Saving request.url variable in filebeat httpjson

Good day! The question arose, is it possible to save the last received value of the request.url parameter and then read from it upon request?
I use httpjson as an input module with the following settings:

# ============================== Filebeat inputs ===============================


- type: httpjson
  config_version: 2
  interval: 1m
  request.method: GET
  auth.basic.enabled: true
  auth.basic.user: login
  auth.basic.password: password
    - set:
        target: url.params.updateID
        value: '[[.last_response.body.updateID]]'

In response, I receive data, from which, using request.transforms, the updateID parameter is taken from the last received data and substituted into the original request, which allows me to receive only data starting from the last updateID. Everything works correctly, as long as there is no need to restart filebeat. Data with ID 12345 is re-received and only then actual data. Is it possible to save the received updateID value from the last request somewhere and read from it in the future?

Yes using the cursor. See HTTP JSON input | Filebeat Reference [7.15] | Elastic

1 Like

Thank you, it works!
Do you know how to clear state of the cursor, to process again from the beginning?
Where it keeps it condition?