Is there a way to alter the value of live API data polled using http_poller input plugin?

Hi all,

I have a logstash config file that pulls in live data using the http_poller plugin. Here is my logstash.conf

input {
  http_poller {
    urls => {
        weather => {
            url => ""MY_APP_ID"&units=metric"
            headers => {
              Accept => "application/json"
    schedule => { cron => "* * * * * *" }
    codec => json
filter {
  mutate {
    remove_field => ["@version" ,"command" ,"host" ,"cod" ,"id" ,"base" ,"coord" ,"sys" ,"dt"]
  split { field => "weather" }
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    index => "weather"
  stdout {
    codec => rubydebug

I want to modify the data retrieved from openweathermap every 30 seconds before sending it into elasticsearch. Is there a way to do it?

I would really appreciate if someone could help me out. Thanks!

What do you mean by modify? Could you give an example?

Hi NerdSec,

The"MY_APP_ID"&units=metric API gives me a lot of data (fields), like temperature, humdity, pressure, etc.

For instance, I want to alter the actual temperature value polled in by logstash, and then send that value to elasticsearch.

Let's assume the main.temp is 20ºF. Now, I want logstash to make it 30ºF and send that data to elasticsearch

So, I'd like to know if there is a way to do this. Please help me out here.


You can do arithmetic operations using the ruby filter. Here are some links.


Thanks a lot NerdSec!

My goal is to perform addition operation on main.temp value (main.temp = main.temp + 10) every 30 seconds. Elasticsearch is something new to me. So I would be grateful if you could let me know what exactly needs to be added or changed in the logstash.conf.


I am not sure how to do it for every 30 sec. As far as I am aware, the said filter will run for every event, irrespective of time.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.