HTTP-json module: processing json array

Elastic Stack Beats
1

I'm getting the following response from a web-server:

{
  "items": [
    {"id": "0", "title": "title 1", "text": "some text"},
    {"id": "1", "title": "title 2", "text": "some text"}
  ]
}

Is is possible:

  • to drop items.*.text ?
  • to split items into separate events?

Thank a lot!

2

Hi!

It could be possible if the response was a pure array, without this items key. See: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-metricset-http-json.html#_json_is_array

3

no "magic" parameter json.is_array.path? :slight_smile:
Unfortunately, I cannot change the web-server's response.
So, the only way is to send the structure to ES and generate separate events in a pipeline, isn't it?
Thanks a lot!

4

oh no! ES-ingest has neither split (events) nor clone processors!
what should I do? Logstash is not an options...

5

Hey!

Maybe script-processor could be of help here.

6

hello!
yes, I saw it, but it was not clear, how could I spawn new events

function process(event) {
    ...
    process(new Event({event: {my: "stuff"}))
    ...
}

could this work?..

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.