Simulate data ingestion Technical preview
Run ingest pipelines against a set of provided documents, optionally with substitute pipeline definitions, to simulate ingesting data into an index.
This API is meant to be used for troubleshooting or pipeline development, as it does not actually index any data into Elasticsearch.
The API runs the default and final pipeline for that index against a set of documents provided in the body of the request. If a pipeline contains a reroute processor, it follows that reroute processor to the new index, running that index's pipelines as well the same way that a non-simulated ingest would. No data is indexed into Elasticsearch. Instead, the transformed document is returned, along with the list of pipelines that have been run and the name of the index where the document would have been indexed if this were not a simulation. The transformed document is validated against the mappings that would apply to this index, and any validation error is reported in the result.
This API differs from the simulate pipeline API in that you specify a single pipeline for that API, and it runs only that one pipeline. The simulate pipeline API is more useful for developing a single pipeline, while the simulate ingest API is more useful for troubleshooting the interaction of the various pipelines that get applied when ingesting into an index.
By default, the pipeline definitions that are currently in the system are used. However, you can supply substitute pipeline definitions in the body of the request. These will be used in place of the pipeline definitions that are already in the system. This can be used to replace existing pipeline definitions or to create new ones. The pipeline substitutions are used only within this request.
Path parameters
-
The index to simulate ingesting into. This value can be overridden by specifying an index on each document. If you specify this parameter in the request path, it is used for any documents that do not explicitly specify an index argument.
Query parameters
-
pipeline string
The pipeline to use as the default pipeline. This value can be used to override the default pipeline of the index.
Body Required
-
Sample documents to test in the pipeline.
-
A map of component template names to substitute component template definition objects.
Hide component_template_substitutions attribute Show component_template_substitutions attribute object
-
* object
Additional properties are allowed.
Hide * attributes Show * attributes object
-
Additional properties are allowed.
Hide template attributes Show template attributes object
-
_meta object
Hide _meta attribute Show _meta attribute object
-
Additional properties are allowed.
-
-
version number
-
settings object
Hide settings attribute Show settings attribute object
-
Additional properties are allowed.
Hide * attributes Show * attributes object
-
Additional properties are allowed.
-
mode string
routing_path string | array[string]
-
soft_deletes object
Additional properties are allowed.
Hide soft_deletes attributes Show soft_deletes attributes object
-
enabled boolean
Indicates whether soft deletes are enabled on the index.
-
retention_lease object
Additional properties are allowed.
-
-
sort object
Additional properties are allowed.
number_of_shards number | string
number_of_replicas number | string
-
number_of_routing_shards number
-
check_on_startup string
Values are
true
,false
, orchecksum
. -
codec string
routing_partition_size number | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
hidden boolean | string
-
auto_expand_replicas string
-
merge object
Additional properties are allowed.
Hide merge attribute Show merge attribute object
-
scheduler object
Additional properties are allowed.
-
-
search object
Additional properties are allowed.
-
refresh_interval string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
max_result_window number
-
max_inner_result_window number
-
max_rescore_window number
-
max_docvalue_fields_search number
-
max_script_fields number
-
max_ngram_diff number
-
max_shingle_diff number
-
blocks object
Additional properties are allowed.
Hide blocks attributes Show blocks attributes object
-
max_refresh_listeners number
-
analyze object
Additional properties are allowed.
Hide analyze attribute Show analyze attribute object
-
highlight object
Additional properties are allowed.
Hide highlight attribute Show highlight attribute object
-
max_analyzed_offset number
-
-
max_terms_count number
-
max_regex_length number
-
routing object
Additional properties are allowed.
Hide routing attributes Show routing attributes object
-
allocation object
Additional properties are allowed.
-
rebalance object
Additional properties are allowed.
-
-
gc_deletes string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
default_pipeline string
-
final_pipeline string
-
lifecycle object
Additional properties are allowed.
Hide lifecycle attributes Show lifecycle attributes object
-
name string
-
origination_date number
If specified, this is the timestamp used to calculate the index age for its phase transitions. Use this setting if you create a new index that contains old data and want to use the original creation date to calculate the index age. Specified as a Unix epoch value in milliseconds.
-
parse_origination_date boolean
Set to true to parse the origination date from the index name. This origination date is used to calculate the index age for its phase transitions. The index name must match the pattern .*-{date_format}-\d+, where the date_format is yyyy.MM.dd and the trailing digits are optional. An index that was rolled over would normally match the full format, for example logs-2016.10.31-000002). If the index name doesn’t match the pattern, index creation fails.
-
step object
Additional properties are allowed.
-
rollover_alias string
The index alias to update when the index rolls over. Specify when using a policy that contains a rollover action. When the index rolls over, the alias is updated to reflect that the index is no longer the write index. For more information about rolling indices, see Rollover.
-
-
provided_name string
-
creation_date string
-
creation_date_string string
-
uuid string
-
version object
Additional properties are allowed.
Hide version attributes Show version attributes object
-
created string
-
created_string string
-
verified_before_close boolean | string
format string | number
-
max_slices_per_scroll number
-
translog object
Additional properties are allowed.
Hide translog attributes Show translog attributes object
-
sync_interval string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
durability string
Values are
request
,REQUEST
,async
, orASYNC
. -
retention object
Additional properties are allowed.
-
-
query_string object
Additional properties are allowed.
Hide query_string attribute Show query_string attribute object
priority number | string
-
top_metrics_max_size number
-
analysis object
Additional properties are allowed.
Hide analysis attributes Show analysis attributes object
-
analyzer object
-
char_filter object
-
filter object
-
normalizer object
-
tokenizer object
-
-
Additional properties are allowed.
-
time_series object
Additional properties are allowed.
Hide time_series attributes Show time_series attributes object
-
queries object
Additional properties are allowed.
Hide queries attribute Show queries attribute object
-
cache object
Additional properties are allowed.
-
-
similarity object
Configure custom similarity settings to customize how search results are scored.
-
mapping object
Additional properties are allowed.
Hide mapping attributes Show mapping attributes object
-
coerce boolean
-
total_fields object
Additional properties are allowed.
-
depth object
Additional properties are allowed.
-
nested_fields object
Additional properties are allowed.
-
nested_objects object
Additional properties are allowed.
-
field_name_length object
Additional properties are allowed.
-
dimension_fields object
Additional properties are allowed.
-
ignore_malformed boolean
-
-
indexing.slowlog object
Additional properties are allowed.
-
indexing_pressure object
Additional properties are allowed.
Hide indexing_pressure attribute Show indexing_pressure attribute object
-
Additional properties are allowed.
-
-
store object
Additional properties are allowed.
Hide store attributes Show store attributes object
-
allow_mmap boolean
You can restrict the use of the mmapfs and the related hybridfs store type via the setting node.store.allow_mmap. This is a boolean setting indicating whether or not memory-mapping is allowed. The default is to allow it. This setting is useful, for example, if you are in an environment where you can not control the ability to create a lot of memory maps so you need disable the ability to use memory-mapping.
-
-
-
mappings object
Additional properties are allowed.
Hide mappings attributes Show mappings attributes object
-
all_field object
Additional properties are allowed.
Hide all_field attributes Show all_field attributes object
-
date_detection boolean
-
dynamic string
Values are
strict
,runtime
,true
, orfalse
. -
dynamic_date_formats array[string]
-
dynamic_templates array[object]
-
_field_names object
Additional properties are allowed.
Hide _field_names attribute Show _field_names attribute object
-
index_field object
Additional properties are allowed.
Hide index_field attribute Show index_field attribute object
-
_meta object
Hide _meta attribute Show _meta attribute object
-
Additional properties are allowed.
-
-
numeric_detection boolean
-
properties object
-
_routing object
Additional properties are allowed.
Hide _routing attribute Show _routing attribute object
-
_size object
Additional properties are allowed.
Hide _size attribute Show _size attribute object
-
_source object
Additional properties are allowed.
-
runtime object
Hide runtime attribute Show runtime attribute object
-
Additional properties are allowed.
Hide * attributes Show * attributes object
-
fields object
For type
composite
-
fetch_fields array[object]
For type
lookup
-
format string
A custom format for
date
type runtime fields. -
input_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_index string
-
script object
Additional properties are allowed.
-
Values are
boolean
,composite
,date
,double
,geo_point
,ip
,keyword
,long
, orlookup
.
-
-
-
enabled boolean
-
subobjects boolean
-
_data_stream_timestamp object
Additional properties are allowed.
Hide _data_stream_timestamp attribute Show _data_stream_timestamp attribute object
-
-
aliases object
Hide aliases attribute Show aliases attribute object
-
Additional properties are allowed.
Hide * attributes Show * attributes object
-
filter object
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
Additional properties are allowed.
-
index_routing string
Value used to route indexing operations to a specific shard. If specified, this overwrites the
routing
value for indexing operations. -
is_write_index boolean
If
true
, the index is the write index for the alias. -
routing string
Value used to route indexing and search operations to a specific shard.
-
search_routing string
Value used to route search operations to a specific shard. If specified, this overwrites the
routing
value for search operations. -
is_hidden boolean
If
true
, the alias is hidden. All indices for the alias must have the sameis_hidden
value.
-
-
-
lifecycle object
Additional properties are allowed.
Hide lifecycle attributes Show lifecycle attributes object
-
data_retention string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
downsampling object
Additional properties are allowed.
Hide downsampling attribute Show downsampling attribute object
-
The list of downsampling rounds to execute as part of this downsampling configuration
Additional properties are allowed.
-
-
rollover object
Additional properties are allowed.
Hide rollover attributes Show rollover attributes object
-
min_age string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
max_age string
-
min_docs number
-
max_docs number
min_size number | string
max_size number | string
min_primary_shard_size number | string
max_primary_shard_size number | string
-
min_primary_shard_docs number
-
max_primary_shard_docs number
-
-
-
-
version number
-
_meta object
Hide _meta attribute Show _meta attribute object
-
Additional properties are allowed.
-
-
-
-
index_template_subtitutions object
A map of index template names to substitute index template definition objects.
Hide index_template_subtitutions attribute Show index_template_subtitutions attribute object
-
* object
Additional properties are allowed.
Hide * attributes Show * attributes object
-
An ordered list of component template names. Component templates are merged in the order specified, meaning that the last component template specified has the highest precedence.
-
template object
Additional properties are allowed.
Hide template attributes Show template attributes object
-
aliases object
Aliases to add. If the index template includes a
data_stream
object, these are data stream aliases. Otherwise, these are index aliases. Data stream aliases ignore theindex_routing
,routing
, andsearch_routing
options.Hide aliases attribute Show aliases attribute object
-
Additional properties are allowed.
Hide * attributes Show * attributes object
-
filter object
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
Additional properties are allowed.
-
index_routing string
-
is_hidden boolean
If
true
, the alias is hidden. All indices for the alias must have the sameis_hidden
value. -
is_write_index boolean
If
true
, the index is the write index for the alias. -
routing string
-
search_routing string
-
-
-
mappings object
Additional properties are allowed.
Hide mappings attributes Show mappings attributes object
-
all_field object
Additional properties are allowed.
Hide all_field attributes Show all_field attributes object
-
date_detection boolean
-
dynamic string
Values are
strict
,runtime
,true
, orfalse
. -
dynamic_date_formats array[string]
-
dynamic_templates array[object]
-
_field_names object
Additional properties are allowed.
Hide _field_names attribute Show _field_names attribute object
-
index_field object
Additional properties are allowed.
Hide index_field attribute Show index_field attribute object
-
_meta object
Hide _meta attribute Show _meta attribute object
-
Additional properties are allowed.
-
-
numeric_detection boolean
-
properties object
-
_routing object
Additional properties are allowed.
Hide _routing attribute Show _routing attribute object
-
_size object
Additional properties are allowed.
Hide _size attribute Show _size attribute object
-
_source object
Additional properties are allowed.
-
runtime object
Hide runtime attribute Show runtime attribute object
-
Additional properties are allowed.
Hide * attributes Show * attributes object
-
fields object
For type
composite
-
fetch_fields array[object]
For type
lookup
-
format string
A custom format for
date
type runtime fields. -
input_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_index string
-
script object
Additional properties are allowed.
-
Values are
boolean
,composite
,date
,double
,geo_point
,ip
,keyword
,long
, orlookup
.
-
-
-
enabled boolean
-
subobjects boolean
-
_data_stream_timestamp object
Additional properties are allowed.
Hide _data_stream_timestamp attribute Show _data_stream_timestamp attribute object
-
-
Additional properties are allowed.
Hide settings attributes Show settings attributes object
-
Additional properties are allowed.
-
mode string
routing_path string | array[string]
-
soft_deletes object
Additional properties are allowed.
Hide soft_deletes attributes Show soft_deletes attributes object
-
enabled boolean
Indicates whether soft deletes are enabled on the index.
-
retention_lease object
Additional properties are allowed.
Hide retention_lease attribute Show retention_lease attribute object
-
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
-
-
-
sort object
Additional properties are allowed.
Hide sort attributes Show sort attributes object
-
field string | array[string]
-
number_of_shards number | string
number_of_replicas number | string
-
number_of_routing_shards number
-
check_on_startup string
Values are
true
,false
, orchecksum
. -
codec string
routing_partition_size number | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
hidden boolean | string
-
auto_expand_replicas string
-
merge object
Additional properties are allowed.
Hide merge attribute Show merge attribute object
-
scheduler object
Additional properties are allowed.
Hide scheduler attributes Show scheduler attributes object
-
-
search object
Additional properties are allowed.
Hide search attributes Show search attributes object
-
idle object
Additional properties are allowed.
Hide idle attribute Show idle attribute object
-
after string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
-
-
slowlog object
Additional properties are allowed.
-
-
refresh_interval string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
max_result_window number
-
max_inner_result_window number
-
max_rescore_window number
-
max_docvalue_fields_search number
-
max_script_fields number
-
max_ngram_diff number
-
max_shingle_diff number
-
blocks object
Additional properties are allowed.
Hide blocks attributes Show blocks attributes object
read_only boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
read_only_allow_delete boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
read boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
write boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
metadata boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
max_refresh_listeners number
-
analyze object
Additional properties are allowed.
Hide analyze attribute Show analyze attribute object
max_token_count number | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
highlight object
Additional properties are allowed.
Hide highlight attribute Show highlight attribute object
-
max_analyzed_offset number
-
-
max_terms_count number
-
max_regex_length number
-
routing object
Additional properties are allowed.
Hide routing attributes Show routing attributes object
-
allocation object
Additional properties are allowed.
Hide allocation attributes Show allocation attributes object
-
enable string
Values are
all
,primaries
,new_primaries
, ornone
. -
include object
Additional properties are allowed.
-
initial_recovery object
Additional properties are allowed.
-
disk object
Additional properties are allowed.
-
-
rebalance object
Additional properties are allowed.
Hide rebalance attribute Show rebalance attribute object
-
Values are
all
,primaries
,replicas
, ornone
.
-
-
-
gc_deletes string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
default_pipeline string
-
final_pipeline string
-
lifecycle object
Additional properties are allowed.
Hide lifecycle attributes Show lifecycle attributes object
-
name string
indexing_complete boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
origination_date number
If specified, this is the timestamp used to calculate the index age for its phase transitions. Use this setting if you create a new index that contains old data and want to use the original creation date to calculate the index age. Specified as a Unix epoch value in milliseconds.
-
parse_origination_date boolean
Set to true to parse the origination date from the index name. This origination date is used to calculate the index age for its phase transitions. The index name must match the pattern .*-{date_format}-\d+, where the date_format is yyyy.MM.dd and the trailing digits are optional. An index that was rolled over would normally match the full format, for example logs-2016.10.31-000002). If the index name doesn’t match the pattern, index creation fails.
-
step object
Additional properties are allowed.
Hide step attribute Show step attribute object
-
wait_time_threshold string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
-
-
rollover_alias string
The index alias to update when the index rolls over. Specify when using a policy that contains a rollover action. When the index rolls over, the alias is updated to reflect that the index is no longer the write index. For more information about rolling indices, see Rollover.
-
-
provided_name string
creation_date number | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
One of: Time unit for milliseconds
creation_date_string string | number
A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.
One of: Time unit for milliseconds
-
uuid string
-
version object
Additional properties are allowed.
Hide version attributes Show version attributes object
-
created string
-
created_string string
-
verified_before_close boolean | string
format string | number
-
max_slices_per_scroll number
-
translog object
Additional properties are allowed.
Hide translog attributes Show translog attributes object
-
sync_interval string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
durability string
Values are
request
,REQUEST
,async
, orASYNC
. flush_threshold_size number | string
-
retention object
Additional properties are allowed.
-
-
query_string object
Additional properties are allowed.
Hide query_string attribute Show query_string attribute object
lenient boolean | string Required
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
priority number | string
-
top_metrics_max_size number
-
analysis object
Additional properties are allowed.
Hide analysis attributes Show analysis attributes object
-
analyzer object
-
char_filter object
-
filter object
-
normalizer object
-
tokenizer object
-
-
Additional properties are allowed.
-
time_series object
Additional properties are allowed.
Hide time_series attributes Show time_series attributes object
-
end_time string
-
start_time string
-
-
queries object
Additional properties are allowed.
-
similarity object
Configure custom similarity settings to customize how search results are scored.
-
mapping object
Additional properties are allowed.
Hide mapping attributes Show mapping attributes object
-
coerce boolean
-
total_fields object
Additional properties are allowed.
Hide total_fields attributes Show total_fields attributes object
-
depth object
Additional properties are allowed.
Hide depth attribute Show depth attribute object
-
limit number
The maximum depth for a field, which is measured as the number of inner objects. For instance, if all fields are defined at the root object level, then the depth is 1. If there is one object mapping, then the depth is 2, etc.
-
-
nested_fields object
Additional properties are allowed.
Hide nested_fields attribute Show nested_fields attribute object
-
limit number
The maximum number of distinct nested mappings in an index. The nested type should only be used in special cases, when arrays of objects need to be queried independently of each other. To safeguard against poorly designed mappings, this setting limits the number of unique nested types per index.
-
-
nested_objects object
Additional properties are allowed.
Hide nested_objects attribute Show nested_objects attribute object
-
limit number
The maximum number of nested JSON objects that a single document can contain across all nested types. This limit helps to prevent out of memory errors when a document contains too many nested objects.
-
-
field_name_length object
Additional properties are allowed.
Hide field_name_length attribute Show field_name_length attribute object
-
limit number
Setting for the maximum length of a field name. This setting isn’t really something that addresses mappings explosion but might still be useful if you want to limit the field length. It usually shouldn’t be necessary to set this setting. The default is okay unless a user starts to add a huge number of fields with really long names. Default is
Long.MAX_VALUE
(no limit).
-
-
dimension_fields object
Additional properties are allowed.
Hide dimension_fields attribute Show dimension_fields attribute object
-
limit number
[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
-
-
ignore_malformed boolean
-
-
indexing.slowlog object
Additional properties are allowed.
-
indexing_pressure object
Additional properties are allowed.
Hide indexing_pressure attribute Show indexing_pressure attribute object
-
Additional properties are allowed.
Hide memory attribute Show memory attribute object
-
limit number
Number of outstanding bytes that may be consumed by indexing requests. When this limit is reached or exceeded, the node will reject new coordinating and primary operations. When replica operations consume 1.5x this limit, the node will reject new replica operations. Defaults to 10% of the heap.
-
-
-
store object
Additional properties are allowed.
Hide store attributes Show store attributes object
-
allow_mmap boolean
You can restrict the use of the mmapfs and the related hybridfs store type via the setting node.store.allow_mmap. This is a boolean setting indicating whether or not memory-mapping is allowed. The default is to allow it. This setting is useful, for example, if you are in an environment where you can not control the ability to create a lot of memory maps so you need disable the ability to use memory-mapping.
-
-
lifecycle object
Additional properties are allowed.
Hide lifecycle attributes Show lifecycle attributes object
-
data_retention string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
downsampling object
Additional properties are allowed.
Hide downsampling attribute Show downsampling attribute object
-
The list of downsampling rounds to execute as part of this downsampling configuration
Additional properties are allowed.
-
-
rollover object
Additional properties are allowed.
Hide rollover attributes Show rollover attributes object
-
min_age string
A duration. Units can be
nanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. -
max_age string
-
min_docs number
-
max_docs number
min_size number | string
max_size number | string
min_primary_shard_size number | string
max_primary_shard_size number | string
-
min_primary_shard_docs number
-
max_primary_shard_docs number
-
-
-
-
version number
-
priority number
Priority to determine index template precedence when a new data stream or index is created. The index template with the highest priority is chosen. If no priority is specified the template is treated as though it is of priority 0 (lowest priority). This number is not automatically generated by Elasticsearch.
-
_meta object
Hide _meta attribute Show _meta attribute object
-
Additional properties are allowed.
-
-
allow_auto_create boolean
-
data_stream object
Additional properties are allowed.
Hide data_stream attributes Show data_stream attributes object
-
hidden boolean
If true, the data stream is hidden.
-
allow_custom_routing boolean
If true, the data stream supports custom routing.
-
-
deprecated boolean
Marks this index template as deprecated. When creating or updating a non-deprecated index template that uses deprecated components, Elasticsearch will emit a deprecation warning.
-
ignore_missing_component_templates string | array[string]
-
-
mapping_addition object
Additional properties are allowed.
Hide mapping_addition attributes Show mapping_addition attributes object
-
all_field object
Additional properties are allowed.
Hide all_field attributes Show all_field attributes object
-
date_detection boolean
-
dynamic string
Values are
strict
,runtime
,true
, orfalse
. -
dynamic_date_formats array[string]
-
dynamic_templates array[object]
-
_field_names object
Additional properties are allowed.
Hide _field_names attribute Show _field_names attribute object
-
index_field object
Additional properties are allowed.
Hide index_field attribute Show index_field attribute object
-
_meta object
Hide _meta attribute Show _meta attribute object
-
Additional properties are allowed.
-
-
numeric_detection boolean
-
properties object
-
_routing object
Additional properties are allowed.
Hide _routing attribute Show _routing attribute object
-
_size object
Additional properties are allowed.
Hide _size attribute Show _size attribute object
-
_source object
Additional properties are allowed.
-
runtime object
Hide runtime attribute Show runtime attribute object
-
Additional properties are allowed.
Hide * attributes Show * attributes object
-
fields object
For type
composite
-
fetch_fields array[object]
For type
lookup
-
format string
A custom format for
date
type runtime fields. -
input_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_index string
-
script object
Additional properties are allowed.
Hide script attributes Show script attributes object
-
source string
The script source.
-
id string
-
params object
Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
Hide params attribute Show params attribute object
-
Additional properties are allowed.
-
-
options object
Hide options attribute Show options attribute object
-
-
Values are
boolean
,composite
,date
,double
,geo_point
,ip
,keyword
,long
, orlookup
.
-
-
-
enabled boolean
-
subobjects boolean
-
_data_stream_timestamp object
Additional properties are allowed.
Hide _data_stream_timestamp attribute Show _data_stream_timestamp attribute object
-
-
pipeline_substitutions object
Pipelines to test. If you don’t specify the
pipeline
request path parameter, this parameter is required. If you specify both this and the request path parameter, the API only uses the request path parameter.Hide pipeline_substitutions attribute Show pipeline_substitutions attribute object
-
Additional properties are allowed.
Hide * attributes Show * attributes object
-
description string
Description of the ingest pipeline.
-
on_failure array[object]
Processors to run immediately after a processor failure.
Hide on_failure attributes Show on_failure attributes object
-
append object
Additional properties are allowed.
Hide append attributes Show append attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
allow_duplicates boolean
If
false
, the processor does not append values already present in the field.
-
-
attachment object
Additional properties are allowed.
Hide attachment attributes Show attachment attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
and field does not exist, the processor quietly exits without modifying the document. -
indexed_chars number
The number of chars being used for extraction to prevent huge fields. Use
-1
for no limit. -
indexed_chars_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
properties array[string]
Array of properties to select to be stored. Can be
content
,title
,name
,author
,keywords
,date
,content_type
,content_length
,language
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
remove_binary boolean
If true, the binary field will be removed from the document
-
resource_name string
Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
-
-
bytes object
Additional properties are allowed.
Hide bytes attributes Show bytes attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
circle object
Additional properties are allowed.
Hide circle attributes Show circle attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for
geo_shape
, unit-less forshape
). -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
Values are
geo_shape
orshape
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
community_id object
Additional properties are allowed.
Hide community_id attributes Show community_id attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
source_ip string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
source_port string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
destination_ip string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
destination_port string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
iana_number string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
icmp_type string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
icmp_code string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
transport string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
seed number
Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
-
ignore_missing boolean
If true and any required fields are missing, the processor quietly exits without modifying the document.
-
-
convert object
Additional properties are allowed.
Hide convert attributes Show convert attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Values are
integer
,long
,double
,float
,boolean
,ip
,string
, orauto
.
-
-
csv object
Additional properties are allowed.
Hide csv attributes Show csv attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
empty_value object
Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes (
""
).Additional properties are allowed.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
quote string
Quote used in CSV, has to be single character string.
-
separator string
Separator used in CSV, has to be single character string.
-
trim boolean
Trim whitespaces in unquoted fields.
-
-
date object
Additional properties are allowed.
Hide date attributes Show date attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
-
locale string
The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
timezone string
The timezone to use when parsing the date. Supports template snippets.
-
output_format string
The format to use when writing the date to target_field. Must be a valid java time pattern.
-
-
date_index_name object
Additional properties are allowed.
Hide date_index_name attributes Show date_index_name attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
-
How to round the date when formatting the date into the index name. Valid values are:
y
(year),M
(month),w
(week),d
(day),h
(hour),m
(minute) ands
(second). Supports template snippets. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
index_name_format string
The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
-
index_name_prefix string
A prefix of the index name to be prepended before the printed date. Supports template snippets.
-
locale string
The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
-
timezone string
The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
-
-
dissect object
Additional properties are allowed.
Hide dissect attributes Show dissect attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
append_separator string
The character(s) that separate the appended fields.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
The pattern to apply to the field.
-
-
dot_expander object
Additional properties are allowed.
Hide dot_expander attributes Show dot_expander attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
override boolean
Controls the behavior when there is already an existing nested object that conflicts with the expanded field. When
false
, the processor will merge conflicts by combining the old and the new values into an array. Whentrue
, the value from the expanded field will overwrite the existing value. -
path string
The field that contains the field to expand. Only required if the field to expand is part another object field, because the
field
option can only understand leaf fields.
-
-
drop object
Additional properties are allowed.
Hide drop attributes Show drop attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
-
enrich object
Additional properties are allowed.
Hide enrich attributes Show enrich attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
max_matches number
The maximum number of matched documents to include under the configured target field. The
target_field
will be turned into a json array ifmax_matches
is higher than 1, otherwisetarget_field
will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128. -
override boolean
If processor will update fields with pre-existing non-null-valued field. When set to
false
, such fields will not be touched. -
The name of the enrich policy to use.
-
shape_relation string
Values are
intersects
,disjoint
,within
, orcontains
. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
fail object
Additional properties are allowed.
Hide fail attributes Show fail attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
The error message thrown by the processor. Supports template snippets.
-
-
fingerprint object
Additional properties are allowed.
Hide fingerprint attributes Show fingerprint attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
salt string
Salt value for the hash function.
-
method string
Values are
MD5
,SHA-1
,SHA-256
,SHA-512
, orMurmurHash3
. -
ignore_missing boolean
If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
-
-
foreach object
Additional properties are allowed.
Hide foreach attributes Show foreach attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
, the processor silently exits without changing the document if thefield
isnull
or missing. -
Additional properties are allowed.
-
-
ip_location object
Additional properties are allowed.
Hide ip_location attributes Show ip_location attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
database_file string
The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
first_only boolean
If
true
, only the first found IP location data will be returned, even if the field contains an array. -
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
properties array[string]
Controls what properties are added to the
target_field
based on the IP location lookup. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
If
true
(and ifingest.geoip.downloader.eager.download
isfalse
), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as thedefault_pipeline
orfinal_pipeline
in an index.
-
-
geo_grid object
Additional properties are allowed.
Hide geo_grid attributes Show geo_grid attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
The field to interpret as a geo-tile.= The field format is determined by the
tile_type
. -
Values are
geotile
,geohex
, orgeohash
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
parent_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
children_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
non_children_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
precision_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
target_format string
Values are
geojson
orwkt
.
-
-
geoip object
Additional properties are allowed.
Hide geoip attributes Show geoip attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
database_file string
The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
first_only boolean
If
true
, only the first found geoip data will be returned, even if the field contains an array. -
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
properties array[string]
Controls what properties are added to the
target_field
based on the geoip lookup. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
If
true
(and ifingest.geoip.downloader.eager.download
isfalse
), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as thedefault_pipeline
orfinal_pipeline
in an index.
-
-
grok object
Additional properties are allowed.
Hide grok attributes Show grok attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
ecs_compatibility string
Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
pattern_definitions object
A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
-
An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
-
trace_match boolean
When
true
,_ingest._grok_match_index
will be inserted into your matched document’s metadata with the index into the pattern found inpatterns
that matched.
-
-
gsub object
Additional properties are allowed.
Hide gsub attributes Show gsub attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
The pattern to be replaced.
-
The string to replace the matching patterns with.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
html_strip object
Additional properties are allowed.
Hide html_strip attributes Show html_strip attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document, -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
inference object
Additional properties are allowed.
Hide inference attributes Show inference attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
field_map object
Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
-
inference_config object
Additional properties are allowed.
-
-
join object
Additional properties are allowed.
Hide join attributes Show join attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
The separator character.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
json object
Additional properties are allowed.
Hide json attributes Show json attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
add_to_root boolean
Flag that forces the parsed JSON to be added at the top level of the document.
target_field
must not be set when this option is chosen. -
Values are
replace
ormerge
. -
allow_duplicate_keys boolean
When set to
true
, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
kv object
Additional properties are allowed.
Hide kv attributes Show kv attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
exclude_keys array[string]
List of keys to exclude from document.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Regex pattern to use for splitting key-value pairs.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
include_keys array[string]
List of keys to filter and insert into document. Defaults to including all keys.
-
prefix string
Prefix to be added to extracted keys.
-
strip_brackets boolean
If
true
. strip brackets()
,<>
,[]
as well as quotes'
and"
from extracted values. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
trim_key string
String of characters to trim from extracted keys.
-
trim_value string
String of characters to trim from extracted values.
-
Regex pattern to use for splitting the key from the value within a key-value pair.
-
-
lowercase object
Additional properties are allowed.
Hide lowercase attributes Show lowercase attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
network_direction object
Additional properties are allowed.
Hide network_direction attributes Show network_direction attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
source_ip string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
destination_ip string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
internal_networks array[string]
List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
-
internal_networks_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If true and any required fields are missing, the processor quietly exits without modifying the document.
-
-
pipeline object
Additional properties are allowed.
Hide pipeline attributes Show pipeline attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
ignore_missing_pipeline boolean
Whether to ignore missing pipelines instead of failing.
-
-
redact object
Additional properties are allowed.
Hide redact attributes Show redact attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
A list of grok expressions to match and redact named captures with
-
pattern_definitions object
-
prefix string
Start a redacted section with this token
-
suffix string
End a redacted section with this token
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
skip_if_unlicensed boolean
If
true
and the current license does not support running redact processors, then the processor quietly exits without modifying the document -
trace_redact boolean
If
true
then ingest metadata_ingest._redact._is_redacted
is set totrue
if the document has been redacted
-
-
registered_domain object
Additional properties are allowed.
Hide registered_domain attributes Show registered_domain attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If true and any required fields are missing, the processor quietly exits without modifying the document.
-
-
remove object
Additional properties are allowed.
Hide remove attributes Show remove attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
keep string | array[string]
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
-
-
rename object
Additional properties are allowed.
Hide rename attributes Show rename attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
reroute object
Additional properties are allowed.
Hide reroute attributes Show reroute attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
destination string
A static value for the target. Can’t be set when the dataset or namespace option is set.
-
-
script object
Additional properties are allowed.
Hide script attributes Show script attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
id string
-
lang string
Script language.
-
params object
Object containing parameters for the script.
-
source string
Inline script. If no
id
is specified, this parameter is required.
-
-
set object
Additional properties are allowed.
Hide set attributes Show set attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
copy_from string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_empty_value boolean
If
true
andvalue
is a template snippet that evaluates tonull
or the empty string, the processor quietly exits without modifying the document. -
media_type string
The media type for encoding
value
. Applies only when value is a template snippet. Must be one ofapplication/json
,text/plain
, orapplication/x-www-form-urlencoded
. -
override boolean
If
true
processor will update fields with pre-existing non-null-valued field. When set tofalse
, such fields will not be touched. -
value object
The value to be set for the field. Supports template snippets. May specify only one of
value
orcopy_from
.Additional properties are allowed.
-
-
set_security_user object
Additional properties are allowed.
Hide set_security_user attributes Show set_security_user attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
properties array[string]
Controls what user related properties are added to the field.
-
-
sort object
Additional properties are allowed.
Hide sort attributes Show sort attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
order string
Values are
asc
ordesc
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
split object
Additional properties are allowed.
Hide split attributes Show split attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
preserve_trailing boolean
Preserves empty trailing fields, if any.
-
A regex which matches the separator, for example,
,
or\s+
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
terminate object
Additional properties are allowed.
Hide terminate attributes Show terminate attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
-
trim object
Additional properties are allowed.
Hide trim attributes Show trim attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
uppercase object
Additional properties are allowed.
Hide uppercase attributes Show uppercase attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
urldecode object
Additional properties are allowed.
Hide urldecode attributes Show urldecode attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
uri_parts object
Additional properties are allowed.
Hide uri_parts attributes Show uri_parts attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
keep_original boolean
If
true
, the processor copies the unparsed URI to<target_field>.original
. -
remove_if_successful boolean
If
true
, the processor removes thefield
after parsing the URI string. If parsing fails, the processor does not remove thefield
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
user_agent object
Additional properties are allowed.
Hide user_agent attributes Show user_agent attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
regex_file string
The name of the file in the
config/ingest-user-agent
directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use theregexes.yaml
from uap-core it ships with. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
properties array[string]
Controls what properties are added to
target_field
.Values are
name
,os
,device
,original
, orversion
. -
Extracts device type from the user agent string on a best-effort basis.
-
-
-
processors array[object]
Processors used to perform transformations on documents before indexing. Processors run sequentially in the order specified.
Hide processors attributes Show processors attributes object
-
append object
Additional properties are allowed.
Hide append attributes Show append attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
allow_duplicates boolean
If
false
, the processor does not append values already present in the field.
-
-
attachment object
Additional properties are allowed.
Hide attachment attributes Show attachment attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
and field does not exist, the processor quietly exits without modifying the document. -
indexed_chars number
The number of chars being used for extraction to prevent huge fields. Use
-1
for no limit. -
indexed_chars_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
properties array[string]
Array of properties to select to be stored. Can be
content
,title
,name
,author
,keywords
,date
,content_type
,content_length
,language
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
remove_binary boolean
If true, the binary field will be removed from the document
-
resource_name string
Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
-
-
bytes object
Additional properties are allowed.
Hide bytes attributes Show bytes attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
circle object
Additional properties are allowed.
Hide circle attributes Show circle attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for
geo_shape
, unit-less forshape
). -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
Values are
geo_shape
orshape
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
community_id object
Additional properties are allowed.
Hide community_id attributes Show community_id attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
source_ip string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
source_port string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
destination_ip string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
destination_port string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
iana_number string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
icmp_type string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
icmp_code string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
transport string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
seed number
Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
-
ignore_missing boolean
If true and any required fields are missing, the processor quietly exits without modifying the document.
-
-
convert object
Additional properties are allowed.
Hide convert attributes Show convert attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Values are
integer
,long
,double
,float
,boolean
,ip
,string
, orauto
.
-
-
csv object
Additional properties are allowed.
Hide csv attributes Show csv attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
empty_value object
Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes (
""
).Additional properties are allowed.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
quote string
Quote used in CSV, has to be single character string.
-
separator string
Separator used in CSV, has to be single character string.
-
trim boolean
Trim whitespaces in unquoted fields.
-
-
date object
Additional properties are allowed.
Hide date attributes Show date attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
-
locale string
The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
timezone string
The timezone to use when parsing the date. Supports template snippets.
-
output_format string
The format to use when writing the date to target_field. Must be a valid java time pattern.
-
-
date_index_name object
Additional properties are allowed.
Hide date_index_name attributes Show date_index_name attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
-
How to round the date when formatting the date into the index name. Valid values are:
y
(year),M
(month),w
(week),d
(day),h
(hour),m
(minute) ands
(second). Supports template snippets. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
index_name_format string
The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
-
index_name_prefix string
A prefix of the index name to be prepended before the printed date. Supports template snippets.
-
locale string
The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
-
timezone string
The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
-
-
dissect object
Additional properties are allowed.
Hide dissect attributes Show dissect attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
append_separator string
The character(s) that separate the appended fields.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
The pattern to apply to the field.
-
-
dot_expander object
Additional properties are allowed.
Hide dot_expander attributes Show dot_expander attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
override boolean
Controls the behavior when there is already an existing nested object that conflicts with the expanded field. When
false
, the processor will merge conflicts by combining the old and the new values into an array. Whentrue
, the value from the expanded field will overwrite the existing value. -
path string
The field that contains the field to expand. Only required if the field to expand is part another object field, because the
field
option can only understand leaf fields.
-
-
drop object
Additional properties are allowed.
Hide drop attributes Show drop attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
-
enrich object
Additional properties are allowed.
Hide enrich attributes Show enrich attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
max_matches number
The maximum number of matched documents to include under the configured target field. The
target_field
will be turned into a json array ifmax_matches
is higher than 1, otherwisetarget_field
will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128. -
override boolean
If processor will update fields with pre-existing non-null-valued field. When set to
false
, such fields will not be touched. -
The name of the enrich policy to use.
-
shape_relation string
Values are
intersects
,disjoint
,within
, orcontains
. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
fail object
Additional properties are allowed.
Hide fail attributes Show fail attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
The error message thrown by the processor. Supports template snippets.
-
-
fingerprint object
Additional properties are allowed.
Hide fingerprint attributes Show fingerprint attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
salt string
Salt value for the hash function.
-
method string
Values are
MD5
,SHA-1
,SHA-256
,SHA-512
, orMurmurHash3
. -
ignore_missing boolean
If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
-
-
foreach object
Additional properties are allowed.
Hide foreach attributes Show foreach attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
, the processor silently exits without changing the document if thefield
isnull
or missing. -
Additional properties are allowed.
-
-
ip_location object
Additional properties are allowed.
Hide ip_location attributes Show ip_location attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
database_file string
The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
first_only boolean
If
true
, only the first found IP location data will be returned, even if the field contains an array. -
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
properties array[string]
Controls what properties are added to the
target_field
based on the IP location lookup. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
If
true
(and ifingest.geoip.downloader.eager.download
isfalse
), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as thedefault_pipeline
orfinal_pipeline
in an index.
-
-
geo_grid object
Additional properties are allowed.
Hide geo_grid attributes Show geo_grid attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
The field to interpret as a geo-tile.= The field format is determined by the
tile_type
. -
Values are
geotile
,geohex
, orgeohash
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
parent_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
children_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
non_children_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
precision_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
target_format string
Values are
geojson
orwkt
.
-
-
geoip object
Additional properties are allowed.
Hide geoip attributes Show geoip attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
database_file string
The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
first_only boolean
If
true
, only the first found geoip data will be returned, even if the field contains an array. -
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
properties array[string]
Controls what properties are added to the
target_field
based on the geoip lookup. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
If
true
(and ifingest.geoip.downloader.eager.download
isfalse
), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as thedefault_pipeline
orfinal_pipeline
in an index.
-
-
grok object
Additional properties are allowed.
Hide grok attributes Show grok attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
ecs_compatibility string
Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
pattern_definitions object
A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
-
An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
-
trace_match boolean
When
true
,_ingest._grok_match_index
will be inserted into your matched document’s metadata with the index into the pattern found inpatterns
that matched.
-
-
gsub object
Additional properties are allowed.
Hide gsub attributes Show gsub attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
The pattern to be replaced.
-
The string to replace the matching patterns with.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
html_strip object
Additional properties are allowed.
Hide html_strip attributes Show html_strip attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document, -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
inference object
Additional properties are allowed.
Hide inference attributes Show inference attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
field_map object
Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
-
inference_config object
Additional properties are allowed.
-
-
join object
Additional properties are allowed.
Hide join attributes Show join attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
The separator character.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
json object
Additional properties are allowed.
Hide json attributes Show json attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
add_to_root boolean
Flag that forces the parsed JSON to be added at the top level of the document.
target_field
must not be set when this option is chosen. -
Values are
replace
ormerge
. -
allow_duplicate_keys boolean
When set to
true
, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
kv object
Additional properties are allowed.
Hide kv attributes Show kv attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
exclude_keys array[string]
List of keys to exclude from document.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Regex pattern to use for splitting key-value pairs.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
include_keys array[string]
List of keys to filter and insert into document. Defaults to including all keys.
-
prefix string
Prefix to be added to extracted keys.
-
strip_brackets boolean
If
true
. strip brackets()
,<>
,[]
as well as quotes'
and"
from extracted values. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
trim_key string
String of characters to trim from extracted keys.
-
trim_value string
String of characters to trim from extracted values.
-
Regex pattern to use for splitting the key from the value within a key-value pair.
-
-
lowercase object
Additional properties are allowed.
Hide lowercase attributes Show lowercase attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
network_direction object
Additional properties are allowed.
Hide network_direction attributes Show network_direction attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
source_ip string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
destination_ip string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
internal_networks array[string]
List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
-
internal_networks_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If true and any required fields are missing, the processor quietly exits without modifying the document.
-
-
pipeline object
Additional properties are allowed.
Hide pipeline attributes Show pipeline attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
ignore_missing_pipeline boolean
Whether to ignore missing pipelines instead of failing.
-
-
redact object
Additional properties are allowed.
Hide redact attributes Show redact attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
A list of grok expressions to match and redact named captures with
-
pattern_definitions object
-
prefix string
Start a redacted section with this token
-
suffix string
End a redacted section with this token
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
skip_if_unlicensed boolean
If
true
and the current license does not support running redact processors, then the processor quietly exits without modifying the document -
trace_redact boolean
If
true
then ingest metadata_ingest._redact._is_redacted
is set totrue
if the document has been redacted
-
-
registered_domain object
Additional properties are allowed.
Hide registered_domain attributes Show registered_domain attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If true and any required fields are missing, the processor quietly exits without modifying the document.
-
-
remove object
Additional properties are allowed.
Hide remove attributes Show remove attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
keep string | array[string]
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
-
-
rename object
Additional properties are allowed.
Hide rename attributes Show rename attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
reroute object
Additional properties are allowed.
Hide reroute attributes Show reroute attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
destination string
A static value for the target. Can’t be set when the dataset or namespace option is set.
-
-
script object
Additional properties are allowed.
Hide script attributes Show script attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
id string
-
lang string
Script language.
-
params object
Object containing parameters for the script.
-
source string
Inline script. If no
id
is specified, this parameter is required.
-
-
set object
Additional properties are allowed.
Hide set attributes Show set attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
copy_from string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_empty_value boolean
If
true
andvalue
is a template snippet that evaluates tonull
or the empty string, the processor quietly exits without modifying the document. -
media_type string
The media type for encoding
value
. Applies only when value is a template snippet. Must be one ofapplication/json
,text/plain
, orapplication/x-www-form-urlencoded
. -
override boolean
If
true
processor will update fields with pre-existing non-null-valued field. When set tofalse
, such fields will not be touched. -
value object
The value to be set for the field. Supports template snippets. May specify only one of
value
orcopy_from
.Additional properties are allowed.
-
-
set_security_user object
Additional properties are allowed.
Hide set_security_user attributes Show set_security_user attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
properties array[string]
Controls what user related properties are added to the field.
-
-
sort object
Additional properties are allowed.
Hide sort attributes Show sort attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
order string
Values are
asc
ordesc
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
split object
Additional properties are allowed.
Hide split attributes Show split attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
preserve_trailing boolean
Preserves empty trailing fields, if any.
-
A regex which matches the separator, for example,
,
or\s+
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
terminate object
Additional properties are allowed.
Hide terminate attributes Show terminate attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
-
trim object
Additional properties are allowed.
Hide trim attributes Show trim attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
uppercase object
Additional properties are allowed.
Hide uppercase attributes Show uppercase attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
urldecode object
Additional properties are allowed.
Hide urldecode attributes Show urldecode attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist or isnull
, the processor quietly exits without modifying the document. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
uri_parts object
Additional properties are allowed.
Hide uri_parts attributes Show uri_parts attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
keep_original boolean
If
true
, the processor copies the unparsed URI to<target_field>.original
. -
remove_if_successful boolean
If
true
, the processor removes thefield
after parsing the URI string. If parsing fails, the processor does not remove thefield
. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
-
user_agent object
Additional properties are allowed.
Hide user_agent attributes Show user_agent attributes object
-
description string
Description of the processor. Useful for describing the purpose of the processor or its configuration.
-
if string
Conditionally execute the processor.
-
ignore_failure boolean
Ignore failures for the processor.
-
on_failure array[object]
Handle failures for the processor.
-
tag string
Identifier for the processor. Useful for debugging and metrics.
-
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
ignore_missing boolean
If
true
andfield
does not exist, the processor quietly exits without modifying the document. -
regex_file string
The name of the file in the
config/ingest-user-agent
directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use theregexes.yaml
from uap-core it ships with. -
target_field string
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
-
properties array[string]
Controls what properties are added to
target_field
.Values are
name
,os
,device
,original
, orversion
. -
Extracts device type from the user agent string on a best-effort basis.
-
-
-
version number
-
deprecated boolean
Marks this ingest pipeline as deprecated. When a deprecated ingest pipeline is referenced as the default or final pipeline when creating or updating a non-deprecated index template, Elasticsearch will emit a deprecation warning.
-
_meta object
Hide _meta attribute Show _meta attribute object
-
Additional properties are allowed.
-
-
-
Responses
-
200 application/json
Hide response attribute Show response attribute object
-
Hide docs attributes Show docs attributes object
-
doc object
Additional properties are allowed.
Hide doc attributes Show doc attributes object
-
Additional properties are allowed.
Hide _ingest attributes Show _ingest attributes object
-
_routing string
Value used to send the document to a specific primary shard.
-
JSON body for the document.
Hide _source attribute Show _source attribute object
-
Additional properties are allowed.
-
_version number | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
-
_version_type string
Values are
internal
,external
,external_gte
, orforce
.
-
error object
Additional properties are allowed.
Hide error attributes Show error attributes object
-
The type of error
-
reason string
A human-readable explanation of the error, in English.
-
stack_trace string
The server stack trace. Present only if the
error_trace=true
parameter was sent with the request. -
caused_by object
Additional properties are allowed.
-
root_cause array[object]
Additional properties are allowed.
-
suppressed array[object]
Additional properties are allowed.
-
-
processor_results array[object]
Hide processor_results attributes Show processor_results attributes object
-
doc object
Additional properties are allowed.
Hide doc attributes Show doc attributes object
-
Additional properties are allowed.
-
_routing string
Value used to send the document to a specific primary shard.
-
JSON body for the document.
-
_version_type string
Values are
internal
,external
,external_gte
, orforce
.
-
tag string
-
processor_type string
-
status string
Values are
success
,failure
,simulated
, orthrottled
. -
description string
-
ignored_error object
Additional properties are allowed.
Hide ignored_error attributes Show ignored_error attributes object
-
The type of error
-
reason string
A human-readable explanation of the error, in English.
-
stack_trace string
The server stack trace. Present only if the
error_trace=true
parameter was sent with the request. -
caused_by object
Additional properties are allowed.
-
root_cause array[object]
-
suppressed array[object]
-
-
error object
Additional properties are allowed.
Hide error attributes Show error attributes object
-
The type of error
-
reason string
A human-readable explanation of the error, in English.
-
stack_trace string
The server stack trace. Present only if the
error_trace=true
parameter was sent with the request. -
caused_by object
Additional properties are allowed.
-
root_cause array[object]
-
suppressed array[object]
-
-
-
-
curl \
-X GET http://api.example.com/_ingest/{index}/_simulate \
-H "Content-Type: application/json" \
-d '{"docs":[{"_id":123,"_index":"my-index","_source":{"foo":"bar"}},{"_id":456,"_index":"my-index","_source":{"foo":"rab"}}]}'
{
"docs": [
{
"_id": 123,
"_index": "my-index",
"_source": {
"foo": "bar"
}
},
{
"_id": 456,
"_index": "my-index",
"_source": {
"foo": "rab"
}
}
]
}
{
"docs": [
{
"_id": 123,
"_index": "my-index",
"_source": {
"foo": "bar"
}
},
{
"_id": 456,
"_index": "my-index",
"_source": {
"foo": "rab"
}
}
],
"pipeline_substitutions": {
"my-pipeline": {
"processors": [
{
"uppercase": {
"field": "foo"
}
}
]
}
}
}
{
"docs": [
{
"_index": "my-index",
"_id": "123",
"_source": {
"foo": "foo"
}
},
{
"_index": "my-index",
"_id": "456",
"_source": {
"bar": "rab"
}
}
],
"component_template_substitutions": {
"my-mappings_template": {
"template": {
"mappings": {
"dynamic": "strict",
"properties": {
"foo": {
"type": "keyword"
},
"bar": {
"type": "keyword"
}
}
}
}
}
}
}
{
"docs": [
{
"_id": "id",
"_index": "my-index",
"_source": {
"foo": "bar"
}
},
{
"_id": "id",
"_index": "my-index",
"_source": {
"foo": "rab"
}
}
],
"mapping_addition": {
"dynamic": "strict",
"properties": {
"foo": {
"type": "keyword"
}
}
},
"pipeline_substitutions": {
"my-pipeline": {
"processors": [
{
"set": {
"field": "field3",
"value": "value3"
}
}
]
}
},
"index_template_substitutions": {
"my-index-template": {
"composed_of": [
"component_template_1",
"component_template_2"
],
"index_patterns": [
"my-index-*"
]
}
},
"component_template_substitutions": {
"my-component-template": {
"template": {
"mappings": {
"dynamic": true,
"properties": {
"field3": {
"type": "keyword"
}
}
},
"settings": {
"index": {
"default_pipeline": "my-pipeline"
}
}
}
}
}
}
{
"docs": [
{
"_id": 123,
"doc": null,
"_index": "my-index",
"_source": {
"foo": "bar",
"field1": "value1",
"field2": "value2"
},
"_version": -3,
"executed_pipelines": [
"my-pipeline",
"my-final-pipeline"
]
},
{
"_id": 456,
"doc": null,
"_index": "my-index",
"_source": {
"foo": "rab",
"field1": "value1",
"field2": "value2"
},
"_version": "-3,",
"executed_pipelines": [
"my-pipeline",
"my-final-pipeline"
]
}
]
}
{
"docs": [
{
"_id": 123,
"doc": null,
"_index": "my-index",
"_source": {
"foo": "BAR",
"field2": "value2"
},
"_version": -3,
"executed_pipelines": [
"my-pipeline",
"my-final-pipeline"
]
},
{
"_id": 456,
"doc": null,
"_index": "my-index",
"_source": {
"foo": "RAB",
"field2": "value2"
},
"_version": -3,
"executed_pipelines": [
"my-pipeline",
"my-final-pipeline"
]
}
]
}
{
"docs": [
{
"doc": {
"_id": "123",
"_index": "my-index",
"_version": -3,
"_source": {
"foo": "foo"
},
"executed_pipelines": []
}
},
{
"doc": {
"_id": "456",
"_index": "my-index",
"_version": -3,
"_source": {
"bar": "rab"
},
"executed_pipelines": []
}
}
]
}