This is an example of how we can reference a value provided by Discover Type HTTP Request in the REST API Collector which will correctly save a bearer token value which will expire (default time 5 minutes) using a named Token attribute: token, Authorization header `Bearer $(token)` and Authentication expression `Bearer $(token)`

The initial authorization request:

curl -X POST 'http://localhost:9000/api/v1/auth/login' -H "Content-Type: application/json" -d '{ "username": "admin", "password": "<password value here>" }'

Run a Discover request to generate a bearer token:

The above request will return a value something like: 

{"token":"abcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKENabcdefgUNIQUEPASSWORDTOKEN","forcePasswordChange":false}

The Collect layer will use the information pulled during discover to pull the following: 

The Encode operation is not necessary but provided for illustration purposes.

‘items’ is specified under Discover field data, under Discover.

{

  "count": 23,

  "items": p

    {

      "id": "access.log",

      "path": "/opt/cribl/log/access.log",

      "size": 1208766

    },

    ... (21 more items...)

    {

      "id": "worker/7/metrics.log",

      "path": "/opt/cribl/log/worker/7/metrics.log",

      "size": 4124739

    }

  ]

}

Event Breaker Configuration: