Possible to pass variables in URL

[sirmodok]

The run down is that my API call looks something like this https://thisismysite/api/ipaddress/10.1.1.8

The IP address on the end is subject to change depending on the event. All of the information is passed via the URL and not necessarily passed via the header or a parameter. I tried simply using "url => https://thisismysite/api/ipaddress/%{source_ip}" but logstash did not like that.

Is this not a functionality that's built into logstash-filter-rest or am I misunderstanding something?

[gandalfb]

Please provide debug log.

I am using this like you except by using a parameter.

[sirmodok]

With my config file like this

filter { rest { request => { url => "https://bingbong/api/IPAMRecords/%{source_ip}" auth => { user => "bsamson" password => "nope" } } json => true # boolean (optional, default = true) target => "lookup" # string (mandatory, no default) } }

I get an error about a malformed escape character.

[2017-08-08T15:30:54,823][ERROR][logstash.filters.rest ] error in rest filter {:request=>[:get, "https://bingbong.com/api/IPAMRecords/%{source_ip}", {:auth=>{:user=>"bsamson", :pass=>"nope"}}], :json=>true, :code=>nil, :body=>nil, :client_error=>java.net.URISyntaxException: Malformed escape pair at index 53: https://bingbong/api/IPAMRecords/%{source_ip}}

Sorry, I apparently don't know how to format on github

[gandalfb]

Hm, are you sure you have a field %{source_ip} in your incoming event?

Please execute logstash in debug mode to have more details. (example cli commands in the README)

For code format: https://guides.github.com/features/mastering-markdown/

[sirmodok]

You were right. The issue was that some of the events coming in did not have the source_ip field, and that is what was throwing the exception. I encased my rest plugin in an if ("" in [source_ip]) { and things started working properly.