Using ingest processors in Painless

Some ingest processors expose behavior through Painless methods that can be called in Painless scripts that execute in ingest pipelines.

Method usage

edit

All ingest methods available in Painless are scoped to the Processors namespace. For example:

POST /_ingest/pipeline/_simulate?verbose
{
  "pipeline": {
    "processors": [
      {
        "script": {
          "lang": "painless",
          "source": """
            long bytes = Processors.bytes(ctx.size);
            ctx.size_in_bytes = bytes;
          """
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "size": "1kb"
      }
    }
  ]
}

Ingest methods reference

edit

Byte conversion

edit

Use the bytes processor to return the number of bytes in the human-readable byte value supplied in the value parameter.

long bytes(String value);

Lowercase conversion

edit

Use the lowercase processor to convert the supplied string in the value parameter to its lowercase equivalent.

String lowercase(String value);

Uppercase conversion

edit

Use the uppercase processor to convert the supplied string in the value parameter to its uppercase equivalent.

String uppercase(String value);

JSON parsing

edit

Use the JSON processor to convert JSON strings to structured JSON objects. The first json method accepts a map and a key. The processor converts the JSON string in the map as specified by the key parameter to structured JSON content. That content is added directly to the map object.

The second json method accepts a JSON string in the value parameter and returns a structured JSON object.

void json(Map<String, Object> map, String key);
Object json(Object value);

You can then add this object to the document through the context object:

Object json = Processors.json(ctx.inputJsonString);
ctx.structuredJson = json;

URL decoding

edit

Use the URL decode processor to URL-decode the string supplied in the value parameter.

String urlDecode(String value);

URI decomposition

edit

Use the URI parts processor to decompose the URI string supplied in the value parameter. Returns a map of key-value pairs in which the key is the name of the URI component such as domain or path and the value is the corresponding value for that component.

String uriParts(String value);

Network community ID

edit

Use the community ID processor to compute the network community ID for network flow data.

String communityId(String sourceIpAddrString, String destIpAddrString, Object ianaNumber, Object transport, Object sourcePort, Object destinationPort, Object icmpType, Object icmpCode, int seed)
String communityId(String sourceIpAddrString, String destIpAddrString, Object ianaNumber, Object transport, Object sourcePort, Object destinationPort, Object icmpType, Object icmpCode)

« Painless execute API Painless Language Specification »