Send data kibana via curl post

I'm trying to send data to my Elastic Cloud instance via CURL POST, in this way:

curl -v -X POST -u XXX:XXX -H "Content-Type: application/json" " " -d' { "foo": "bar" }'

but I have "Content-Type header [multipart/form-data; boundary=--------------------------841656771037045464898756] is not supported" as response using Postman. Any idea?


Your title say send data to Kibana but to be clear to post a document to an elasticsearch cluster via curl you should POST it to the Elasticsearch endpoint not the Kibana endpoint

Which endpoint are you posting too?

If I use:

as URL, I have:

404 Not found error.
Maybe, before, I have to create the index? How can I do?

There are 2 URLS for your Elastic Cloud Deployment.

There is the Kibana endpoint
Example... Notice the .kb. in the url that is used to get to the Kibana app.

If you want to write and read documents directly to elasticsearch you need to use the elasticsearch endpoint
Notice the .es.

So now that we sorted that ... looks like you are originally using the right URL!

I tried yours and you have an extra space after ... 9243/test/_doc " <-- Right There

Since you put that in a qoutes it is trying to use that trailing space. Also I would clean up the -d part it really should be -d '{....}'

Does Not Work
curl -v -X POST -u XXX:XXX -H "Content-Type: application/json" " " -d' { "foo": "bar" }'

curl -v -X POST -u XXX:XXX -H "Content-Type: application/json" "" -d' { "foo": "bar" }'

If you are getting an error please post the entire error

curl -v -X POST -u elastic:ksjhslkdjfhlskjgfh -H "Content-Type: application/json" "" -d' { "foo": "bar" }'
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying
* Connected to ( port 9243 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: C=US; ST=California; L=Mountain View; O=Elasticsearch, Inc.; CN=*
*  start date: Mar  9 00:00:00 2021 GMT
*  expire date: Nov  9 23:59:59 2021 GMT
*  subjectAltName: host "" matched cert's "*"
*  issuer: C=US; O=DigiCert Inc; CN=DigiCert TLS RSA SHA256 2020 CA1
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Server auth using Basic with user 'elastic'
* Using Stream ID: 1 (easy handle 0x7f83c780f200)
> POST /test/_doc HTTP/2
> Host:
> Authorization: Basic ZWxhc3RslkjfghsdlfkjghsdflgkjhmTmNaOWFaNlJmbExYZ2k=
> User-Agent: curl/7.64.1
> Accept: */*
> Content-Type: application/json
> Content-Length: 17
* We are completely uploaded and fine
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
< HTTP/2 201 
< content-type: application/json; charset=UTF-8
< location: /test/_doc/3MpDdHgBPpcTMEMZu1ij
< x-cloud-request-id: fNeyQeHaTvG77mK5QxFSIg
< x-found-handling-cluster: 234lkj2134lkj2134klj1234l1kj
< x-found-handling-instance: instance-0000000074
< content-length: 171
< date: Sat, 27 Mar 2021 15:18:19 GMT
* Connection #0 to host left intact
{"_index":"test","_type":"_doc","_id":"3MpDdHgBPpcTMEMZu1ij","_version":1,"result":"created","_shards":{"total":2,"successful":2,"failed":0},"_seq_no":9,"_primary_term":7}* Closing connection 0
1 Like

There were two errors. The trailing spaces and I was using "form-data" and not "raw-data" in postman.


1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.