ruby - Logstash http_poller post giving Name may not be found 错误

Question

我正在尝试使用 http_poller 从 ElasticSearch 获取数据并将它们写入另一个 ES。在执行此操作时，ES 查询需要作为 POST 请求完成。在提供的示例中，我找不到用于发布正文的参数，它引用了 ruby​​ 的 manticore 客户端。基于此，我使用了 params 参数来发布正文。

http_poller 组件看起来像这样

input {


 http_poller {
    urls => {
      some_other_service => {
        method => "POST"
        url => "http://localhost:9200/index-2016-03-26/_search"
        params => '"query": { "filtered": { "filter": { "bool": { "must": [ { "term":  { "SERVERNAME": "SERVER1" }}, {"range": { "eventtime": { "gte": "26/Mar/2016:13:00:00" }}} ]}}} }"'
      }
    }
    # Maximum amount of time to wait for a request to complete
    request_timeout => 300
    # How far apart requests should be
    interval => 300
    # Decode the results as JSON
    codec => "json"
    # Store metadata about the request in this key
    metadata_target => "http_poller_metadata"
  }
}
output {
  stdout {
    codec => json
  }
}

当我执行这个时，Logstash 给出了一个错误， 错误:名称不能为空 {:level=>:error}

感谢任何帮助。

我的猜测是参数需要是真正的键值对，但问题是如何使用 logstash 发布查询。

我引用了此链接以获取 HTTP 客户端的可用选项 https://github.com/cheald/manticore/blob/master/lib/manticore/client.rb

Answer 1

因为我在尝试不同的选项时得到了答案，所以我想我也会分享解决方案。

将上述有效负载中的参数替换为正文。

使用 HTTP 轮询器发送帖子的正确负载是

input {


 http_poller {
    urls => {
      some_other_service => {
        method => "POST"
        url => "http://localhost:9200/index-2016-03-26/_search"
        body=> '"query": { "filtered": { "filter": { "bool": { "must": [ { "term":  { "SERVERNAME": "SERVER1" }}, {"range": { "eventtime": { "gte": "26/Mar/2016:13:00:00" }}} ]}}} }"'
      }
    }
    # Maximum amount of time to wait for a request to complete
    request_timeout => 300
    # How far apart requests should be
    interval => 300
    # Decode the results as JSON
    codec => "json"
    # Store metadata about the request in this key
    metadata_target => "http_poller_metadata"
  }
}
output {
  stdout {
    codec => json
  }
}