Logstash Input HTTP Plugin

Elastic Stack Logstash
1

I am using logstash input plugin and capture all data post on specific port number. I would like to create custom field and during post method I want to capture data on custom field or variable. Can anyone help me for this?

2

Use the add_field option.

http {
  ...
  add_field => {
    "fieldname" => "fieldvalue"
  }
}
3

Yes I did same thing but while posting value from post method I am not
getting value on logstash server

How I can capture all data pass in HTTP plugin of logstash http

4

Okay, so you want to capture additional data from the HTTP request? That wasn't obvious. What data are you missing? Perhaps it would be easier if you gave a complete example if what you're doing, what you get, and what you'd like to get.

5

Hi
I am trying to build logstash as centralize logging and exception management system. I would like to capture application logging and exception via logstash. If any error occur in mobile application or .net application then my developer will post exception / crash report to logstash and logstash will save those data to mongodb.

So in http module I need few extra field like Application Name, Application Type, Authorized Key, Exception, Crash File. But I am not getting proper data in proper field.

input {
http {
host => "0.0.0.0"
port => 18080
add_field => [ "Authorized_key", "%{Authorized_key}" ]
add_field => [ "Application_Name", "%{Application_Name}" ]
}
}

output {
mongodb {
database => "local"
collection => "local"
uri => "mongodb://localhost:27017"
}
}

6

You have supplied your configuration, which is a good start but I asked for a complete example. What does the posted data look like?

add_field => [ "Authorized_key", "%{Authorized_key}" ]

What is this supposed to mean? From where would the Authorized_key value come? The posted data? Perhaps what you're missing is codec => json for the input.

7

Hi,

I am sorry for delay. Let me clear what I am trying to build

I am trying to build one common system, where appkey, appname and data are custom fields. If any error occur in any mobile device like android or iphone then my developer will post data to logstash server via post method and pass, appkey, appname and data parameters with real data.

Logstash will get all these data and add into mongodb.

Based on appkey and appname my log analysis team can identify this log is for which application, at what time its occur kind of things.

Same way if any error occur in website then my developer will post all these data to logstash server so we can analyze all those logs.

I hope now my requirement is clear.

8

Okay, good background info but what are the clients posting to Logstash? What does an event look like today?

9

From various sources like mobile devices, webservers, developer machines all will post data to logstash server via http post method. for each http post method, 3 fields are critical (appkey, appname and data). Data variable contains debug error message of app or web. appkey and appname refer to this log entry is for which app or key.

10

Sorry, I give up. I don't know how to express myself in a way so that you give me the information I need to help you.