Improve HTTPJSON implicit array split documentation

[marc-gr]

HTTPJSON does an implicit split when an it gets and array response.

This might lead to confusion and needs to be properly documented.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[Tigger2014]

Should it not also actually be possible to disable this behaviour as some things output as an array but need to be processed as a single event.

[marc-gr]

Should it not also actually be possible to disable this behaviour as some things output as an array but need to be processed as a single event.

That would be ideal as far as we can default to the current behavior to avoid introducing a breaking change

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[thopico]

I find it still relevant, especially giving the ability to process the output as one single event.

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!