httpjson: Add replaceAll helper function

replaceAll returns a copy of the string s with all non-overlapping instances
of old replaced by new.

Note that the order of the arguments differs from Go's [strings.ReplaceAll] to
make pipelining more ergonomic. This allows s to be piped in because it is
the final argument. For example,

    [[ "some value" | replaceAll "some" "my" ]]  // == "my value"

CHANGELOG.next.asciidoc

@@ -103,6 +103,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 - Add new `parser` called `include_message` to filter based on message contents. {issue}31794[31794] {pull}32094[32094]
 - Extend list of mapped record types in o365 Audit module. {pull}32217[32217]
 - Add references for CRI-O configuration in input-container and in our kubernetes manifests {issue}32149[32149] {pull}32151[32151]
+- httpjson input: Add `replaceAll` helper function to template context. {pull}32365[32365]
 
 *Auditbeat*
 

x-pack/filebeat/docs/inputs/input-httpjson.asciidoc

@@ -221,6 +221,7 @@ Some built-in helper functions are provided to work with the input state inside
 - `parseTimestampMilli`: parses a timestamp in milliseconds and returns a `time.Time` in UTC. Example: `[[parseTimestamp 1604582732000]]` returns `2020-11-05 13:25:32 +0000 UTC`.
 - `parseTimestampNano`: parses a timestamp in nanoseconds and returns a `time.Time` in UTC. Example: `[[parseTimestamp 1604582732000000000]]` returns `2020-11-05 13:25:32 +0000 UTC`.
 - `parseTimestamp`: parses a timestamp in seconds and returns a `time.Time` in UTC. Example: `[[parseTimestamp 1604582732]]` returns `2020-11-05 13:25:32 +0000 UTC`.
+- `replaceAll(old, new, s)`: replaces all non-overlapping instances of `old` with `new` in `s`. Example: `[[ replaceAll "some value" "some" "my" ]]` returns `my value`.
 - `sprintf`: formats according to a format specifier and returns the resulting string. Refer to https://pkg.go.dev/fmt#Sprintf[the Go docs] for usage. Example: `[[sprintf "%d:%q" 34 "quote this"]]`
 - `toInt`: converts a value of any type to an integer when possible. Returns 0 if the conversion fails.
 - `urlEncode`: URL encodes the supplied string. Example `[[urlEncode "string1"]]`. Example `[[urlEncode "<string1>"]]` will return `%3Cstring1%3E`.

x-pack/filebeat/input/httpjson/value_tpl.go

@@ -71,6 +71,7 @@ func (t *valueTpl) Unpack(in string) error {
 			"parseTimestamp":      parseTimestamp,
 			"parseTimestampMilli": parseTimestampMilli,
 			"parseTimestampNano":  parseTimestampNano,
+			"replaceAll":          replaceAll,
 			"sprintf":             fmt.Sprintf,
 			"toInt":               toInt,
 			"urlEncode":           urlEncode,
@@ -426,3 +427,15 @@ func urlEncode(value string) string {
 	}
 	return url.QueryEscape(value)
 }
+
+// replaceAll returns a copy of the string s with all non-overlapping instances
+// of old replaced by new.
+//
+// Note that the order of the arguments differs from Go's [strings.ReplaceAll] to
+// make pipelining more ergonomic. This allows s to be piped in because it is
+// the final argument. For example,
+//
+//   [[ "some value" | replaceAll "some" "my" ]]  // == "my value"
+func replaceAll(old, new, s string) string {
+	return strings.ReplaceAll(s, old, new)
+}

x-pack/filebeat/input/httpjson/value_tpl_test.go

@@ -567,6 +567,13 @@ func TestValueTpl(t *testing.T) {
 			paramTr:     transformable{},
 			expectedVal: "2022-02-17T04%3A37%3A10.406%2B0000",
 		},
+		{
+			name:        "func replaceAll",
+			value:       `[[ "some value" | replaceAll "some" "my" ]]`,
+			paramCtx:    emptyTransformContext(),
+			paramTr:     transformable{},
+			expectedVal: "my value",
+		},
 	}
 
 	for _, tc := range cases {