Fix httpjson split issue on empty root array (#32001)

* Fix httpjson split issue on empty root arrayPublish events * update asciidoc * update changelog * remove old lines (cherry picked from commit 0334634)
elastic · Sep 15, 2022 · bc1059d · bc1059d
1 parent 982f1f0
commit bc1059d
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 5 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -42,6 +42,26 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 
 *Filebeat*
 
+- Fix counter for number of events published in `httpjson` input. {pull}31993[31993]
+- Fix handling of Checkpoint event for R81. {issue}32380[32380] {pull}32458[32458]
+- Fix a hang on `apt-get update` stage in packaging. {pull}32580[32580]
+- gcp-pubsub input: Restart Pub/Sub client on all errors. {issue}32550[32550] {pull}32712[32712]
+- Fix not parsing as json when `json` and `ndjson` content types have charset information in `aws-s3` input {pull}32767[32767]
+- Update `cloud.region` parsing in cloudtrail fileset. {pull}32763[32763]
+- Fix file.path field in cloudtrail fileset to use json.digestS3Object. {pull}32759[32759]
+- Fix rendering of MAC addresses to conform to ECS. {issue}32621[32621] {pull}32622[32622]
+- Import dashboards from CEF integration. {pull}32766[32766]
+- Fix how to handle IPv6 addresses in the fileset `nginx/ingress_controller` for Filebeat. {pull}32989[32989]
+- Fix handling of Cisco 302020 messages in ASA and FTD modules. {pull}33089[33089]
+
+*Auditbeat*
+
+
+*Filebeat*
+
+- Add handling of AAA operations for Cisco ASA module. {issue}32257[32257] {pull}32789[32789]
+- Fix gc.log always shipped even if gc fileset is disabled {issue}30995[30995]
+- Fix handling of empty array in httpjson input. {pull}32001[32001]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/input/httpjson/split.go b/x-pack/filebeat/input/httpjson/split.go
@@ -136,6 +136,7 @@ func (s *split) split(ctx *transformContext, root mapstr.M, ch chan<- maybeMsg)
 				return nil
 			}
 			if s.isRoot {
+				ch <- maybeMsg{msg: root}
 				return errEmptyRootField
 			}
 			ch <- maybeMsg{msg: root}

diff --git a/x-pack/filebeat/input/httpjson/split_test.go b/x-pack/filebeat/input/httpjson/split_test.go
@@ -277,10 +277,11 @@ func TestSplit(t *testing.T) {
 			},
 		},
 		{
-			name: "First level split skips publish if no events",
+			name: "First level split publishes with key if no events",
 			config: &splitConfig{
-				Target: "body.response",
-				Type:   "array",
+				Target:     "body.response",
+				Type:       "array",
+				KeepParent: true,
 				Split: &splitConfig{
 					Target:     "body.Event.Attributes",
 					KeepParent: true,
@@ -292,8 +293,12 @@ func TestSplit(t *testing.T) {
 					"response": []interface{}{},
 				},
 			},
-			expectedMessages: []mapstr.M{},
-			expectedErr:      errEmptyRootField,
+			expectedMessages: []mapstr.M{
+				{
+					"response": []interface{}{},
+				},
+			},
+			expectedErr: errEmptyRootField,
 		},
 		{
 			name: "Changes must be local to parent when nested splits",