Unable to add event field to http body

[dtclayton]

I would like to reference a value from an event field into the http body. It doesn't seem to be possible, but it states it is possible with headers? Is it also possible with the http body?

[ankitnfs]

Hi - any progress on this ? I am also facing this issue.

[ankitnfs]

Found a workaround, Use below in the filters to have event into a given field

ruby { code => "

Move everything to request

   event.set('request', event.to_hash)
 "
}

and then pass, body => "%{request}"

[C0rn3j]

It would be really nice if some example documentation could be added, both in the README which doesn't even link to the plugin page or call the filter the HTTP filter and the actual documentation.

# Way to set the entire body from the outside
mutate {
    add_field => { 
        "[cm][request][body]" => '{"data":{"nodeId":4,"dateFrom":"%{[datetime]}","kind":"compute"}}' 
    }
}
...
body_format => "text"
body => "%{[cm][request][body]}"

# Way to set the body from the inside while keeping some things modular
body_format => "json"
body => {
    "data" => {
        "nodeId" => 4
        "%{[cm][date_name]}" => "%{[datetime]}"
        "kind" => "compute"
        "isSuccess" => true
    }
}

There is no way to set up the body from a previously existing hash. (outside of hacks with ruby code)

# This block won't work

add_field => {
    "[cm][request][body]" => {
        "data" => {
            "nodeId" => 4
            "dateTo" => "%{[datetime]}"
            "kind" => "compute"
            "isSuccess" => true
        }
    }
}
...
body_format => "json"

# This will just set the string "[cm][request][body]"
body => "[cm][request][body]"

# This will just pass the raw Hash, not parsed JSON
body => "${[cm][request][body]}"