# \[Filebeat 8.6.1 - httpjson\] chain response.transform question

**URL:** https://discuss.elastic.co/t/filebeat-8-6-1-httpjson-chain-response-transform-question/326774
**Category:** Beats
**Tags:** filebeat
**Created:** [March 1, 2023, 2:47pm UTC](https://discuss.elastic.co/t/filebeat-8-6-1-httpjson-chain-response-transform-question/326774 "2023-03-01T14:47:45Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![marrc.rousseau](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@marrc.rousseau](https://discuss.elastic.co/u/marrc.rousseau)
#### Post date: [March 1, 2023, 2:47pm UTC](https://discuss.elastic.co/t/filebeat-8-6-1-httpjson-chain-response-transform-question/326774/1 "2023-03-01T14:47:45Z")

</div>

Hello,

I'm facing an issue with response.transform and after searching during hours I'm still not able to find a solution.

I try to chain some api calls to get a list of bugs per host :

```auto
Request 1: To get list of host Ids
	Url : /hosts

Response:

results: [
      {
	    id: 1, 
		name: server1
	  },
      {
	    id: 2,
		name : server2
	  }
	]

Chain :
Request 2.1 : To get bug list for host 1
	Url : /hosts/1/errata

Response:

results: [
        {
            bug: 5000
		},
        {
            bug: 5100
		}
	]
}

Request 2.2 : To get bug list for host 2
	Url : /hosts/2/errata

Response:

results": [
        {
            bug: 6000
		},
        {
            bug: 6100
		}
	]
}

Using response.split, I'm able to obtain 4 seperate documents :
message: {
            bug: 5000
		}
		
message: {
            bug: 5100
		}

message: {
            bug: 6000
		}

message: {
            bug: 6100
		}			

Final result I would like 
message: {
            name: server1,
            bug: 5000
		}
		
message: {
            name: server1,
            bug: 5100
		}

message: {
			name: server2,
			bug: 6000
		}

message: {
			name: server2,
            bug: 6100
		}	

```

I use this httjson filebeat configuration

```auto
filebeat.inputs:
- type: httpjson
  #tracer doesn't works for chain requests...useless
  #request.tracer.filename : /etc/filebeat/debug
  request.url: https://xxxx/api/hosts?per_page=2&thin=2&search=o*
  request.transforms:
    - set:
        target: header.Authorization
        value: 'Basic xxxx=='
  chain:
    - step:
        request.url: https://xxx/api/hosts/$.results[:].id/errata?type=security&severity=Important
        request.method: GET
        replace: $.results[:].id
        request.transforms:
          - set:
              target: header.Authorization
              value: 'Basic xxx=='

        response.split:
          target: body.results
          type: array
          transforms:
            - set:
                target: body.name
# value: static_value -> OK
# value: $.results[:].name -> NOK
# value: '[[.first_response.body.results[:].name]]' -> NOK
# value: '[[.first_response.body.results[0].name]]' -> NOK
# value: '[[.first_response.body.results.name]]' -> NOK

```

I don't find what should I use in value of response.split.transforms to obtain name from first response body .

Any idea ?

Thanks

---

<div class="post-metadata">

### Author: ![exdghost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exdghost/32/100274_2.png) [@exdghost](https://discuss.elastic.co/u/exdghost)
#### Post date: [March 7, 2023, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-8-6-1-httpjson-chain-response-transform-question/326774/2 "2023-03-07T12:40:47Z")

</div>

Hi Marc,

Thanks for posting your query. At the moment the **first\_response** should only be used for storing flat JSON structures and cannot be split upon. It was introduced for a couple of niche use\_cases. It also cannot deal with NDJSON, JSON responses with the root object being an array or Gzipped JSONs. This will be worked upon the future and a PR is already under review to make the **first\_response** object a flag based variable, updating the documentation simultaneously.

PR:- [[filebeat][httpjson] - Fix first\_response false positive error by making it a flag based object by ShourieG · Pull Request #34748 · elastic/beats · GitHub](https://github.com/elastic/beats/pull/34748)

---

<div class="post-metadata">

### Author: ![marrc.rousseau](https://avatars.discourse-cdn.com/v4/letter/m/2acd7d/32.png) [@marrc.rousseau](https://discuss.elastic.co/u/marrc.rousseau)
#### Post date: [March 13, 2023, 8:51am UTC](https://discuss.elastic.co/t/filebeat-8-6-1-httpjson-chain-response-transform-question/326774/3 "2023-03-13T08:51:59Z")

</div>

Thanks for your answer @exdghost

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 10, 2023, 10:52am UTC](https://discuss.elastic.co/t/filebeat-8-6-1-httpjson-chain-response-transform-question/326774/4 "2023-04-10T10:52:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.