# Variable in Request body - Fleet

**URL:** <https://discuss.elastic.co/t/variable-in-request-body-fleet/359457>\
**Category:** Kibana\
**Tags:** fleet\
**Created:** [May 14, 2024, 12:21pm UTC](https://discuss.elastic.co/t/variable-in-request-body-fleet/359457 "2024-05-14T12:21:35Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![karnamonkster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/karnamonkster/32/67266_2.png) [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\
**Post date:** [May 14, 2024, 12:21pm UTC](https://discuss.elastic.co/t/variable-in-request-body-fleet/359457/1 "2024-05-14T12:21:35Z")

</div>

Hi,  
I am using Elastic-Agent integration using Custom API to integrate with Teamviewer API to fetch events.  
**Request URL** : [https://webapi.teamviewer.com/api/v1/EventLogging](https://webapi.teamviewer.com/api/v1/EventLogging)  
**Request HTTP Method** : POST  
**Request Body** :

```auto
{
    "StartDate":"2024-03-21T12:00:00Z",
    "EndDate":"2024-03-21T13:00:00Z",
    "EventTypes": [
         "Session"
     ],
     "Events": [
         "StartedSession",
         "EndedSession",
         "ParticipantJoinedSession",
         "ParticipantLeftSession"
    ]
}

```

Now the issue with the request body that Teamviewer API needs mandatory fields **StartDate** and **EndDate** with values as mentioned above. And I need to figure out a way to use something like " **now**" and " **now-1h**" instead.

I tried using Request Transform with no luck, as may be I am doing something silly.

```auto
- set:
    target: StartDate
    value: '[[now (parseDuration "-1h")]]'
- set:
    target: EndDate
    value: '[[now]]'

```

Since I do not have much experience on handling APIs per say, can anyone point me to right solution on how can I get this sorted ?

Complete API request

```auto
{
  "package": {
    "name": "httpjson",
    "version": "1.20.0",
    "experimental_data_stream_features": []
  },
  "name": "Teamviewer",
  "namespace": "teamviewer",
  "description": "Teamviewer Event Logs",
  "policy_id": "7b0aa080-9b5a-11ee-b7d8-4381dadb75d9",
  "vars": {},
  "inputs": {
    "generic-httpjson": {
      "enabled": true,
      "streams": {
        "httpjson.generic": {
          "enabled": true,
          "vars": {
            "data_stream.dataset": "httpjson.teamviewer",
            "request_url": "https://webapi.teamviewer.com/api/v1/EventLogging",
            "request_interval": "1h",
            "request_method": "POST",
            "username": "",
            "password": "",
            "oauth_id": "",
            "oauth_secret": "",
            "oauth_token_url": "",
            "request_body": "{\n \n \"EventTypes\": [\n \"Session\"\n],\n \"Events\": [\n \"StartedSession\",\n \"EndedSession\",\n \"ParticipantJoinedSession\",\n \"ParticipantLeftSession\"\n]\n}",
            "request_transforms": "- set:\n target: header.Authorization\n value: 'MY BEARER TOKEN'\n- set:\n target: StartDate\n value: '[[now (parseDuration \"-1h\")]]'\n- set:\n target: EndDate\n value: '[[now]]'",
            "response_transforms": "- set:\n target: body.last_requested_at\n value: '[[.cursor.last_requested_at]]'\n default: \"[[now]]\"",
            "response_split": "target: body.AuditEvents\ntype: array\nignore_empty_value: true\nkeep_parent: false\nsplit: \n target: body.AuditEvents.EventDetails\n type: array\n keep_parent: false",
            "cursor": "cursor:\n last_requested_at:\n value: '[[now]]'",
            "request_redirect_headers_ban_list": [],
            "oauth_scopes": [],
            "processors": "- decode_json_fields:\n fields: [\"message\"]\n process_array: true\n target: \"json\"\n max_depth: 3\n overwrite_keys: true\n add_error_key: true",
            "tags": [
              "teamviewer-session"
            ]
          }
        }
      }
    }
  }
}

```

EDIT: The integration works fine, if I use the static dates