HTTP-json module: processing json array

[jetnet]

I'm getting the following response from a web-server:

{
  "items": [
    {"id": "0", "title": "title 1", "text": "some text"},
    {"id": "1", "title": "title 2", "text": "some text"}
  ]
}

Is is possible:

• to drop items.*.text ?
• to split items into separate events?

Thank a lot!

[ChrsMark (Chris Mark)]

Hi!

It could be possible if the response was a pure array, without this items key. See: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-http-json.html#_json_is_array

[jetnet]

no "magic" parameter json.is_array.path?
Unfortunately, I cannot change the web-server's response.
So, the only way is to send the structure to ES and generate separate events in a pipeline, isn't it?
Thanks a lot!

[jetnet]

oh no! ES-ingest has neither split (events) nor clone processors!
what should I do? Logstash is not an options...

[ChrsMark (Chris Mark)]

Hey!

Maybe script-processor could be of help here.

[jetnet]

hello!
yes, I saw it, but it was not clear, how could I spawn new events

function process(event) {
    ...
    process(new Event({event: {my: "stuff"}))
    ...
}

could this work?..