Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x-pack/filebeat/docs/input: clarify interaction between split and cursor updates #41384

Merged
merged 1 commit into from
Oct 24, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions x-pack/filebeat/docs/inputs/input-httpjson.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -783,6 +783,8 @@ Valid when used with `type: map`. When not empty, defines a new field where the

If set to true, empty or missing value will be ignored and processing will pass on to the next nested split operation instead of failing with an error. Default: `false`.

Note that if `ignore_empty_value` is `true` and the final result is empty, no event will be published, and no cursor update will be made. If a cursor update must be made for all responses, this should be set to `false` and the ingest pipeline must be configured to tolerate empty event sets.

[float]
==== `response.split[].split`

Expand Down Expand Up @@ -1556,6 +1558,8 @@ See <<chain-step-replace_with, chain[].step.replace_with>> .

Cursor is a list of key value objects where arbitrary values are defined. The values are interpreted as <<value-templates,value templates>> and a default template can be set. Cursor state is kept between input restarts and updated once all the events for a request are published.

If no event is published, no cursor update is made. This can have implications on how cursor updates should be performed when the target API returns empty response sets.

Each cursor entry is formed by:

- A `value` template, which will define the value to store when evaluated.
Expand Down
Loading