# Response\_split not splitting final response after a chain/while sequence completes
**URL:** https://discuss.elastic.co/t/response-split-not-splitting-final-response-after-a-chain-while-sequence-completes/389417
**Category:** Elastic Agent
**Created:** [August 11, 2026, 8:37am UTC](https://discuss.elastic.co/t/response-split-not-splitting-final-response-after-a-chain-while-sequence-completes/389417 "2026-08-11T08:37:57Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)
#### Post date: [August 11, 2026, 8:37am UTC](https://discuss.elastic.co/t/response-split-not-splitting-final-response-after-a-chain-while-sequence-completes/389417/1 "2026-08-11T08:37:57Z")
I have a working `chain`/`while` setup that polls an async job-status endpoint until completion — this part works correctly, and only the final ("finished") response reaches `message`/`event.original`, as expected.
The problem: `response_split` isn't splitting that final response into multiple documents. The entire JSON body — `results` array and all — lands as a single document instead of one document per array item.
**Config (via Fleet package policy API):**
```json
PUT kbn:/api/fleet/package_policies/7830640f-15a4-4c94-8614-e4d9d12bed73
{
"package": {
"name": "httpjson",
"version": "1.18.0",
"experimental_data_stream_features": []
},
"name": "Sekoia | Silent Intakes Monitor",
"namespace": "",
"description": "Detects Sekoia intakes with no events in the last 24h, enriched with 7-day average for context",
"policy_ids": [
"2d583987-fb02-4665-8751-771e3106186f"
],
"vars": {},
"inputs": {
"generic-httpjson": {
"enabled": true,
"streams": {
"httpjson.generic": {
"enabled": true,
"vars": {
"data_stream.dataset": "sekoia_silent_intakes",
"pipeline": "sekoia_silent_intakes",
"request_url": "https://api.sekoia.io/v1/notebooks/queries/runs",
"request_interval": "1h",
"request_method": "POST",
"request_body": "...",
"request_transforms": "- set:\n target: header.Authorization\n value: 'Bearer ...'\n- set:\n target: header.Content-Type\n value: application/json",
"response_split": "target: body.results",
"request_redirect_headers_ban_list": [],
"oauth_scopes": [],
"chain": "- while:\n request.method: GET\n request.url: 'https://api.sekoia.io/v1/notebooks/queries/runs/$.uuid'\n replace: $.uuid\n request.transforms:\n - set:\n target: header.Authorization\n value: 'Bearer ...'\n until: '[[eq .last_response.body.status \"finished\"]]'\n request.retry.max_attempts: 15\n request.retry.wait_min: 5s\n request.retry.wait_max: 30s",
"tags": [
"forwarded"
]
}
}
}
}
}
}
```
**Example final response body (anonymized, truncated to 3 of 1314 real items):**
```json
{
"status": "finished",
"total": 1314,
"results": [
{"name": "Intake-A", "community_context.name": "Community-A", "last24h": 0, "SevenDayAverage": 0},
{"name": "Intake-B", "community_context.name": "Community-B", "last24h": 0, "SevenDayAverage": 0},
{"name": "Intake-C", "community_context.name": "Community-C", "last24h": 0, "SevenDayAverage": 0}
]
}
```
`results` is a genuine top-level JSON array, matching `response_split: target: body.results` exactly — yet no split occurs; the whole body is ingested as one document.
**Things I've tried:**
- Adding `type: array` and `keep_parent: false` to `response_split`
- Placing `response_split` at the top level (sibling of `chain`) — current state
- Confirmed via `GET /api/fleet/agent_policies/{id}/full` that `response_split` is present in the compiled config
**Question:** does `response_split` apply to the final response of a `chain`/`while` sequence the same way it does for a non-chained single request, or is there a different mechanism/placement needed for splitting a chained response? Any pointers on what's misconfigured here would be appreciated.
---
### Author:  [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)
#### Post date: [August 13, 2026, 7:33am UTC](https://discuss.elastic.co/t/response-split-not-splitting-final-response-after-a-chain-while-sequence-completes/389417/2 "2026-08-13T07:33:33Z")
Anyone have an example or docs reference for a valid elastic agent custom API chain+split combination?
---
### Author:  [@bmorelli25](https://discuss.elastic.co/u/bmorelli25)
#### Post date: [August 20, 2026, 10:42pm UTC](https://discuss.elastic.co/t/response-split-not-splitting-final-response-after-a-chain-while-sequence-completes/389417/3 "2026-08-20T22:42:35Z")
Hi @lduvnjak. I'm not an expert here, but looking at the [custom API integration template](https://github.com/elastic/integrations/blob/main/packages/httpjson/data_stream/generic/agent/stream/httpjson.yml.hbs#L129-L164) and the [`chain` docs](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-httpjson#_chain_while_response_split), I think you need to move the split into the `while` block so it operates on the competed GET response. Something like this:
```diff
request.url: https://api.sekoia.io/v1/notebooks/queries/runs
request.method: POST
-# This is attached to the initial POST response.
-response.split:
- target: body.results
chain:
- while:
request.method: GET
request.url: "https://api.sekoia.io/v1/notebooks/queries/runs/$.uuid"
replace: $.uuid
request.transforms:
- set:
target: header.Authorization
value: "Bearer ..."
until: '[[eq .last_response.body.status "finished"]]'
request.retry.max_attempts: 15
request.retry.wait_min: 5s
request.retry.wait_max: 30s
+ response.split:
+ target: body.results
+ type: array
+ keep_parent: false
```
This remove the top-level `response_split` variable, since it targets the initial POST and instead puts `response.split` inside the YAML stored in the `chain` variable. Then with [`keep_parent: false`](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#response-split-keep-parent), each element of `results` becomes an individual event.