diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 16f43d97714c..44db08ace8dd 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -146,6 +146,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Include ip and boolean type when generating index pattern. {pull}10995[10995] - Cancelling enrollment of a beat will not enroll the beat. {issue}10150[10150] - Add missing fields and test cases for libbeat add_kubernetes_metadata processor. {issue}11133[11133], {pull}11134[11134] +- decode_json_field: do not process arrays when flag not set. {pull}11318[11318] - Report faulting file when config reload fails. {pull}[11304]11304 *Auditbeat* diff --git a/libbeat/processors/actions/decode_json_fields.go b/libbeat/processors/actions/decode_json_fields.go index 5f01d0c2c643..684648e169c4 100644 --- a/libbeat/processors/actions/decode_json_fields.go +++ b/libbeat/processors/actions/decode_json_fields.go @@ -52,6 +52,7 @@ var ( MaxDepth: 1, ProcessArray: false, } + errProcessingSkipped = errors.New("processing skipped") ) var debug = logp.MakeDebug("filters") @@ -150,7 +151,7 @@ func unmarshal(maxDepth int, text string, fields *interface{}, processArray bool var tmp interface{} err := unmarshal(maxDepth, str, &tmp, processArray) if err != nil { - return v, false + return v, err == errProcessingSkipped } return tmp, true @@ -167,7 +168,7 @@ func unmarshal(maxDepth int, text string, fields *interface{}, processArray bool // We want to process arrays here case []interface{}: if !processArray { - break + return errProcessingSkipped } for i, v := range O { diff --git a/libbeat/processors/actions/decode_json_fields_test.go b/libbeat/processors/actions/decode_json_fields_test.go index cdfe3ff3ff45..50309652dfb8 100644 --- a/libbeat/processors/actions/decode_json_fields_test.go +++ b/libbeat/processors/actions/decode_json_fields_test.go @@ -199,6 +199,53 @@ func TestTargetRootOption(t *testing.T) { assert.Equal(t, expected.String(), actual.String()) } +func TestArrayWithArraysDisabled(t *testing.T) { + input := common.MapStr{ + "msg": `{ + "arrayOfMap": "[{\"a\":\"b\"}]" + }`, + } + + testConfig, _ = common.NewConfigFrom(map[string]interface{}{ + "fields": fields, + "max_depth": 10, + "process_array": false, + }) + + actual := getActualValue(t, testConfig, input) + + expected := common.MapStr{ + "msg": common.MapStr{ + "arrayOfMap": "[{\"a\":\"b\"}]", + }, + } + + assert.Equal(t, expected.String(), actual.String()) +} +func TestArrayWithArraysEnabled(t *testing.T) { + input := common.MapStr{ + "msg": `{ + "arrayOfMap": "[{\"a\":\"b\"}]" + }`, + } + + testConfig, _ = common.NewConfigFrom(map[string]interface{}{ + "fields": fields, + "max_depth": 10, + "process_array": true, + }) + + actual := getActualValue(t, testConfig, input) + + expected := common.MapStr{ + "msg": common.MapStr{ + "arrayOfMap": []common.MapStr{common.MapStr{"a": "b"}}, + }, + } + + assert.Equal(t, expected.String(), actual.String()) +} + func getActualValue(t *testing.T, config *common.Config, input common.MapStr) common.MapStr { logp.TestingSetup()