Logstash Exec Curl - cant create valid JSON

[johnwood]

I was referred to GutHub by ES Cloud Support in ticket #00344788 but I thought I should check here first before heading over there.

I am trying to get a logstash exec command to work with a curl call that needs JSON payload.

Cloud support got me as far as this:
command => "curl -X POST 'https://api.ontraport.com/1/objects' --header 'Content-Type: application/json' --header 'Api-Key: ABCABCABC' --header 'Api-Appid: XYZXYZXYZ' -d '{"objectID": 0}'"

The problem I face is that the JSON payload ( -d '{"objectID": 0}' ) is getting further escaped in the curl command and ends up being sent like this:

'{\\\"objectID\\\": 0}' 

which is then rejected by the target system as bad json and is confirmed as bad json by jsonlint.com

The debug log in logstash shows this:

[2019-06-07T12:52:06,429][DEBUG][logstash.outputs.exec ] running exec command {:command=>"curl -X POST 'https://api.ontraport.com/1/objects\' --header 'Content-Type: application/json' --header 'Api-Key: XYZXYZXYZ' --header 'Api-Appid: ABCABCABCABC' -d '{\"objectID\": 0}'"}

[2019-06-07T12:52:08,034][DEBUG][logstash.outputs.exec ] debugging command {:stdout=>"Invalid request. Could not parse JSON."

Can a Logstash expert please tell me if this is a config problem on my side or a bug?

I have tried this using version 6.2.4 and 7.1.1 and I am running logstash on a Mac OSX right now

thanks.

[danhermann]

@johnwood, I would suggest escaping the quotes around your JSON content and ensuring that the config.support_escapes setting is enabled per the docs:

https://www.elastic.co/guide/en/logstash/master/configuration-file-structure.html#_escape_sequences

[johnwood]

Thank you Dan - that worked perfectly - I will update the support ticket too so there is a reference over there should this come up again.