Response_split not splitting final response after a chain/while sequence completes

Elastic Stack Elastic Agent
1

I have a working chain/while setup that polls an async job-status endpoint until completion — this part works correctly, and only the final ("finished") response reaches message/event.original, as expected.

The problem: response_split isn't splitting that final response into multiple documents. The entire JSON body — results array and all — lands as a single document instead of one document per array item.

Config (via Fleet package policy API):

PUT kbn:/api/fleet/package_policies/7830640f-15a4-4c94-8614-e4d9d12bed73
{
  "package": {
    "name": "httpjson",
    "version": "1.18.0",
    "experimental_data_stream_features": []
  },
  "name": "Sekoia | Silent Intakes Monitor",
  "namespace": "",
  "description": "Detects Sekoia intakes with no events in the last 24h, enriched with 7-day average for context",
  "policy_ids": [
    "2d583987-fb02-4665-8751-771e3106186f"
  ],
  "vars": {},
  "inputs": {
    "generic-httpjson": {
      "enabled": true,
      "streams": {
        "httpjson.generic": {
          "enabled": true,
          "vars": {
            "data_stream.dataset": "sekoia_silent_intakes",
            "pipeline": "sekoia_silent_intakes",
            "request_url": "https://api.sekoia.io/v1/notebooks/queries/runs",
            "request_interval": "1h",
            "request_method": "POST",
            "request_body": "...",
            "request_transforms": "- set:\n    target: header.Authorization\n    value: 'Bearer ...'\n- set:\n    target: header.Content-Type\n    value: application/json",
            "response_split": "target: body.results",
            "request_redirect_headers_ban_list": [],
            "oauth_scopes": [],
            "chain": "- while:\n    request.method: GET\n    request.url: 'https://api.sekoia.io/v1/notebooks/queries/runs/$.uuid'\n    replace: $.uuid\n    request.transforms:\n      - set:\n          target: header.Authorization\n          value: 'Bearer ...'\n    until: '[[ eq .last_response.body.status \"finished\" ]]'\n    request.retry.max_attempts: 15\n    request.retry.wait_min: 5s\n    request.retry.wait_max: 30s",
            "tags": [
              "forwarded"
            ]
          }
        }
      }
    }
  }
}

Example final response body (anonymized, truncated to 3 of 1314 real items):

{
  "status": "finished",
  "total": 1314,
  "results": [
    {"name": "Intake-A", "community_context.name": "Community-A", "last24h": 0, "SevenDayAverage": 0},
    {"name": "Intake-B", "community_context.name": "Community-B", "last24h": 0, "SevenDayAverage": 0},
    {"name": "Intake-C", "community_context.name": "Community-C", "last24h": 0, "SevenDayAverage": 0}
  ]
}

results is a genuine top-level JSON array, matching response_split: target: body.results exactly — yet no split occurs; the whole body is ingested as one document.

Things I've tried:

  • Adding type: array and keep_parent: false to response_split
  • Placing response_split at the top level (sibling of chain) — current state
  • Confirmed via GET /api/fleet/agent_policies/{id}/full that response_split is present in the compiled config

Question: does response_split apply to the final response of a chain/while sequence the same way it does for a non-chained single request, or is there a different mechanism/placement needed for splitting a chained response? Any pointers on what's misconfigured here would be appreciated.