Logstash http poller input & filter flow not working properly

Elastic Stack Logstash
1

Hello,

Below is my requirement:

First http call with user & password will return bearer token, token expires every 30mins. So need to call the URL every 30mins for updated token.

Second: Get token from above and poll Prometheus metrics URL every min with that bearer token.

Below is my implementation:

First scenario:

#Get bearer token 
input {
     http_poller {
     urls => 
		{
         gettoken => 
		 {
 			url => "http://test.dev.com:40021/oauth/token?grant_type=client_credentials"
			user => "46ad390f-aa20a253cae3"
			password => "9a9b-c27a3a7114d7"
		}
      }
      keepalive => true
      automatic_retries => 1
      codec => json
      schedule => { cron => "*/30 * * * * UTC"}
   }   
}

#Set bearer token 
filter
{
	ruby 
	{
		code => "
		event.set('token',event.get('access_token'))
		"
	}
}

Second Scenario:

#Prometheus Metrics Poller
input 
{
	http_poller 
	{
	 urls => 
		{
		 rps => 
		 {
			url => "http://test.dev.com:11000/green/service/actuator/prometheus?tId=7667977e-6ddd-4788-8dcf-578a746b8812"
			headers => 
			{
				"Authorization" => "Bearer %{token}"
			}
		}
		}
		keepalive => true
		automatic_retries => 1
		codec => line
		schedule => { cron => "* * * * * UTC"}
		add_field => { "index" => "hc-prometheus" }
		add_field => { "hc_type" => "prometheus-metrics" }
	}
}

#Prometheus Metrics Parsing Filter
filter
{
 #some filters....
}

Able to get token from first scenario and save to "token" field. But not able to send that to 2nd HTTP poller as i am getting unauthorised response.

Pls let me know the issue? @Badger or anyone else

2

After going through other post where http_poller will get initiated before any events, changed above code as below:

#Get bearer token 
input {
     http_poller {
     urls => 
		{
         gettoken => 
		 {
 			url => "http://test.dev.com:40021/oauth/token?grant_type=client_credentials"
			user => "46ad390f-f56a-aa20a253cae3"
			password => "8e057748-c27a3a7114d7"
		}
      }
	  keepalive => true
      automatic_retries => 1
	  codec => json
      schedule => { cron => "* * * * * UTC"}
	  add_field => { "index" => "hc-prometheus" }
	  add_field => { "hc_type" => "prometheus-metrics" }
   }   
}

#Save bearer token 
filter
{
	ruby 
	{
		code => "
		event.set('token',event.get('access_token'))
		"
	}
}

filter
{	
	http {
		url => "http://test.dev.com:11000/green/service/actuator/prometheus?tId=7667977e-6ddd-578a746b8812"
		verb => "GET"
		headers => 
		{
			"Authorization" => "Bearer %{token}"
		}
		target_body => "prometheusdataset"
	}
}

finally able to get prometheusdataset filed as below:

# HELP disk_free_bytes Usable space for path\n# TYPE disk_free_bytes gauge\ndisk_free_bytes{CUST=\"green\",ENV=\"QA\",PROCESS_NAME=\"trade_singleton_1\",path=\"/test/TRADE/.\"} 1.12633286656E11\n# HELP disk_total_bytes Total space for path\n

Earlier we have added a codec=> line on http_poller which was splitting above output to different lines. But now i cannot use line codec for http filter. Pls let me know how can i split above output to multiline events.

3

Use a split filter. The documentation calls out the use case of splitting the multiline output of a command into multiple events.

1 Like
4

Split is working, Thanks. Pls let me know is there anyway we can add another HTTP section inside filter dynamically from env variable? I do not want to update logstash config file manually for every new end point addition.

5

Not that I can think of.