From fd86ea04ac51ea3908af6f9475a474b5f1d07794 Mon Sep 17 00:00:00 2001
From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com>
Date: Sun, 21 Aug 2022 14:52:31 -0400
Subject: [PATCH] httpjson: Add toJSON helper function (#32472) (#32736)

toJSON converts the given structure into a JSON string.

Example usage:

  response.pagination:
    - set:
        target: body.pagingIdentifiers
        value: '[[ toJSON .last_response.body.pagingIdentifiers ]]'
        value_type: json
        fail_on_template_error: true

(cherry picked from commit 396af77680d163d72697cd2c3c7b5765e52e822e)

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
---
 CHANGELOG.next.asciidoc                             |  1 +
 x-pack/filebeat/docs/inputs/input-httpjson.asciidoc |  1 +
 x-pack/filebeat/input/httpjson/value_tpl.go         | 11 +++++++++++
 x-pack/filebeat/input/httpjson/value_tpl_test.go    | 11 +++++++++++
 4 files changed, 24 insertions(+)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 75ddd6cd31b2..96ae8f9fd235 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -118,6 +118,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 - Extend list of mapped record types in o365 Audit module. {pull}32217[32217]
 - Add references for CRI-O configuration in input-container and in our kubernetes manifests {issue}32149[32149] {pull}32151[32151]
 - httpjson input: Add `replaceAll` helper function to template context. {pull}32365[32365]
+- httpjson input: Add `toJSON` helper function to template context. {pull}32472[32472]
 - Optimize grok patterns in system.auth module pipeline. {pull}32360[32360]
 - Checkpoint module: add authentication operation outcome enrichment. {issue}32230[32230] {pull}32431[32431]
 - add documentation for decode_xml_wineventlog processor field mappings.  {pull}32456[32456]
diff --git a/x-pack/filebeat/docs/inputs/input-httpjson.asciidoc b/x-pack/filebeat/docs/inputs/input-httpjson.asciidoc
index e181c8abeb26..bfc85b2ec140 100644
--- a/x-pack/filebeat/docs/inputs/input-httpjson.asciidoc
+++ b/x-pack/filebeat/docs/inputs/input-httpjson.asciidoc
@@ -224,6 +224,7 @@ Some built-in helper functions are provided to work with the input state inside
 - `replaceAll(old, new, s)`: replaces all non-overlapping instances of `old` with `new` in `s`. Example: `[[ replaceAll "some" "my" "some value" ]]` returns `my value`.
 - `sprintf`: formats according to a format specifier and returns the resulting string. Refer to https://pkg.go.dev/fmt#Sprintf[the Go docs] for usage. Example: `[[sprintf "%d:%q" 34 "quote this"]]`
 - `toInt`: converts a value of any type to an integer when possible. Returns 0 if the conversion fails.
+- `toJSON`: converts a value to a JSON string. This can be used with `value_type: json` to create an object from a template. Example: `[[ toJSON .last_response.body.pagingIdentifiers ]]`.
 - `urlEncode`: URL encodes the supplied string. Example `[[urlEncode "string1"]]`. Example `[[urlEncode "<string1>"]]` will return `%3Cstring1%3E`.
 - `userAgent`: generates the User Agent with optional additional values. If no arguments are provided, it will generate the default User Agent that is added to all requests by default. It is recommended to delete the existing User-Agent header before setting a new one. Example: `[[ userAgent "integration/1.2.3" ]]` would generate `Elastic-Filebeat/8.1.0 (darwin; amd64; 9b893e88cfe109e64638d65c58fd75c2ff695402; 2021-12-15 13:20:00 +0000 UTC; integration_name/1.2.3)`
 - `uuid`: returns a random UUID such as `a11e8780-e3e7-46d0-8e76-f66e75acf019`. Example: `[[ uuid ]]`
diff --git a/x-pack/filebeat/input/httpjson/value_tpl.go b/x-pack/filebeat/input/httpjson/value_tpl.go
index 0b45cd4a2538..2f2d382480d8 100644
--- a/x-pack/filebeat/input/httpjson/value_tpl.go
+++ b/x-pack/filebeat/input/httpjson/value_tpl.go
@@ -11,6 +11,7 @@ import (
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/hex"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"hash"
@@ -64,6 +65,7 @@ func (t *valueTpl) Unpack(in string) error {
 			"hmac":                hmacStringHex,
 			"hmacBase64":          hmacStringBase64,
 			"join":                join,
+			"toJSON":              toJSON,
 			"mul":                 mul,
 			"now":                 now,
 			"parseDate":           parseDate,
@@ -439,3 +441,12 @@ func urlEncode(value string) string {
 func replaceAll(old, new, s string) string {
 	return strings.ReplaceAll(s, old, new)
 }
+
+// toJSON converts the given structure into a JSON string.
+func toJSON(i interface{}) (string, error) {
+	result, err := json.Marshal(i)
+	if err != nil {
+		return "", fmt.Errorf("toJSON failed: %w", err)
+	}
+	return string(bytes.TrimSpace(result)), nil
+}
diff --git a/x-pack/filebeat/input/httpjson/value_tpl_test.go b/x-pack/filebeat/input/httpjson/value_tpl_test.go
index 300728fbf5b6..7dfbd3e829f0 100644
--- a/x-pack/filebeat/input/httpjson/value_tpl_test.go
+++ b/x-pack/filebeat/input/httpjson/value_tpl_test.go
@@ -574,6 +574,17 @@ func TestValueTpl(t *testing.T) {
 			paramTr:     transformable{},
 			expectedVal: "my value",
 		},
+		{
+			name:  "func toJSON",
+			value: "[[ toJSON .first_event.events ]]",
+			paramCtx: &transformContext{
+				firstEvent:   &mapstr.M{"events": []interface{}{map[string]interface{}{"id": 1234}}},
+				lastEvent:    &mapstr.M{},
+				lastResponse: newTestResponse(nil, nil, ""),
+			},
+			paramTr:     transformable{},
+			expectedVal: `[{"id":1234}]`,
+		},
 	}
 
 	for _, tc := range cases {