Response.code:401

Elastic Stack Logstash
1

Hi,
I am trying to get to the endpoints but getting an error response.code:401. Could anyone explain me how to fix this?

3

It looks like httpbeat is having trouble authenticating when it makes the GET http://localhost:8080/api/dashboard/staging-space request every 10 seconds.

Without running httpbeat at all, could you try using your browser in private browsing mode to make a GET request to http://localhost:8080/api/dashboard/staging-space? Do you get prompted for authentication? Is it a basic auth prompt?

5

Yeah, that's what I meant. Thanks.

In the screenshot it says "session has expired". Could you make the same request using curl -v http://localhost:8080/api/dashboards/staging-space from the command line and paste the complete output here?

7

I have change my httpbeat.yml like the following

8

also tried with http_poller but the result is the same response.code: 401

input {
  http_poller {
    urls => {
      test2 => {
        url => "http://localhost:8080/api/dash/backup"
        method => "get"
        headers => {
          Accept => "application/json"
        }
        auth => {
          user => "admin"
          password => "pass"
        }
     }
    }
    request_timeout => 60
    # Supports "cron", "every", "at" and "in" schedules by rufus scheduler
    schedule => { cron => "* * * * * UTC"}
    codec => "json"
    # A hash of request metadata info (timing, response headers, etc.) will be sent here
    metadata_target => "http_poller_metadata"
  }
}

output {
  stdout {
    codec => rubydebug
  }
}
9

Sorry, the URL in my curl request was bad. Here is the correct curl request to make:

curl -v http://localhost:8080/api/dashboard/staging-space

I changed it because i know that firstly i need to login and after that check another endpoints. Does any agent that makes a request to APIs to use cookies?

I see. Given this, I would suggest trying the following:

  1. Open your browser's developer tools so you can inspect HTTP requests and responses, specifically their headers.
  2. Login as you usually do via the browser.
  3. Inspect the login response headers, and look for the Set-Cookie header. Copy it's value.
  4. Edit your httpbeat.yml and under the headers section, add a line: Cookie: <value from previous step>
  5. Try to use httpbeat now.

Similarly, if you used the Logstash http_poller input instead, it has a headers setting as well. You can see it in this example here: Http_poller input plugin | Logstash Reference [8.11] | Elastic.

10

ok, here is the output, sorry for late answer

curl -v http://localhost:8080/api/dash/space
* About to connect() to localhost port 8080 (#0)
*   Trying ::1...
* Connected to localhost (::1) port 8080 (#0)
> GET /api/dashboard/staging-space HTTP/1.1
> User-Agent: curl/7.29.0
> Host: localhost:8080
> Accept: */*
> 
< HTTP/1.1 401 Unauthorized
< Server: Payara Micro #badassfish
< Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE, OPTIONS
< Access-Control-Allow-Credentials: true
< Access-Control-Allow-Headers: accept, origin, content-type, cookie, x-requested-with, x-http-method-override, authorization, If-Modified-Since, 
< Content-Type: application/json;charset=UTF-8
< Date: Thu, 26 Jul 2018 06:07:47 GMT
< Content-Length: 63
< X-Frame-Options: SAMEORIGIN
< 
* Connection #0 to host localhost left intact
{"errorCode":"SESSION_EXPIRED","message":"Session has expired"}
13

Open your browser's developer tools so you can inspect HTTP requests and responses, specifically their headers.
Login as you usually do via the browser.
Inspect the login response headers, and look for the Set-Cookie header. Copy it's value.
Edit your httpbeat.yml and under the headers section, add a line: Cookie:
Try to use httpbeat now.

OK, I've made it but with http_poller and it is working
My logstash.conf is the following now

input {
  http_poller {
    urls => {
      test2 => {
        url => "http://localhost:8080/api/dash/space"
        method => "get"
        headers => {
          Accept => "application/json"
          Cookie => "JSESSIONID=5fad76f01bbed6f502dd68095e18"
        }
     }
    }
    request_timeout => 60
    # Supports "cron", "every", "at" and "in" schedules by rufus scheduler
    schedule => { cron => "* * * * * UTC"}
    codec => "json"
    # A hash of request metadata info (timing, response headers, etc.) will be sent here
    metadata_target => "http_poller_metadata"
  }
}
output {
  stdout {
    codec => rubydebug
  }
}

And now question how to renew the Cookie for example every 5 minutes automatically? For example if will make like this

input {
  http_poller {
    urls => {
      test1 => {
        url => "http://localhost:8080/api/session/login"
        method => "post"
        headers => {
          Accept => "application/json"
        
        }

      test2 => {
        url => "http://localhost:8080/api/dashboard/staging-space"
        method => "get"
        headers => {
          Accept => "application/json"
          Cookie => "JSESSIONID=5fad76f01bbed6f502dd68095e18"
        }
     }
    }

and test2 will automatically take cookie from session/login
My login is used a JSON file with such input

{
    "login": "{{ adminLogin  }}",
    "password": "{{ adminPass  }}"
}
14

Hmm, I'm not sure how to accomplish the scenario you described (re-authenticate periodically to fetch a new cookie and then use that in you second request). I'm going to move this post to the Logstash forum to see if anyone might have an idea there.

16

Could you please tell me also how to make a POST request with JSON ?

17

Yes, it is exactly what I want. Or maybe there is another way how to do that ?

18

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.