Retrieve values from json file

[sdhiaeddine]

Hi,

I need to filter my query for a specific field_value. The working query is as follow:

index=_index (field_value="value1" OR field_value="value4" OR field_value="value14") | .....


Now, I would like to retrieve those field values from a remote json file and pass it to search condition this way:

index=_index (field_value in listOfFieldValuesFromRemoteJson) | .....

Could you please help me make it work?

The json file : [{"field_value": "value1"},{"field_value": "value4"},{"field_value": "value14"}]

Best regards,
Dhiaeddine

[ITWhisperer]

Have you already ingested the "remote" file or made it available through a KV store?

How often does the remote file change?

[sdhiaeddine]

Hi @ITWhisperer 

---

Have you already ingested the "remote" file or made it available through a KV store?

---

Not yet, I'm still looking on how to do it

---

How often does the remote file change?

---

About once a month I update the json file

[ITWhisperer]

OK once you get the data ingested, it will be easier to use it