x-pack/filebeat/input/httpjson: allow template termination without logging error (#45810)

efd6 · web-flow · commit f324f295a3c9 · 2025-08-14T06:27:07.000+09:30
This adds a terminate helper that can be used to signal that a template
should terminate without an error. The termination can (should) be used
to report the reason for the termination which will be logged at DEBUG
level, but otherwise ignored.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -504,6 +504,7 @@ otherwise no tag is added. {issue}42208[42208] {pull}42403[42403]
 - Enhanced HTTPJSON input error logging with structured error metadata conforming to Elastic Common Schema (ECS) conventions. {pull}45653[45653]
 - Clarify behavior in logging for starting periodic evaluations and for exceeding the maximum execution budget. {pull}45633[45633]
 - Add status reporting support for AWS CloudWatch input. {pull}45679[45679]
+- Add mechanism to allow HTTP JSON templates to terminate without logging an error. {issue}45664[45664] {pull}45810[45810]
 
 *Auditbeat*
 
diff --git a/docs/reference/filebeat/filebeat-input-httpjson.md b/docs/reference/filebeat/filebeat-input-httpjson.md
@@ -221,6 +221,7 @@ Some built-in helper functions are provided to work with the input state inside
 * `parseTimestamp`: parses a timestamp in seconds and returns a `time.Time` in UTC. Example: `[[parseTimestamp 1604582732]]` returns `2020-11-05 13:25:32 +0000 UTC`.
 * `replaceAll(old, new, s)`: replaces all non-overlapping instances of `old` with `new` in `s`. Example: `[[ replaceAll "some" "my" "some value" ]]` returns `my value`.
 * `sprintf`: formats according to a format specifier and returns the resulting string. Refer to [the Go docs](https://pkg.go.dev/fmt#Sprintf) for usage. Example: `[[sprintf "%d:%q" 34 "quote this"]]`
+* `terminate`: exits the template without falling back to the default value and without causing an error. It takes a single string argument that is logged in debug logging. {applies_to}`stack: ga 9.1.2, ga 9.0.6, ga 8.19.2, ga 8.18.6`
 * `toInt`: converts a value of any type to an integer when possible. Returns 0 if the conversion fails.
 * `toJSON`: converts a value to a JSON string. This can be used with `value_type: json` to create an object from a template. Example: `[[ toJSON .last_response.body.pagingIdentifiers ]]`.
 * `urlEncode`: URL encodes the supplied string. Example `[[urlEncode "string1"]]`. Example `[[urlEncode "<string1>"]]` will return `%3Cstring1%3E`.
diff --git a/x-pack/filebeat/input/httpjson/request.go b/x-pack/filebeat/input/httpjson/request.go
@@ -414,9 +414,11 @@ func evaluateResponse(expression *valueTpl, data []byte, stat status.StatusRepor
 
 	val, err := expression.Execute(paramCtx, tr, "response_evaluation", nil, stat, log)
 	if err != nil {
-
 		return false, fmt.Errorf("error while evaluating expression: %w", err)
 	}
+	if val == "" {
+		return false, nil
+	}
 	result, err := strconv.ParseBool(val)
 	if err != nil {
 		return false, fmt.Errorf("error while parsing boolean value of string: %w", err)
diff --git a/x-pack/filebeat/input/httpjson/value_tpl.go b/x-pack/filebeat/input/httpjson/value_tpl.go
@@ -83,6 +83,7 @@ func (t *valueTpl) Unpack(in string) error {
 			"urlEncode":           urlEncode,
 			"userAgent":           userAgentString,
 			"uuid":                uuidString,
+			"terminate":           func(s string) (any, error) { return nil, &errTerminate{s} },
 		}).
 		Delims(leftDelim, rightDelim).
 		Parse(in)
@@ -95,6 +96,17 @@ func (t *valueTpl) Unpack(in string) error {
 	return nil
 }
 
+type errTerminate struct {
+	Reason string
+}
+
+func (e *errTerminate) Error() string {
+	if e.Reason != "" {
+		return "terminated template: " + e.Reason
+	}
+	return "terminated template"
+}
+
 func (t *valueTpl) Execute(trCtx *transformContext, tr transformable, targetName string, defaultVal *valueTpl, stat status.StatusReporter, log *logp.Logger) (val string, err error) {
 	fallback := func(err error) (string, error) {
 		if defaultVal != nil {
@@ -134,6 +146,11 @@ func (t *valueTpl) Execute(trCtx *transformContext, tr transformable, targetName
 	}
 
 	if err := t.Template.Execute(buf, data); err != nil {
+		var termErr *errTerminate
+		if errors.As(err, &termErr) {
+			log.Debugw("template execution terminated", "target", targetName, "reason", termErr.Reason)
+			return "", nil
+		}
 		return fallback(err)
 	}
 
diff --git a/x-pack/filebeat/input/httpjson/value_tpl_test.go b/x-pack/filebeat/input/httpjson/value_tpl_test.go
@@ -75,6 +75,14 @@ func TestValueTpl(t *testing.T) {
 			paramDefVal: "25",
 			expectedVal: "25",
 		},
+		{
+			name:        "terminate",
+			value:       `[[if false]]ok[[else]][[terminate "because reasons"]][[end]]`,
+			paramCtx:    emptyTransformContext(),
+			paramTr:     transformable{},
+			paramDefVal: "this should not be seen",
+			expectedVal: "",
+		},
 		{
 			name:          "returns error if result is empty and no default is set",
 			value:         "",
