Problem using OAUTH API connecting to Elastic Logstash http_poller plugin to get oauth token

[Bill.Youngman]

Good Morning,

I am using the http_poller logstash input filter to connect to the AppDynamics OAUTH API that I will then use to pass to the http filter plugin to retrieve AppDynamics REST API metric data to insert into Elasticsearch.

My logstash http_poller configuration is:

```
input {
http_poller {
urls => {
AppDynamics => {
method => post
url => "https://*appdynamics-test-account*/controller/api/oauth/access_token"
headers => {
"Accept" => "application/json"
"Content-Type" => "application/vnd.appd.cntrl+protobuf;v=1"
"Authorizations" => "*AppDynamics bearer token*"
"grant_type" => "client_credentials"
"client_id" => "Stage-CurlTest"
"client_secret" => "*AppDynamics Client Secret*"
}
}
}
request_timeout => 60
schedule => { every => "1h"}
codec => "json"
metadata_target => "appd-token"
type => "AppDynamics"
}
}
}
```

I am getting the following error response when the poller tries to connect to AppDynamics

```
{
"type": "AppDynamics",
"@timestamp": "2021-10-18T14:02:11.191Z",
"appd-token": {
"request": {
"method": "post",
"url": "https://*appdynamics-test-account*/controller/api/oauth/access_token",
"headers": {
"Authorizations": "AppDynamics Bearer Token",
"grant_type": "client_credentials",
"client_secret": "`AppDynamics Client Secret`",
"client_id": "Stage-CurlTest",
"Content-Type": "application/vnd.appd.cntrl+protobuf;v=1",
"Accept": "application/json"
}
},
"response_headers": {
"x-content-type-options": "nosniff",
"x-frame-options": "SAMEORIGIN",
"x-xss-protection": "1; mode=block",
"connection": "keep-alive",
"server": "AppDynamics",
"date": "Mon, 18 Oct 2021 14:02:10 GMT"
},
"runtime_seconds": 0.36,
"host": "SAPPLOG03",
"name": "AppDynamics",
"response_message": "Not Acceptable",
"code": 406,
"times_retried": 0
},
"@version": "1",
"tags": [
"_httprequestfailure"
]
}
```

New to both the http_poller filter and the AppDynamics Metric REST API so not sure what I have configured wrong. I have also posted to the Elastic Community forum.

I have removed any account-specific information for security reasons so any additional information that would be helpful let me know and I'll get it for this post.

Thanks,
Bill

[Ryan.Paredez]

Hi @Haluk Yaşar.Erol,

It's preferable to ask questions in the public space of the community. As for the questions you have, others most likely will have too. If an answer is found, it then is able to help many other community members. 

Note: I understand some questions may involve sensitive information, if that is the case, redact that information before publishing your post. 

[Anu.Mungara]

I have followed the same steps. Some how I am able to index only Oauth api response instead of Api response. Could you please send me full config file

[Hiroki.Ito]

Hello @Anu.Mungara ,

Thank you for the post in the community.

Below is the logstash.conf file I used.

I have changed the value for controller url, API client name, account name, client secret and application id.

input {
  http_poller {
    urls => {
        AppD => {
            method => post
            url => "https://<contorller_url>/controller/api/oauth/access_token"
            body => "grant_type=client_credentials&client_id=<client_name>@<account_name>&client_secret=<client_secret>"
            headers => {
                "Content-Type" => "application/vnd.appd.cntrl+protobuf;v=1"
            }
        }
    }
    request_timeout => 60
    schedule => { every => "1m"}
    codec => "json"
  }
}

filter{
  http {
    url => "https://<contorller_url>/controller/rest/applications/<application_id>/metric-data?metric-path=Business%20Transaction%20Performance%7CBusiness%20Transactions%7CJava_Tier%7C/logger%7CAverage%20Response%20Time%20%28ms%29&time-range-type=BEFORE_NOW&output=JSON&duration-in-mins=480"
    verb => "GET"
    headers => [ "Authorization", "Bearer %{access_token}" ] 
  }
}

output {
  elasticsearch {
    hosts    => [ 'elasticsearch' ]
    user     => 'elastic'
    password => 'changeme'
  }
}

Please make sure the API URL in filter.http part is the correct URL for a REST API.

You can use a curl command to confirm if the URL endpoint returns a response by following the steps in the document below.

https://docs.appdynamics.com/appd/23.x/latest/en/extend-appdynamics/appdynamics-apis/api-clients#id-...

e.g. in the above config file

curl -H "Authorization:Bearer <access_token>" "https://<contorller_url>/controller/rest/applications/<application_id>/metric-data?metric-path=Business%20Transaction%20Performance%7CBusiness%20Transactions%7CJava_Tier%7C/logger%7CAverage%20Response%20Time%20%28ms%29&time-range-type=BEFORE_NOW&output=JSON&duration-in-mins=480"

Best regards,

Hiroki