=""><soapenv:Header></soapenv:Header><soapenv:Body><type><Start_Date>%{[basedateSOAP]}</Start_Date><End_Date>%{[basedateSOAP]}</End_Date></type></soapenv:Body></soapenv:Envelope>'	
	body => "%{[requestSOAP]}"

request_timeout => 60
schedule => { cron => "* * * * * UTC"}
codec => "plain"

output {
file {
            codec => plain {
                    format => "%{[message]} %{[basedateSOAP]} %{[requestSOAP]}"
 path => "/tmp/logstash/output.log"

If tried in with both the first and second body. Both don't seem to accept a field.

Thanks in advance.



The add_field is not executed until the input has successfully created an event, so you cannot reference those fields in setting the body.

Thanks for your reply. Is there maybe another way to get the currentDate in the message body? I also tried to use %{+YYYY-MM-dd} in the body string. However, no luck.

Use an http filter instead of an http input, perhaps?

I try to figure out how I can use SOAP in that case. I like the HTTP_Poller for multiple reasons, so I really try to find a solution to have the currentDate in that body.

Fixed it via exec python

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.