# Logstash HTTP POST : Filter or Output (which would be better) also not wait for response?

**URL:** https://discuss.elastic.co/t/logstash-http-post-filter-or-output-which-would-be-better-also-not-wait-for-response/213776
**Category:** Logstash
**Created:** [January 4, 2020, 3:48pm UTC](https://discuss.elastic.co/t/logstash-http-post-filter-or-output-which-would-be-better-also-not-wait-for-response/213776 "2020-01-04T15:48:35Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![stcdarrell](https://avatars.discourse-cdn.com/v4/letter/s/a183cd/32.png) [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)
#### Post date: [January 4, 2020, 3:48pm UTC](https://discuss.elastic.co/t/logstash-http-post-filter-or-output-which-would-be-better-also-not-wait-for-response/213776/1 "2020-01-04T15:48:35Z")

</div>

hi,  
i'm working on an interesting project. I have a honeypot (tpot19 [https://github.com/dtag-dev-sec/tpotce](https://github.com/dtag-dev-sec/tpotce)) that gathers threat intelligence info. Its back end is ELK. i need to send this info to another platform that uses a REST API.

I can send it either in a filter { HTTP {blah blah blah} } or an Output { HTTP{blah blah blah}}

i've got it working with the filter http.. but its VERY slow.. ridiculously slow.. i think its waiting on a response from the REST API. i dont need it to respond or wait for a response.. i've looked through the docs and i dont see anything to tell it not to wait for response.

as for the output {HTTP{}}, the format configuration options seem completely different than the filter version of HTTP. same question.. would this be a better choice? is there an option to tell it not to wait on a response from the other server? i dont see anything in the documentation.

Here is the filter version of the HTTP Post, this works but is VERY slow...

```
filter {
        http {
                url => "http://192.168.4.9:5000/indicators/"

                body => { # hash (optional, available for method => "get" and "post$
                        "indicator" => "%{[src_ip]}"
                        "group" => "everyone"
                        "provider" => "HoneyPot"
                        "confidence" => "4"
                        "tlp" => "green"
                        }
                verb => POST
                body_format => json
                headers => {
                        "Authorization" => "03ae4a2de8e5a017d41d213e1dbb446583c88db9fXXXXX"
                        "accept" => "application/json"
                } #end headers
                automatic_retries => 4
                target_headers => "[threat][headers]"
                target_body => "[threat][body]"
        } # end http
}#end filter 

```

Would using the Output {http}} be better/faster?

Here is the curl command i need to send through logstash:  
curl -i -k   
-H "Content-Type: application/json"   
-XPOST -H "Authorization: 41458f0fb710d29af79088eXXXXXX"   
'[http://localhost:5000/indicators/](http://localhost:5000/indicators/)'   
-d '{"indicator":"[badbadplace.com](http://badbadplace.com)", "group": "everyone", "provider": "Honeypot", "confidence":"4", "tlp":"green"}'

i dont understand if i need to using "mapping" or "body"

any suggestions would be appreciated  
Darrell

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 1, 2020, 3:48pm UTC](https://discuss.elastic.co/t/logstash-http-post-filter-or-output-which-would-be-better-also-not-wait-for-response/213776/2 "2020-02-01T15:48:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.