Split filter array handling is unclear

[andrewvc]

We could do a better job documenting array handling and potentially implementing it. This issue was created to more concretely address the issues raised in elastic/logstash#6441 and elastic/logstash#6260 .

@jordansissel what is the correct way to handle arrays? Is it to consider them already split, or is it to run this filter on each item in the array?

[jordansissel]

If [foo] is an array, and [foo][bar] is looked up, I think this should either be an error or nil, because the field [foo][bar] doesn't exist.

We handle arrays by allowing you to specify index, like [foo][0][bar] will get the field 'bar' from the first entry of [foo] array.

FOr the example from logstash#6441:

 { "foo": [{"bar": "123"},{"bar": "456"}] }

Because we don't have errors (yet?) from field lookups, I propose:

• [foo][bar] is nil (new behavior, current behavior is throwing an exception due to unexpected input)
• [foo][0][bar] is "123" (this will work today)

[andrewvc]

@jordansissel that makes sense. Looking again I see we do document the array behavior here but the docs are out of date.

My recommendation is that we regenerate the docs and close this ticket. Thoughts?

You did mention that elastic/logstash#6260 needed work, but I don't see any mention of a PR to address that. Is it safe to close this group of issues completely?

[andrewvc]

Assigned to @suyograo to regenerate the docs.