HTTP-json module: processing json array

I'm getting the following response from a web-server:

  "items": [
    {"id": "0", "title": "title 1", "text": "some text"},
    {"id": "1", "title": "title 2", "text": "some text"}

Is is possible:

  • to drop items.*.text ?
  • to split items into separate events?

Thank a lot!


It could be possible if the response was a pure array, without this items key. See:

no "magic" parameter json.is_array.path? :slight_smile:
Unfortunately, I cannot change the web-server's response.
So, the only way is to send the structure to ES and generate separate events in a pipeline, isn't it?
Thanks a lot!

oh no! ES-ingest has neither split (events) nor clone processors!
what should I do? Logstash is not an options...


Maybe script-processor could be of help here.

yes, I saw it, but it was not clear, how could I spawn new events

function process(event) {
    process(new Event({event: {my: "stuff"}))

could this work?..

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.