Hey All,
I'm having trouble getting some json data from a field using painless. I have an index with firewall data, one of the fields is headers. I want to pull from the header the requested host, but as you can see from the data it's not keyed as i'd expect. So i need to say where Name = Host get the Value.
So it returns my.website.com, the json is stored in httpRequest.headers and here is a sample;
{
"name": "Host",
"value": "my.website.com"
},
{
"name": "Content-Length",
"value": "0"
},
{
"name": "pragma",
"value": "no-cache"
},
{
"name": "cache-control",
"value": "no-cache"
},
{
"name": "user-agent",
"value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
},
{
"name": "accept",
"value": "text/css,*/*;q=0.1"
}
Now i can pull the all the values or names like this; doc['httpRequest.headers.name.keyword'].value
but that returns, mywebsite.com, pragam, 0 etc. etc..
How do I pull just the host value?