# Heartbeat parsing JSON object for HTTP monitor failure

**URL:** <https://discuss.elastic.co/t/heartbeat-parsing-json-object-for-http-monitor-failure/334335>\
**Category:** Beats\
**Tags:** heartbeat\
**Created:** [May 25, 2023, 1:44pm UTC](https://discuss.elastic.co/t/heartbeat-parsing-json-object-for-http-monitor-failure/334335 "2023-05-25T13:44:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [May 25, 2023, 1:44pm UTC](https://discuss.elastic.co/t/heartbeat-parsing-json-object-for-http-monitor-failure/334335/1 "2023-05-25T13:44:02Z")

</div>

hey there, I am using Heartbeat 8.x and according to

> <https://github.com/elastic/beats/pull/28073>
>
> This PR greatly improves validation of JSON HTTP response bodies in heartbeat in… two different ways:
> 
> 1. Introduces a new notion of JSON \`expressions\`, using \[gval\](https://github.com/PaesslerAG/gval) as an expression engine. This allows validation of complex data, including the use of \[JSON Path\]() expressions within. As an example you can write an expression like: \`$.nodes\[?(@name == "foo"\]\[2\].message == "hello"\` to traverse a JSON object containing a nodes key with nested objects, find all elements named "foo", select the third one, then see if its' \`message\` attribute equals "hello".
> 2. Supports handling APIs that return arrays of JSON objects without a top level object root. Previously, we only parsed JSON response that looked like an object, e.g. \`{"an": "object"}\`, we now support: \`\[{"one": 1},{"two": 2}\]\`.
> 3. Deprecates the \`condition\` configuration in favor of this new \`expression\` syntax. The new syntax is more consistent and powerful, and should be less effort to maintain.
> 
> It also splits out the JSON checking code into separate files to cut down on the extreme length of the originals.
> 
> Fixes #27283 
> 
> \## Checklist
> 
> \- \[x\] My code follows the style guidelines of this project
> \- \[x\] I have commented my code, particularly in hard-to-understand areas
> \- \[x\] I have made corresponding changes to the documentation
> \- \[x\] I have made corresponding change to the default configuration files
> \- \[x\] I have added tests that prove my fix is effective or that my feature works
> \- \[x\] I have added an entry in \`CHANGELOG.next.asciidoc\` or \`CHANGELOG-developer.next.asciidoc\`.
> 
> \## How to test this PR locally
> 
> Try the docs examples

> **[HTTP options | Heartbeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/heartbeat/current/monitor-http-options.html)**

I was trying to check the Sendgrid SMTP service using the public url [https://status.sendgrid.com/api/v2/components.json](https://status.sendgrid.com/api/v2/components.json)

Using this code:

```auto
- type: http
  id: sendgrid-smtp-status
  name: Check Sendgrid SMTP
  fields:
    component: "sendgrid-smtp-status"
  schedule: '@every 10s'
  response.include_body: always
  tags: ["sendgrid-smtp"]
  urls:
    - https://status.sendgrid.com/api/v2/components.json
  check.request.method: GET
  check.response:
    status: [200]
    json:
      - description: Check Sendgrid SMTP status
        expression: '$.components[4].status == "operational"'

```

I can reach my goal. Anyway, if I want to use a more flexible syntax like this one (since I am not sure that SMTP service will be forever at position 4):

```
   expression: '$.components[?(@.name=="SMTP")].status == "operational"'

```

I will face the error

> JSON body did not match 1 expressions or conditions 'rule 'Check Sendgrid SMTP status'($.components[?(@.name=="SMTP")].status == "operational") not matched

Can you explain me the reason?  
Furthermore, if I use the following code just to check if SMTP object exists, it works:

```
   expression: '$.components[?(@.name=="SMTP")] != []'

```

---

<div class="post-metadata">

**Author:** ![rschirin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rschirin/32/45283_2.png) [@rschirin](https://discuss.elastic.co/u/rschirin)\
**Post date:** [May 26, 2023, 10:52am UTC](https://discuss.elastic.co/t/heartbeat-parsing-json-object-for-http-monitor-failure/334335/2 "2023-05-26T10:52:39Z")

</div>

ok. I found a possible solution. probably it is not the best but it works.  
This is the way to check it:

```auto
expression: '$.components[?(@.name == "SMTP" && @.status == "operational")] != []'

```

In my opinion, official doc should be integrated with an example with logical operators

---

<div class="post-metadata">

**Author:** ![jkambic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jkambic/32/53306_2.png) [@jkambic](https://discuss.elastic.co/u/jkambic)\
**Post date:** [May 31, 2023, 1:05pm UTC](https://discuss.elastic.co/t/heartbeat-parsing-json-object-for-http-monitor-failure/334335/3 "2023-05-31T13:05:18Z")

</div>

Hi @rschirin - sorry we failed to get back to you promptly on this. I actually did pull down the same API last week and do a PoC. I was able to write an expression that worked well with the latest version of the library Heartbeat uses for processing JSON with this feature, but my expression didn't work for the version of the lib Heartbeat requires. I apologize that I failed to reply back here with a status update.

In any case, I'm glad you were able to solve the issue and I'll mention the case to my team that perhaps we can enhance the documentation around this feature.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2023, 3:05pm UTC](https://discuss.elastic.co/t/heartbeat-parsing-json-object-for-http-monitor-failure/334335/4 "2023-06-28T15:05:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.