Using http output plugin for multi-form rest api call and attaching message as a file

Hi guys,
first time poster.

I've started using logstash to collect event data. The requirement I have is to send this information as a file attachment using a rest api.

Now, I'd rather not go to the "expense" of having to write an actual file so I was going to wrap it in a "fake" file resource in someway. I'm assuming a custom ruby plug-in could/should be used for that and that you'd call that in the filter portion of logstash.

Next I want to send the file using the http output plugin. I'm able to send info to the rest api using another api call that just streams the data but I've no idea how to do this in logstash.

Equally I'm wondering if this is just a total "abuse" of what I should be doing and maybe I'm going about this the wrong way?

The api is a third party api so unfortunately can't be changed.

Thanks,
SKing

REST has no "attachment" concept so I'm not sure what you're trying to do. Do you want to make a POST request with a Logstash event (or parts of it) as the request body?

Hi Magnus, thanks for the reply.

With regard to sending in an attachment with request maybe I'm using the wrong terminology. Apologies!

So, what I'm doing (or trying to do) is creating a post request.
One of the headers is "Content-Type"->"multipart/form-data"

So maybe I should be describing it as a multi-part request?

The body of my request contains two Name-Value pairs of data
and then a third which consists of data in a file.

Sorry if I'm not explaining this very well! I can get it working using java and the RequestEntity functionality. But now I'm trying to do this just posting json directly and am struggling a bit.

Hi Magnus,
I found posts on the same problem I'm having


Thsi might help clarify what I'm looking for.

From reading through the replies, it seems to be saying that unless you use an (expensive) decoding method, it has to be a two stage process.
Send file in -> get associated id
Send rest of information in with associated id.

SKing