Hello I'm trying to pass a list of dicts from a "custom code block" into a "filter block", to run either ip_lookup, hash_lookup, or both sub-playbooks based on the indicator type. For example: ioc_list = [ { "ioc": "2.2.2.2", "type": "ip" }, { "ioc": "1.1.1.1", "type": "ip" }, { "ioc": "ce5761c89434367598b34f32493b", "type": "hash" } ] And then on filter I have: if get_indicators:custom_function:ioc_list.*.type == ip run -> ip_lookup sub-playbook if get_indicators:custom_function:ioc_list.*.type == hash run -> hash_lookup sub-playbook And it looks like the filter does half of the job, because it can route to the proper sub-playbook(s), but instead of forwarding only the elements that match the conditions, it simply forwards all elements. Expected output: filtered-data on condition_1 route: [ { "ioc": "2.2.2.2", "type": "ip" }, { "ioc": "1.1.1.1", "type": "ip" }] filtered-data on condition_2 route: [{ "ioc": "ce5761c89434367598b34f32493b", "type": "hash" }] Actual output on both condition routes: [{ "ioc": "2.2.2.2", "type": "ip" }, { "ioc": "1.1.1.1", "type": "ip" }, { "ioc": "ce5761c89434367598b34f32493b", "type": "hash" }] Even though this seems a specific question, is also part of a broad miss-understanding of how custom code blocks and filter interact with each other. Hope some one can enlighten me in the correct path. Thanks
... View more