[httpjson] Add new join and sprintf functions

CHANGELOG.next.asciidoc

@@ -737,6 +737,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Move AWS module and filesets to GA. {pull}27428[27428]
 - update ecs.version to ECS 1.11.0. {pull}27107[27107]
 - Add base64 Encode functionality to httpjson input. {pull}27681[27681]
+- Add `join` and `sprintf` functions to `httpjson` input. {pull}27735[27735]
 
 
 *Heartbeat*

x-pack/filebeat/docs/inputs/input-httpjson.asciidoc

@@ -206,6 +206,8 @@ Some built-in helper functions are provided to work with the input state inside
 - `hmac`: calculates the hmac signature of a list of strings concatenated together. Supports sha1 or sha256. Example `[[hmac "sha256" "secret" "string1" "string2" (formatDate (now) "RFC1123")]]`
 - `base64Encode`: Joins and base64 encodes all supplied strings. Example `[[base64Encode "string1" "string2"]]`
 - `base64EncodeNoPad`: Joins and base64 encodes all supplied strings without padding. Example `[[base64EncodeNoPad "string1" "string2"]]`
+- `join`: joins a list of strings using the specified separator. Example: `[[join .body.arr ","]]`
+- `sprintf`: formats according to a format specifier and returns the resulting string. Refer to https://pkg.go.dev/fmt#Sprintf[the Go docs] for usage. Example: `[[sprintf "%d:%q" 34 "quote this"]]`
 
 In addition to the provided functions, any of the native functions for https://golang.org/pkg/time/#Time[`time.Time`], https://golang.org/pkg/net/http/#Header[`http.Header`], and https://golang.org/pkg/net/url/#Values[`url.Values`] types can be used on the corresponding objects. Examples: `[[(now).Day]]`, `[[.last_response.header.Get "key"]]`
 

x-pack/filebeat/input/httpjson/internal/v2/value_tpl.go

@@ -12,6 +12,7 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"errors"
+	"fmt"
 	"hash"
 	"reflect"
 	"regexp"
@@ -57,6 +58,8 @@ func (t *valueTpl) Unpack(in string) error {
 			"hmac":                hmacString,
 			"base64Encode":        base64Encode,
 			"base64EncodeNoPad":   base64EncodeNoPad,
+			"join":                strings.Join,
+			"sprintf":             fmt.Sprintf,
 		}).
 		Delims(leftDelim, rightDelim).
 		Parse(in)

x-pack/filebeat/input/httpjson/internal/v2/value_tpl_test.go

@@ -291,6 +291,46 @@ func TestValueTpl(t *testing.T) {
 			expectedVal:   "",
 			expectedError: errEmptyTemplateResult.Error(),
 		},
+		{
+			name:  "func join",
+			value: `[[join .last_response.body.arr ","]]`,
+			paramCtx: &transformContext{
+				firstEvent: &common.MapStr{},
+				lastEvent:  &common.MapStr{},
+				lastResponse: newTestResponse(
+					common.MapStr{
+						"arr": []string{
+							"foo",
+							"bar",
+						},
+					},
+					http.Header{},
+					"",
+				),
+			},
+			paramTr:     transformable{},
+			expectedVal: "foo,bar",
+		},
+		{
+			name:  "func sprintf",
+			value: `[[sprintf "%q:%d" (join .last_response.body.arr ",") 1]]`,
+			paramCtx: &transformContext{
+				firstEvent: &common.MapStr{},
+				lastEvent:  &common.MapStr{},
+				lastResponse: newTestResponse(
+					common.MapStr{
+						"arr": []string{
+							"foo",
+							"bar",
+						},
+					},
+					http.Header{},
+					"",
+				),
+			},
+			paramTr:     transformable{},
+			expectedVal: `"foo,bar":1`,
+		},
 	}
 
 	for _, tc := range cases {