# Monitor the state - JSON data - body mismatch

**URL:** <https://discuss.elastic.co/t/monitor-the-state-json-data-body-mismatch/156916>\
**Category:** Beats\
**Tags:** heartbeat\
**Created:** [November 15, 2018, 5:33pm UTC](https://discuss.elastic.co/t/monitor-the-state-json-data-body-mismatch/156916 "2018-11-15T17:33:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shiv94](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@shiv94](https://discuss.elastic.co/u/shiv94)\
**Post date:** [November 15, 2018, 5:33pm UTC](https://discuss.elastic.co/t/monitor-the-state-json-data-body-mismatch/156916/1 "2018-11-15T17:33:14Z")

</div>

heartbeat.yml

heartbeat.monitors:

- type: http  
urls: ["[https://x.x.x.x](https://x.x.x.x):xxx/x/x/x"]  
ssl.verification\_mode: none  
check.request:  
method: GET  
headers:  
'x-auth-token': 'xxxxx'  
check.response:  
status: 200  
body: '{"state": "copy"}'  
schedule: '@every 10s'

When I use the following curl cmd I get the json response  
curl -k --request GET --url [https://x.x.x.x](https://x.x.x.x):xxx/x/x/x --header 'x-auth-token: xxxx'

Json response

{  
"server": {  
"status": "ok",  
"code": "",  
"message": "Operation done successfully."  
},  
"counts": {  
"data\_counts": 21,  
"total\_counts": 21  
},  
"data": {  
"xxx": [  
{  
"sourcevolume": {  
"id": "xxx",  
"link": {  
"rel": "self",  
"href": "[https://x.x.x.x](https://x.x.x.x):xxx/x/x/x"  
}  
},  
"targetvolume": {  
"id": "xxx",  
"link": {}  
},  
"targetsystem": {  
"id": "xxx",  
"link": {}  
},  
"type": "globalcopy",  
"state": "copy"  
},  
]  
}  
}

I get body mismatch error, how do I use the json data 'state' in body?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [November 16, 2018, 4:24pm UTC](https://discuss.elastic.co/t/monitor-the-state-json-data-body-mismatch/156916/2 "2018-11-16T16:24:42Z")

</div>

Hi @shiv94,

The check you are trying to do looks for the string in plain text, so it is looking literally for `{"state": "copy"}`, what is not present as is in the response body.  
This would probably work if you remove the curly brackets:

```auto
check.response:
  status: 200
    body: 
      - '"state": "copy"'

```

Notice also that the `body` field needs to be defined as a list that contains a list of expressions.

Starting on heartbeat 6.6.0 (see [#8667](https://github.com/elastic/beats/pull/8667)) it will be also possible to use specific [JSON checks](https://www.elastic.co/guide/en/beats/heartbeat/master/configuration-heartbeat-options.html#monitor-http-check). Though your case would need quite complex conditions (not sure if even possible) as this `state` field is inside a list and an object of unknown name.

But you will be able to check for example the server status with:

```auto
  check.response:
    status: 200
    json:
      - description: 'check server status' 
        condition:
          equals:
            status: ok

```

[Heartbeat 7.0.0-alpha1 pre-release](https://www.elastic.co/downloads/beats/heartbeat#preview-release) already contains this feature in case you want to give it a try 😉

---

<div class="post-metadata">

**Author:** ![shiv94](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@shiv94](https://discuss.elastic.co/u/shiv94)\
**Post date:** [November 16, 2018, 6:22pm UTC](https://discuss.elastic.co/t/monitor-the-state-json-data-body-mismatch/156916/3 "2018-11-16T18:22:25Z")

</div>

Thanks for your response @jsoriano

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2018, 6:22pm UTC](https://discuss.elastic.co/t/monitor-the-state-json-data-body-mismatch/156916/4 "2018-12-14T18:22:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.