Need help deciding which input plugin to use

[az123]

I want to use log stash to act as a tcp client to get some data from the server. I need logstash to send a json message over to the server to request the data of interest before the server can send that data over (More like tcp session with request response kind of transactions). Does logstash have this kind of capability? If so, can someone point me to a config file example that can help me achieve this?

[Badger]

You could use an exec input that would run an external client to make the request, or you could use a generator input to create an event, and then use a ruby filter to make the TCP connection and send a request.

[az123]

Thanks! Let me try that.

[az123]

Hi,

Can you share some sample config file that I can use to achieve these options?

Thanks!

[Badger]

No. To do that I would need knowledge of the API you are calling.

[az123]

There is no API call here. Its a plain tcp connection request to a node on port 45670 and send a json string to that port. Thats it!

I tried both the options you mentioned like so:

#input {
#generator {

lines => [ "{ "host": "x.x.x.x", "port": 45670, "cid": "xxx", "grpc": { "ws" : 524288 }, "paths": [{ "path":, "/interfaces", "freq", 2000 }] }"

]

}

#}
#Sending the json info to the juniper node
filter {
ruby {
code => '
require "socket" # Sockets are in standard library
hostname = "x.x.x.x"
port = 45670

s = TCPSocket.open(hostname, port)

#while line = s.gets # Read lines from the socket
request = '{ "host": "x.x.x.x", "port": 45670, "cid": "elk1", "grpc": { "ws": 524288 }, "paths": [{ "path": "/interfaces", "freq": 2000 }] }'
s.puts(request)
# And print with platform line terminator
#end
#s.close # Close the socket when done
"
}
}