REST endpoint as Output

Is there a way to use a REST endpoint as a Cribl output? The specific use case is LogicMonitor’s /rest/log/ingest

1 UpGoat

Yes. See WebHook

1 UpGoat

Thanks, didn’t think to look there. However there doesn’t seem to be a way to send along computed values as additional headers. The thing about the logicmonitor api is that authentication is done by computing an authorization header based on a sha256 hash of the timestamp, rest endpoint uri and the actual payload.

With the REST source I can add an authorization header with a calculated value, like this:

'LMv1 ' + C.vars.lm_access_id + ':' + C.Encode.base64(C.Crypto.createHmac('GET' + (new Date()).getTime().toString().slice(0, -3) + "000" + '/service/groups', C.vars.lm_access_key, 'sha256')) + ':' + (new Date()).getTime().toString().slice(0, -3) + "000"

In the Webhook destination it does not seem to be possible to add a computed authorization header, but simply a static name/value pairs.

2 UpGoats

I don’t have a solution for you on this topic, except to say I will file an enhancement request. If you could send me any more details you have that would help. Also the company involved will help give it more weight. (You can DM that to me in the Cribl Slack if you’d like.)

2 UpGoats