I have figured out how to split the array into two events, or one of the items into the correct output if passed by itself, but I'm not sure how to both split the input array and then also split each item by actions.
The expected output would be that each of the 4 outputs above would be passed on as a log event.
I'd like logstash to listen for an http request with the array indicated as the JSON input above and then pass on the 4 output documents indicated above to Elasticsearch and to the filesystem. I think I've figured out the input/output steps work, but I'm not sure how to split the input twice. First to get one object for each member of the initial input array and then to split again on the "actions" property of each of those events.
Does that answer your question? Thanks for your help!
The count for the generator is how many time to repeat the message. It's used for testing. You wouldn't need that for HTT input. I would really focus on your input first because it's possible the data could be structured different.