# Use API field as a variable in logstash input

**URL:** https://discuss.elastic.co/t/use-api-field-as-a-variable-in-logstash-input/133689
**Category:** Logstash
**Created:** [May 29, 2018, 1:34pm UTC](https://discuss.elastic.co/t/use-api-field-as-a-variable-in-logstash-input/133689 "2018-05-29T13:34:18Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![AurelienG](https://avatars.discourse-cdn.com/v4/letter/a/76d3ee/32.png) [@AurelienG](https://discuss.elastic.co/u/AurelienG)
#### Post date: [May 29, 2018, 1:34pm UTC](https://discuss.elastic.co/t/use-api-field-as-a-variable-in-logstash-input/133689/1 "2018-05-29T13:34:19Z")

</div>

Hello,

What I am trying to do seems quite similar to what @dorj1234 was asking help for a few months ago in [this topic](https://discuss.elastic.co/t/using-logstash-http-poller-to-loop-through-json-structure-run-2nd-poller/109121) but the answer provided is not enough for me so I hope you won't mind me opening a similar topic.

What I would like to get is information about Jenkins builds configuration. From the API, I can have some information about all builds, but if I want to know more about a specific build, I have to add its name in the URL. So my idea is to make a first API request with logstash, maybe store the builds name somewhere (file? local variable?), then use logstash again for each build.

I use exec plugin to curl the Jenkins API and then I would like to GET jenkins/job/name-of-job/config.xml. Is there any way I could do that?

Thanks for the help 🙂

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 29, 2018, 2:38pm UTC](https://discuss.elastic.co/t/use-api-field-as-a-variable-in-logstash-input/133689/2 "2018-05-29T14:38:29Z")

</div>

Well the answer is much the same. You can write a ruby filter, which would perhaps use [Net::HTTP](https://docs.ruby-lang.org/en/2.0.0/Net/HTTP.html) to do the second GET. Something like this, which uses the whole of message as a filename, and puts the response into somefield.

```auto
    ruby {
        code => '
            require "net/http"
            uri = URI( "http://127.0.0.1/geojson/" + event.get("message") )
            response = Net::HTTP.get(uri)
            event.set("somefield", response)
        '
    }

```

Error handling left as an exercise for the reader.

---

<div class="post-metadata">

### Author: ![AurelienG](https://avatars.discourse-cdn.com/v4/letter/a/76d3ee/32.png) [@AurelienG](https://discuss.elastic.co/u/AurelienG)
#### Post date: [May 30, 2018, 7:44am UTC](https://discuss.elastic.co/t/use-api-field-as-a-variable-in-logstash-input/133689/3 "2018-05-30T07:44:51Z")

</div>

Ok thanks, I'll try that! I must admit I'm not really familiar with ruby, so thank you for giving the whole syntax 🙂

Edit: I looked a little further and came across the Nokogiri gem, which seems to be better to get specific elements of the XML file. What do you think?

Edit 2: I have tried a few things but I can't fix the issue I have. The address I'm trying to get the XML file from is HTTPS and I always get this error:  
Ruby exception occurred: Non-HTTP proxy URI: proxy.\*\*\*\*\*\*\*\*.fr:\*\*\*\*

Here's my ruby filter:

```auto
ruby {
    code => '
      require "nokogiri"
      require "open-uri"
      config = URI.parse(event.get("[jobs][url]") + "config.xml").read
      jdk_version = config.xpath("//jdk")
      event.set("jdk_version", jdk_version)
    '
  }

```

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 30, 2018, 12:39pm UTC](https://discuss.elastic.co/t/use-api-field-as-a-variable-in-logstash-input/133689/4 "2018-05-30T12:39:58Z")

</div>

Logstash has an [xml](https://www.elastic.co/guide/en/logstash/current/plugins-filters-xml.html) filter, which is a wrapper around nokogiri.

---

<div class="post-metadata">

### Author: ![AurelienG](https://avatars.discourse-cdn.com/v4/letter/a/76d3ee/32.png) [@AurelienG](https://discuss.elastic.co/u/AurelienG)
#### Post date: [May 30, 2018, 1:20pm UTC](https://discuss.elastic.co/t/use-api-field-as-a-variable-in-logstash-input/133689/5 "2018-05-30T13:20:36Z")

</div>

I guess I shouldn't have tried to do everything within the Ruby filter...  
I used your code to get all the XML in a field and now I just have to use the XML filter to keep what I need.

I think I should be able to do it by myself now, thanks a lot!

Edit: It's working perfectly, thanks again 😉

---

<div class="post-metadata">

### Author: ![AurelienG](https://avatars.discourse-cdn.com/v4/letter/a/76d3ee/32.png) [@AurelienG](https://discuss.elastic.co/u/AurelienG)
#### Post date: [June 1, 2018, 9:10am UTC](https://discuss.elastic.co/t/use-api-field-as-a-variable-in-logstash-input/133689/6 "2018-06-01T09:10:14Z")

</div>

Actually, I still have a problem...  
I need to authenticate to access the config.xml file but I can't figure out how to do it with the https request. I have seen lots of "solutions" but only for http requests. Obviously, I don't want to use username and password, but rather the private token. I have tried to put it in the header but can't make it work.  
Any idea for this?

Here's my code:

```auto
	ruby {
		# Get the config.xml for each job
		code => '
			require "net/https"
			url = event.get("[jobs][url]") + "config.xml"
			uri = URI(url)

			Net::HTTP.start(uri.host, uri.port, :use_ssl => true) do |http|
				request = Net::HTTP::Get.new(uri)
				request["authorization"] = "Token token=abc123"
				response = http.request(request)
				event.set("config", response.body)
			end
		'
	}

```

I used the other syntax for HTTPS from the NET::HTTP class because it seemed to handle the header, but it still doesn't work.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 29, 2018, 9:10am UTC](https://discuss.elastic.co/t/use-api-field-as-a-variable-in-logstash-input/133689/7 "2018-06-29T09:10:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
