Use saved saved search template with http_poller

Elastic Stack Logstash
#1

Hi,

I am attempting to call a saved search with http_poller and currently cannot figure it out. Was wondering if any others have run into this issue before? My config is below:

Search Template:
PUT _search/template/ip-test

"template": {
    "query": {
        "match": {
            "type": "ip"
        }
   }

My logstash config:

input {
    http_poller {
        urls => {
            url=> {
                method => get
                url => "http://localhost:9200/_search/template"
                headers => {
                    "content-type" => "application/json",
                    "id" => "ip-test"
                }
                auth => {
                    user => "elastic"
                    password => "changeme"
                }
           }
        }
        keepalive => true
        schedule => { cron => "* * * * * UTC" }
        codec => "line"
        metadata_target => "http_poller_metadata"
    }
}
output {
stdout{ codec => rubydebug }
}
#2

In what way doesn't this work? What happens?

#3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.