[8.4](backport #32472) httpjson: Add toJSON helper function

CHANGELOG.next.asciidoc

@@ -118,6 +118,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 - Extend list of mapped record types in o365 Audit module. {pull}32217[32217]
 - Add references for CRI-O configuration in input-container and in our kubernetes manifests {issue}32149[32149] {pull}32151[32151]
 - httpjson input: Add `replaceAll` helper function to template context. {pull}32365[32365]
+- httpjson input: Add `toJSON` helper function to template context. {pull}32472[32472]
 - Optimize grok patterns in system.auth module pipeline. {pull}32360[32360]
 - Checkpoint module: add authentication operation outcome enrichment. {issue}32230[32230] {pull}32431[32431]
 - add documentation for decode_xml_wineventlog processor field mappings.  {pull}32456[32456]

x-pack/filebeat/docs/inputs/input-httpjson.asciidoc

@@ -224,6 +224,7 @@ Some built-in helper functions are provided to work with the input state inside
 - `replaceAll(old, new, s)`: replaces all non-overlapping instances of `old` with `new` in `s`. Example: `[[ replaceAll "some" "my" "some value" ]]` returns `my value`.
 - `sprintf`: formats according to a format specifier and returns the resulting string. Refer to https://pkg.go.dev/fmt#Sprintf[the Go docs] for usage. Example: `[[sprintf "%d:%q" 34 "quote this"]]`
 - `toInt`: converts a value of any type to an integer when possible. Returns 0 if the conversion fails.
+- `toJSON`: converts a value to a JSON string. This can be used with `value_type: json` to create an object from a template. Example: `[[ toJSON .last_response.body.pagingIdentifiers ]]`.
 - `urlEncode`: URL encodes the supplied string. Example `[[urlEncode "string1"]]`. Example `[[urlEncode "<string1>"]]` will return `%3Cstring1%3E`.
 - `userAgent`: generates the User Agent with optional additional values. If no arguments are provided, it will generate the default User Agent that is added to all requests by default. It is recommended to delete the existing User-Agent header before setting a new one. Example: `[[ userAgent "integration/1.2.3" ]]` would generate `Elastic-Filebeat/8.1.0 (darwin; amd64; 9b893e88cfe109e64638d65c58fd75c2ff695402; 2021-12-15 13:20:00 +0000 UTC; integration_name/1.2.3)`
 - `uuid`: returns a random UUID such as `a11e8780-e3e7-46d0-8e76-f66e75acf019`. Example: `[[ uuid ]]`

x-pack/filebeat/input/httpjson/value_tpl.go

@@ -11,6 +11,7 @@ import (
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/hex"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"hash"
@@ -64,6 +65,7 @@ func (t *valueTpl) Unpack(in string) error {
 			"hmac":                hmacStringHex,
 			"hmacBase64":          hmacStringBase64,
 			"join":                join,
+			"toJSON":              toJSON,
 			"mul":                 mul,
 			"now":                 now,
 			"parseDate":           parseDate,
@@ -439,3 +441,12 @@ func urlEncode(value string) string {
 func replaceAll(old, new, s string) string {
 	return strings.ReplaceAll(s, old, new)
 }
+
+// toJSON converts the given structure into a JSON string.
+func toJSON(i interface{}) (string, error) {
+	result, err := json.Marshal(i)
+	if err != nil {
+		return "", fmt.Errorf("toJSON failed: %w", err)
+	}
+	return string(bytes.TrimSpace(result)), nil
+}

x-pack/filebeat/input/httpjson/value_tpl_test.go

@@ -574,6 +574,17 @@ func TestValueTpl(t *testing.T) {
 			paramTr:     transformable{},
 			expectedVal: "my value",
 		},
+		{
+			name:  "func toJSON",
+			value: "[[ toJSON .first_event.events ]]",
+			paramCtx: &transformContext{
+				firstEvent:   &mapstr.M{"events": []interface{}{map[string]interface{}{"id": 1234}}},
+				lastEvent:    &mapstr.M{},
+				lastResponse: newTestResponse(nil, nil, ""),
+			},
+			paramTr:     transformable{},
+			expectedVal: `[{"id":1234}]`,
+		},
 	}
 
 	for _, tc := range cases {