Jump to content
Welcome to our new Citrix community!

HTTP-ECV with JSON reply and pattern not found

Tijmen Schoemaker

Recommended Posts

Hey guys, 


I want to check the status of a graylog (syslog cluster) input, and i can talk to the API for that.

If i create a HTTP-ECV with custom header for basic authentication and do the API requiest without a response filled, the monitor is UP.

The response is JSON and looks like this:

{"id":"5d0a1d7asdf238a7e4ab4f","state":"RUNNING","started_at":"2020-11-13T07:06:35.145Z","detailed_message":null,"message_input":{"title":"INPUT_UDP30000","global":true,"name":"Syslog UDP","content_pack":null,"created_at":"2020-08-12T06:43:20.828Z","type":"org.graylog2.inputs.syslog.udp.SyslogUDPInput","creator_user_id":"admin","attributes":{"expand_structured_data":false,"recv_buffer_size":1048576,"port":30000,"number_worker_threads":4,"override_source":null,"force_rdns":false,"allow_override_date":true,"bind_address":"","store_full_message":true},"static_fields":{},"node":null,"id":"5d0a1d7b8asdf24t7e4ab4f"}}

So i figured, the ECV would look into the first 24k of the response, so the word RUNNING would be fine, since that is the state of the input.

But as soon as i put in RUNNING in response field, it says the pattern is not found. Am i doing something wrong here? Or am i missing something?



Have also tried with belowe reseponse but same result, pattern not found



Switched to TCP-ECV, apparently that works? So why doesnt HTTP-ECV read the JSON response, but TCP-ECV does?

Link to comment
Share on other sites

  • 1 year later...

There is no solution for this. It could potentially come from Citrix product development team.


Let's have a closer look at the problem. Why does it not work? HTML-ECV monitors only work with MIME types of text/... JSON, however, is application/json. That's why it won't work.


There is no way to solve the problem. There is a work around: Changing the MIME type would, of course, break the application. So I have to create a dummy lb-vServer for each real server. I have to pint services there. Next, I have to create a response-side rewrite policy to rewrite the MIME type to text/html.
Now I can add a lb-monitor pointing to these vServers (instead of the real servers). These monitors now will see MIME type text/html and HTML-ECV monitors will work with text/html.

I hope, that helps. I know, it's no solution, it is just a dirty work-around. The solution should come from Citrix product development.


Johannes Norz




Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...