While using httpjson input in filebeat getting error Exiting: Failed to start crawler

Elastic Stack Beats
1

While using httpjson input in filebeat getting below error
Exiting: Failed to start crawler: starting input failed: error while initializing input: template: :1: bad character U+0040 '@' accessing 'filebeat.inputs.0.cursor.@nextUrl.value' (source:'filebeat.yml')

The response containts @nextUrl value which I want to set as cursor value for next call.

Below configuration fails, however it works for other fields where there is no @ sign in the filed name.

cursor:
'@nextUrl':
value: '[[.last_response.body.@nextUrl]]'

Please advise

2

Hi Any advice on above query please?

3

You need to share the input you are using, you didn't share any information about it.

Please share the entire configuration that you are using in your input and filebeat.yml.

4

Thank you for your response @leandrojmp

The Response I get from the API is

{
"data": [
{
"Key1": "Value1",
"Key2": "Value1"
},
{
"Key3": "Value3",
"Key4": "Value4"
}
],
"status": 200,
"@nextUrl": "",
"code": 0,
"message": null
}

And Filebeat.yml is as below.

filebeat.inputs:

  • type: httpjson
    interval: 1m

    request.url: ""

    request.transforms:

    • set:
      target: url.params.@nextUrl
      value: '[[.cursor.@nextUrl]]'
      default: '[[0]]'

    cursor:
    '@nextUrl':
    value: '[[.last_response.body.@nextUrl]]'

    processors:

    • decode_json_fields:
      fields: ["data"]
5

@leandrojmp : Please let me know if the input and filebeat helps and any solution for this use case.

6

I have no clue, I do not use this input, but searching on the forum I found a similar post.

It seems that the httpjson does not suport fields with @ in the name.

You may need a response from someone from Elastic or maybe open an issue in Github.