How to connect with GLPI API?

Hi

I come to seek your help.
I configured my logstash to retrieve data from my "alert2" index.
it works. My goal is that when an event from this index arrives with the name "root-connection", it will create a ticket in glpi.

except that I still have the same problem with a return: missing session_token.

Here's where I am :

input {
  beats {
    port => "5044"
  }
  elasticsearch {
    hosts => ["http://x.x.x.x:9200"]
    user => "myusername"
    password => "mypassword"
    index => "alert2"
  }
}

filter {
  if [fields][source] == "client" or [fields][source] == "server" {
    grok {
      match => { 
        "message" => "%{TIMESTAMP_ISO8601:date} %{HOUR:heure}:%{MINUTE:mn}:%{SECOND:secondes} %{USERNAME:username} %{DATA:reseau_source} %{IP:ip_destination} %{GREEDYDATA:message}" 
      }
    }
  }

  if [_index] == "alert2" {
    # Initialisation de la session
    http {
      url => "http://x.x.x.x:80/apirest.php/initSession"
      verb => "POST"
      headers => {
        "Content-Type" => "application/json"
        "app-token" => "GLPIAPPTOKEN"
      }
      target_body => '{"login": "userlogin", "password": "userpassword"}'
    }

    # Extraction du session_token
    json {
      source => "message"
      target => "session_response"
    }

    # Ajout du session_token aux événements
    mutate {
      add_field => { "session-token" => "%{[session_response][session_token]}" }
    }
  }
}

output {
  if [fields][source] == "client" {
    elasticsearch {
      hosts => ["http://x.x.x.x:9200"]
      user => "username"
      password => "password"
      index => "client-logs-%{+YYYY.MM.dd}"
    }
  } else if [fields][source] == "server" {
    elasticsearch {
      hosts => ["http://x.x.x.x:9200"]
      user => "username"
      password => "password"
      index => "server-logs-%{+YYYY.MM.dd}"
    }
  }

  if [name] == "root_connection" {
    # Création du ticket
    http {
      url => "http://x.x.x.x:80/apirest.php/Ticket"
      http_method => "post"
      format => "json"
      headers => {
        "Content-Type" => "application/json"
        "session_token" => "Bearer %{session-token}"
        "app-token" => "GLPI APPTOKEN"
      }
      message => '{"name": "Alerte de sécurité détectée", "content": "sécurité compromise", "status": 1, "priority": 1, "requesters_id": 4}'
      codec => "json"
    }
  }

  stdout {
    codec => rubydebug
  }
}

Thanks
thanks for your help

1 post - 1 participant

Read full topic