Exploding http_poller json line

[Callahan]

Hi,

So a provider has updated their REST API and changed the way the JSON is displayed/returned. The newer version now returns a line beginning with:

{"tickets":[{"cc_emails":[],"fwd_emails":[],

This means all the data is contained within a subset called "tickets" so I only ever get one entry in my index called tickets whereas the previous version would return a line structured as follows:

[{"account_id":145344,"category":null,"cc_email":{"cc_emails":[],

This obviously allowed each entry to be allocated a new line which was properly processed by Logstash. I'm working with the provider to possibly change the way they deliver the JSON response but to cover off any possibility of me being able to fix it at my end, does anyone know if it's possible for the http_poller to expand the first line into it's component parts?

My config:

input {
  http_poller {
    type => "helpdesk"
	urls => {
      "all_tickets" => {
        method => GET
		url => "https://website.com/api/v2/tickets"
        headers => {
        Accept => "application/json"
        }
		auth => {
		user => "my_username"
        password => "my_password"
     }
    }
    }
	connect_timeout => 15
	automatic_retries => 5
	request_timeout => 60
	socket_timeout => 60
	schedule => { "every" => "10m"}
    codec => "json"
	metadata_target => "http_poller_metadata"
   }
}

Thanks for your help.