String array support in http/json metricset

[Benny-Git]

Describe the enhancement:

The standard http/json metricset should support parsing of String arrays when json.is_array: true is set.

Pull request #6480 added support for JSON arrays containing JSON objects (the type for elements in the array is []common.MapStr), but that doesn't allow parsing Strings in an array.

Describe a specific use case for the enhancement or feature:

We are currently trying to pull data from an application that exposes a list of connected systems as a REST endpoint, returning a simple String array. So when I call http://example.com/rest/connectedSystems/ it returns

["systemA", "systemB", "anotherOne", "theLastOne"]

I want to track which systems are connected at any given point in time. This could be done by storing one doc for each system and timestamp, allowing me to aggregate later on. So later I could query for systemA, and see at what times it was or was not connected. Also, I'd be able to use a cardinality query to see how many systems were connected at any given time (having a trend graph on Kibana for it).

Link to discussion:

https://discuss.elastic.co/t/161342

[aidarbek]

Hi! I am a bit new to the Beats and wanted to make sure if I understood solution to this issue correctly. Is it possible to change jsonBodyArr variable's datatype from []common.MapStr to []interface{} in the Fetch() method (so that it could store not only plain string and plain object arrays, but also arrays of strings and objects combined) and do some handling in processBody() method? But it looks like it is required to return common.MapStr type in processBody() method. As I understood from the discussion on this issue, the string element of the array should be put in the namespace key of event variable from processBody()?

[ruflin]

@aidarbek Good timing, @live-wire started some work on this here: #10136

In general I think it's important to differentiate 3 things

• []common.MapStr: Array of objects, send multiple docs
• []string: Array of strings, my suggestion would be to just send one doc with the array in
• common.MapStr with array of objects inside: This would create nested documents and I would separate it from this discussion here.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.