FileBeat HTTPJSON input split.type of list?

Elastic Stack Beats
1

Hello, I'm struggling to perform a subsplit with a type of list. It appears only array, map, and string is supported. Am I not understanding something? Or is there a way to make this work?

config

  response:
    split:
      target: body.entries
      type: array
      split:
        target: body.entries.nodeNames
        type: list # I want to use list here as the data is a list. However, this is not a valid option
        keep_parent: true

input data

{
  "totalItemsCount": 2,
  "totalResultsCount": 2,
  "offset": 0,
  "entries": [
    {
      "category": "PSIRT",
      "title": "Descriptive title for this PSIRT category",
      "nodeNames": [
        "node-AA",
        "node-BB"
      ]
    },
    {
      "category": "HWEOL",
      "title": "Descriptive title for this HWEOL category",
      "nodeNames": [
        "node-01"
      ]
    }
  ]
}

output desired

{
  "category": "PSIRT",
  "title": "Descriptive title for this PSIRT category",
  "nodeNames": "node-AA"
},
{
  "category": "PSIRT",
  "title": "Descriptive title for this PSIRT category",
  "nodeNames": "node-BB"
},
{
  "category": "HWEOL",
  "title": "Descriptive title for this HWEOL category",
  "nodeNames": "node-01"
}

However, I cannot set the sub split type to list, so what I can getting is this

actual output

{
  "category": "PSIRT",
  "title": "Descriptive title for this PSIRT category",
  "nodeNames": [
    "node-AA",
    "node-BB"
  ]
},
{
  "category": "HWEOL",
  "title": "Descriptive title for this HWEOL category",
  "nodeNames": [
    "node-01"
  ]
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.