Use variables (possibly set by Ruby) in Input

Hello all,

So I'm using the http_poller plugin to poll events off one of our SaaS subscriptions.
The problem is that I need to specify the "From Date" and "To Date" statically.
My question is how can I generate a variable for those dates, for example $fromDate=now()-5Minutes and $toDate=now() , then use them in the request?

I know I can use Ruby code plugin in the filter section, but how to do so in the Input section and how to set the output of the code to a variable?

Currently, my input is something like this:

input {
http_poller{
urls => {
fusion => {
method => post
url => "https://example.somecloud.com/api/audittrail/getaudithistory"
verify_cert => false
headers => {
"Content-Type" => "application/json"
}
auth => {
user => "user"
password => "password"
}
body => '{ "fromDate": "2018-09-1 17:06:40","toDate": "2018-09-2 17:06:50"}'
}
}
schedule => { every => "30s" }
codec => "json"
}

}

If variables are available, the "body" would look like this:

body => '{ "fromDate": $nowMinusFiveMinutes,"toDate": $now}'

Any help would be much appreciated!

You cannot do it using a ruby filter. You might be able to do it by setting environment variables externally to logstash, but those would not change with time whilst logstash runs.

I see.
So how others are tackling this problem? As most REST calls includes some sort of date filtering parameters.

Use a generator input to trigger dummy events, then use an http filter to make the REST call.

Oh, that is a pickle!
I will try it as a last resort, thanks!

@magnusbaeck Any ideas?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.