Hi
I come to seek your help.
I configured my logstash to retrieve data from my "alert2" index.
it works. My goal is that when an event from this index arrives with the name "root-connection", it will create a ticket in glpi.
except that I still have the same problem with a return: missing session_token.
Here's where I am :
input {
beats {
port => "5044"
}
elasticsearch {
hosts => ["http://x.x.x.x:9200"]
user => "myusername"
password => "mypassword"
index => "alert2"
}
}
filter {
if [fields][source] == "client" or [fields][source] == "server" {
grok {
match => {
"message" => "%{TIMESTAMP_ISO8601:date} %{HOUR:heure}:%{MINUTE:mn}:%{SECOND:secondes} %{USERNAME:username} %{DATA:reseau_source} %{IP:ip_destination} %{GREEDYDATA:message}"
}
}
}
if [_index] == "alert2" {
# Initialisation de la session
http {
url => "http://x.x.x.x:80/apirest.php/initSession"
verb => "POST"
headers => {
"Content-Type" => "application/json"
"app-token" => "GLPIAPPTOKEN"
}
target_body => '{"login": "userlogin", "password": "userpassword"}'
}
# Extraction du session_token
json {
source => "message"
target => "session_response"
}
# Ajout du session_token aux événements
mutate {
add_field => { "session-token" => "%{[session_response][session_token]}" }
}
}
}
output {
if [fields][source] == "client" {
elasticsearch {
hosts => ["http://x.x.x.x:9200"]
user => "username"
password => "password"
index => "client-logs-%{+YYYY.MM.dd}"
}
} else if [fields][source] == "server" {
elasticsearch {
hosts => ["http://x.x.x.x:9200"]
user => "username"
password => "password"
index => "server-logs-%{+YYYY.MM.dd}"
}
}
if [name] == "root_connection" {
# Création du ticket
http {
url => "http://x.x.x.x:80/apirest.php/Ticket"
http_method => "post"
format => "json"
headers => {
"Content-Type" => "application/json"
"session_token" => "Bearer %{session-token}"
"app-token" => "GLPI APPTOKEN"
}
message => '{"name": "Alerte de sécurité détectée", "content": "sécurité compromise", "status": 1, "priority": 1, "requesters_id": 4}'
codec => "json"
}
}
stdout {
codec => rubydebug
}
}
Thanks
thanks for your help
1 post - 1 participant