Graylog API question - What is the right way to use plugins/pipelines/pipelines in the API?

[itano92 (itano)]

Hello people,

I’ve been trying to build some automation for a small project. The project is supposed to do the following for a local Graylog instance.

1. Create a stream
2. Create pipelines with the rule source in the payload.
3. Add the rule source to a main filter (main pipeline for organisation) and add a stage in.

This 3rd step is where I’m struggling. Here is the GET request.

curl -X GET -u user:password http://ip:9000/api/plugins/org.graylog.plugins.pipelineprocessor/system/pipelines/pipeline/59316e49dbde3104dc630fe6 | python -m json.tool
{
“created_at”: “2017-06-02T13:55:21.346Z”,
“description”: “testing for automation”,
“errors”: null,
“id”: “59316e49dbde3104dc630fe6”,
“modified_at”: “2017-06-05T08:48:45.483Z”,
“source”: “pipeline "auto_dev"\nstage 0 match either\nstage 3 match either\nend”,
“stages”: [
{
“match_all”: false,
“rules”: ,
“stage”: 0
},
{
“match_all”: false,
“rules”: ,
“stage”: 3
}
],
“title”: “auto_dev”
}

Here is the PUT request that fails for me, in the swagger API browser as well as from the command line. Now I suspect that it is the payload, but the payload has been syntax checked (multiple online tools including jsonlint).

curl -X PUT -u user:password http://ip:9000/api/plugins/org.graylog.plugins.pipelineprocessor/system/pipelines/pipeline/59316e49dbde3104dc630fe6 -d @/tmp/payload.json
{“type”:“ApiError”,“message”:“HTTP 415 Unsupported Media Type”}

Here is what the payload file contain.

{“title”: “auto_dev”, “description”: “testing for automation”, “created_at”: “2017-06-02T13:55:21.346Z”, “modified_at”: “2017-06-05T08:48:45.483Z”, “stages”: [{“stage”: “0” ,“match_all”: “false”,“rules”: },{“stage”: 3,“match_all”: false,“rules”: [“Send to auto_dev”]}],“errors”: null,“id”: “59316e49dbde3104dc630fe6”}

I tried the same thing with spacing and in the curl request itself, with the same error.

The content type when defined as JSON shows the following details.

{
“message”: “Can not construct instance of org.graylog.plugins.pipelineprocessor.rest.StageSource: abstract types either need to be mapped to concrete types, have custom deserializer, or contain additional type information\n at [Source: org.glassfish.jersey.message.internal.ReaderInterceptorExecutor$UnCloseableInputStream@83d4fce; line: 1, column: 165] (through reference chain: org.graylog.plugins.pipelineprocessor.rest.PipelineSource["stages"]->java.util.ArrayList[0])”,
“type”: “ApiError”
}

What am I doing wrong? Can someone give me an example of how I can add the rule in Stage 3 for this pipeline?

Any help would be appreciated. Can someone please provide documentation in this case too as all I am following is the JSON schema provided in the swagger API browser.

Cheers!