From d23d6281fcb4e7436e8213346b35249f3d934ba1 Mon Sep 17 00:00:00 2001
From: Dan Kortschak <dan.kortschak@elastic.co>
Date: Fri, 3 Mar 2023 09:43:38 +1030
Subject: [PATCH] add missing import

---
 x-pack/filebeat/input/cel/input.go      |  1 +
 x-pack/filebeat/input/cel/input_test.go | 26 +++++++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/x-pack/filebeat/input/cel/input.go b/x-pack/filebeat/input/cel/input.go
index b9f4a2e868a..c0648bcfa2a 100644
--- a/x-pack/filebeat/input/cel/input.go
+++ b/x-pack/filebeat/input/cel/input.go
@@ -821,6 +821,7 @@ func newProgram(ctx context.Context, src, root string, client *http.Client, limi
 		lib.Collections(),
 		lib.Crypto(),
 		lib.JSON(nil),
+		lib.Strings(),
 		lib.Time(),
 		lib.Try(),
 		lib.File(mimetypes),
diff --git a/x-pack/filebeat/input/cel/input_test.go b/x-pack/filebeat/input/cel/input_test.go
index 0960a97efb9..ea96380fbb1 100644
--- a/x-pack/filebeat/input/cel/input_test.go
+++ b/x-pack/filebeat/input/cel/input_test.go
@@ -294,6 +294,32 @@ int(has(state.cursor) && has(state.cursor.next) ? state.cursor.next : 0).as(inde
 			{"next": 3.0},
 		},
 	},
+	{
+		name: "strings_split",
+		config: map[string]interface{}{
+			"interval": 1,
+			"program": `
+{
+	"events": state.data.split(":").map(s,
+		{
+			"message": s
+		}
+	)
+}
+`,
+			"state": map[string]interface{}{
+				"data": "first:second:third",
+			},
+			"resource": map[string]interface{}{
+				"url": "",
+			},
+		},
+		want: []map[string]interface{}{
+			{"message": "first"},
+			{"message": "second"},
+			{"message": "third"},
+		},
+	},
 
 	// FS-based tests.
 	{