Index HTTP response code using HTTP API input?

Graylog Central (peer support)
1

I configured a “JSON path from HTTP API input” (in Graylog 2.2.2+691b4b7) and can see the received messages. I am wondering if it is possible to index the HTTP response code and response time? I plan to subsequently use these to generate alerts (for bad or delayed responses).

Looking at extractors documentation it sounds like the message needs to contain the information I am looking for before I can use extractors on them. In this case, I do not see HTTP response code or response time even if the complete message in indexed (with “$” as “JSON path of data to extract”). Am I missing something?

2

Hey @strutdepot,

the response code / time is not part of the JSON-Path. The Input only uses the HTTP Response Content, checks it for a valid JSON-String and then tries to extract the value from the given JSON-Path.
If you want to get the response code / time, your server would have to write it into the JSON-String, or you would have to write your own plugin. There is a plugin that is able to get the response code and time and also is able to get the HTTP Response Content, which you can use the JSON-Extractor on.

Greetings - Phil