Run http_poller only once and terminate logstash

Elastic Stack Logstash
1

I have an API call to JIRA which should run only once every 4 weeks. I'm using logstash http_poller to fetch the data from JIRA.

The schedule with http_poller does not allow a complex cron schedule so I was planning on setting up an external cron. For this, I need the http_poller to run only once which works with using schedule as {"in" => "0"} but logstash is not terminated after the run.

Is there a way to terminate logstash after http_poller runs once. Or is there an alternative input plugin to fetch API data?

2

Use a stdin input, which will tell logstash to exit when it hits end-of-file. Then run logstash using

echo One line | /usr/share/logstash/bin/logstash ...

Use an http filter to make the API call.

3

Thanks a lot @Badger! I've tried to implement this solution and I'm getting the below error.

error during HTTP request {:url=>"URL_with_query_params", :code=>415, :response=>""}

The call that I'm making is a GET call to JIRA REST API and here's the configuration I'm using. The URL does have query parameters and I've tried to use query property to define the parameters as key-value pairs but no luck.

input {
	stdin {}
}

filter {
	http {
		url => "URL_with_query_params"
		verb => "GET"
		user => "username"
		password => "password"
		truststore => "path_to_certificate"
		truststore_password => "truststore_password"
	}
}

output {
  stdout { codec => rubydebug }
}

Can you please review and let me know why this is not working?

4

A 415 response code would typically indicate an incorrect Content-Type header. You can set the header using the "headers" option...

http {
    headers => { "Content-Type" => "text/plain" }
    ...

text/plain is just an example. I do not know what the JIRA API expects.

5

Thanks a lot for the help @Badger! I was able to successfully implement this. JIRA API was expecting Content-Type as "application/json".

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.