Digest Authentication to 'httpjson' input

[getkub]

Describe the enhancement:
First of all thanks for implementing Digest Authentication in filebeat CEL input type. As more and more SAAS solutions with API use 'digest' authentication, it would be beneficial to embed digest authentication type to 'httpjson' input type

Describe a specific use case for the enhancement or feature:
CEL is complicated for many use-cases and httpjson is much easy and sufficient in many scenarios.

CEL input has been uplifted using Digest authentication in: #36932
Please extend this to https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

@getkub I'd be interested to see a case of HTTPJSON use where you think the CEL equivalent is complicated.

[getkub]

@efd6 Few instances below

• Need to get data from 'MongoDB Atlas' service. It just needs digest authentication and URL is same. So the real purpose is just for 'digest authentication'
• Need to pull 'smarts application' with 'digest authentication' and simple URL, but we would like to leverage the response.split function
• Basically for ALL simple http GET requests with digest auth; and the learning curve for CEL input is bit high for our team

[efd6]

@getkub, a GET-based configuration will look at a minimum like the example in the configuration UI (the endpoint copied from there for the example)

bytes(get("https://api.ipify.org/?format=json").Body).as(body, {
    "events": [body.decode_json()],
})

plus configuration that's essentially identical to the config options in the HTTPJSON package.

If the body of the response had an array of elements that you want to split on, say called data, then it would look like

bytes(get("https://api.ipify.org/?format=json").Body).as(body, {
    "events": body.decode_json().data.map(d, d),
})

The language allows more, but in the minimum it is clearer than HTTPJSON in terms of what is actually being executed.

[getkub]

ok, in that case you can close the issue. thanks for the explanation