Detect mime type

The detect_mime_type processor attempts to detect a mime type for a field that contains a given stream of bytes.

Example

In this example, http.request.body.content is used as the source, and http.request.mime_type is set to the detected mime type.

  - detect_mime_type:
      field: http.request.body.content
      target: http.request.mime_type

Configuration settings

edit

Elastic Agent processors execute before ingest pipelines, which means that your processor configurations cannot refer to fields that are created by ingest pipelines or Logstash. For more limitations, refer to What are some limitations of using processors?

Name	Required	Default	Description
`field`	Yes		Field used as the data source.
`target`	Yes		Field to populate with the detected type. You can use the `@metadata.` prefix to set the value in the event metadata instead of fields.

See Conditions for a list of supported conditions.

« Decompress gzip fields Dissect strings »