See om_http request | Log collection solutions

#1 pbaer 5 years ago

I am trying to set up an om_http output. I get the response of ERROR HTTP response status is not OK: 400 Bad Request

I need to trouble shoot what message I am actually sending. Is there an easy way to see what message is sent?

This is my in/out config. <Extension _syslog> Module xm_syslog </Extension> <Extension _json> Module xm_json </Extension> <Input in> Module im_file File '<scrubbed>/data.json' Exec $message = to_json(); </Input> <Output out> Module om_http URL <scrubbed> HTTPSCAFile <scrubbed> HTTPSCertFile <scrubbed> HTTPSCertKeyFile <scrubbed> ContentType application/vnd.kafka.v1+json </Output> <Route 1> Path in => out </Route>

Permalink

#2 Zhengshi Nxlog ✓ 5 years ago

#1 pbaer

I am trying to set up an om_http output. I get the response of ERROR HTTP response status is not OK: 400 Bad Request I need to trouble shoot what message I am actually sending. Is there an easy way to see what message is sent? This is my in/out config. <Extension _syslog> Module xm_syslog </Extension> <Extension _json> Module xm_json </Extension> <Input in> Module im_file File '<scrubbed>/data.json' Exec $message = to_json(); </Input> <Output out> Module om_http URL <scrubbed> HTTPSCAFile <scrubbed> HTTPSCertFile <scrubbed> HTTPSCertKeyFile <scrubbed> ContentType application/vnd.kafka.v1+json </Output> <Route 1> Path in => out </Route>

Using Exec log_info($raw_event); will show you the Events before they have http headers attached.
If you want to see what the HTTP packets look like, you can run tcpdump on plain http traffic or ssldump. (wireshark and importing certificates can work too)