I'm using the http_poller plugin with an endpoint that returns a json array and then I'm processing the response in a ruby script. It seems like http_poller is automatically splitting the body into separate events for each element in the response. I'm not using a split filter at all, and getting the error Could not process event: undefined method `has_key?' for ["id", 5]:Array
. Is this expected/documented? Am I doing something wrong?
input {
http_poller {
urls => {
poll_it => {
method => get
url => "http://endpoint/stuff"
}
}
request_timeout => 60
schedule => { every => "1m" }
codec => "json"
metadata_target => "poll_metadata"
target => "body"
}
}
filter {
ruby {
path => "/some/script.rb"
}
}
output {
pipeline {
send_to => [someOtherPipeline]
}
}
Script:
def filter(event)
body = event.get("body")
logger.error("test: ", {"value" => body})
stuff = []
for thing in body do
if thing.has_key? "foo"
stuff.push(thing["foo"])
end
end
event.set("stuff", stuff.join(','))
return [event]
end