Logstash http_poller input body

Elastic Stack Logstash
1

I'm trying to POST to an external API that requires authorization headers and a query. Here is the configuration that I have so far and the error that I am receiving. I'm not sure if the body portion of the config is formatted correctly as far as the http_poller config is concerned. The query does work when I run it from curl or postman.

input {
  http_poller {
    urls => {
      ls => {
        method => post
        url => "https://api.lansweeper.com/api/v2/graphql"
        headers => {
         Authorization => "<auth token>"
        }

        body => '{ site(id: "<id>"){ assetResources(assetPagination: { limit: 100, page: FIRST }, fields: [ "assetBasicInfo.domain" "assetBasicInfo.name" "assetBasicInfo.userDomain" "assetBasicInfo.userName" "assetBasicInfo.firstSeen" "assetBasicInfo.fqdn" "assetBasicInfo.ipAddress" "assetBasicInfo.lastSeen" "assetBasicInfo.type" "antiviruses.name" "antiviruses.enabled" "antiviruses.upToDate" "antiviruses.lastChanged" "autoruns.command" "autoruns.commandName" "autoruns.location" "autoruns.lastChanged" "bioses.manufacturer" "bioses.releaseDate" "bioses.version" "bioses.address" "bioses.runTimeSize" "bioses.romSize" "bioses.lastChanged" "bioses.biosCharacteristics" "bioses.caption" "bioses.currentLanguage" "bioses.installableLanguage" "bioses.primaryBios" "bioses.serialNumber" ],) { total pagination {limit current next page } items }}}'}}
    schedule => { cron => "* * * * * UTC"}
    codec => "json"

    }
  }

output {
  stdout { codec => json }
  }

and I am receiving this error response from the API

[ERROR] 2022-06-23 14:59:01.057 [pool-6-thread-1] json - JSON parse error, original data now in message field {:message=>"Unrecognized token 'POST': was expecting ('true', 'false' or 'null')\n at [Source: (String)\"POST body missing, invalid Content-Type, or JSON object has no keys.\"; line: 1, column: 5]", :exception=>LogStash::Json::ParserError, :data=>"POST body missing, invalid Content-Type, or JSON object has no keys."}
{"@version":"1","message":"POST body missing, invalid Content-Type, or JSON object has no keys.","@timestamp":"2022-06-23T14:59:01.062817Z","tags":["_jsonparsefailure"]}^C[WARN ] 2022-06-23 14:59:05.796 [SIGINT handler] runner - SIGINT received. Shutting down.
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.