Simulate a pipeline | Elasticsearch API documentation (original) (raw)

Dismiss highlight Show more

Query parameters

• If true, the response includes output data for each processor in the executed pipeline.

application/json

Body Required

• docs
  array[object] Required
  Sample documents to test in the pipeline.
  Hide docs attributes Show docs attributes object
  • JSON body for the document.
• Hide pipeline attributes Show pipeline attributes object
  • Description of the ingest pipeline.
  • Processors to run immediately after a processor failure.
    Hide on_failure attributes Show on_failure attributes object
    * Hide append attributes Show append attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * #### value object | array[object] Required
    The value to be appended. Supports template snippets.
    * If false, the processor does not append values already present in the field.
    * Hide attachment attributes Show attachment attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * The number of chars being used for extraction to prevent huge fields. Use -1 for no limit.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Array of properties to select to be stored. Can be content, title, name, author, keywords, date, content_type, content_length, language.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true, the binary field will be removed from the document
    * Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
    * Hide bytes attributes Show bytes attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide circle attributes Show circle attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for geo_shape, unit-less for shape).
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Values are geo_shape or shape.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide community_id attributes Show community_id attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
    * If true and any required fields are missing, the processor quietly exits without modifying the document.
    * Hide convert attributes Show convert attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Values are integer, long, double, float, boolean, ip, string, or auto.
    * Hide csv attributes Show csv attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes ("").
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Quote used in CSV, has to be single character string.
    * Separator used in CSV, has to be single character string.
    * Trim whitespaces in unquoted fields.
    * Hide date attributes Show date attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
    * The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * The timezone to use when parsing the date. Supports template snippets.
    * The format to use when writing the date to target_field. Must be a valid java time pattern.
    * Hide date_index_name attributes Show date_index_name attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
    * How to round the date when formatting the date into the index name. Valid values are:y (year), M (month), w (week), d (day), h (hour), m (minute) and s (second). Supports template snippets.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
    * A prefix of the index name to be prepended before the printed date. Supports template snippets.
    * The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
    * The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
    * Hide dissect attributes Show dissect attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The character(s) that separate the appended fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * The pattern to apply to the field.
    * Hide dot_expander attributes Show dot_expander attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Controls the behavior when there is already an existing nested object that conflicts with the expanded field. When false, the processor will merge conflicts by combining the old and the new values into an array. When true, the value from the expanded field will overwrite the existing value.
    * The field that contains the field to expand. Only required if the field to expand is part another object field, because the field option can only understand leaf fields.
    * Hide drop attributes Show drop attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Hide enrich attributes Show enrich attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * The maximum number of matched documents to include under the configured target field. The target_field will be turned into a json array if max_matches is higher than 1, otherwise target_field will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128.
    * If processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
    * The name of the enrich policy to use.
    * Values are intersects, disjoint, within, or contains.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide fail attributes Show fail attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The error message thrown by the processor. Supports template snippets.
    * Hide fingerprint attributes Show fingerprint attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * fields
    string | array[string] Required
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Salt value for the hash function.
    * Values are MD5, SHA-1, SHA-256, SHA-512, or MurmurHash3.
    * If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
    * Hide foreach attributes Show foreach attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true, the processor silently exits without changing the document if the field is null or missing.
    * Hide ip_location attributes Show ip_location attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true, only the first found IP location data will be returned, even if the field contains an array.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Controls what properties are added to the target_field based on the IP location lookup.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
    * Hide geo_grid attributes Show geo_grid attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The field to interpret as a geo-tile.= The field format is determined by the tile_type.
    * Values are geotile, geohex, or geohash.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Values are geojson or wkt.
    * Hide geoip attributes Show geoip attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true, only the first found geoip data will be returned, even if the field contains an array.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Controls what properties are added to the target_field based on the geoip lookup.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
    * Hide grok attributes Show grok attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
    Hide pattern_definitions attribute Show pattern_definitions attribute object
    * *
    string Additional properties
    * An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
    * When true, _ingest._grok_match_index will be inserted into your matched document’s metadata with the index into the pattern found in patterns that matched.
    * Hide gsub attributes Show gsub attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * The pattern to be replaced.
    * The string to replace the matching patterns with.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide html_strip attributes Show html_strip attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document,
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide inference attributes Show inference attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
    Hide field_map attribute Show field_map attribute object
    * *
    object Additional properties
    * Hide inference_config attributes Show inference_config attributes object
    * #### input_output object | array[object]
    Input fields for inference and output (destination) fields for the inference results. This option is incompatible with the target_field and field_map options.
    * If true and any of the input fields defined in input_ouput are missing then those missing fields are quietly ignored, otherwise a missing field causes a failure. Only applies when using input_output configurations to explicitly list the input fields.
    * Hide join attributes Show join attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * The separator character.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide json attributes Show json attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Flag that forces the parsed JSON to be added at the top level of the document.target_field must not be set when this option is chosen.
    * Values are replace or merge.
    * When set to true, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide kv attributes Show kv attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * List of keys to exclude from document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Regex pattern to use for splitting key-value pairs.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * List of keys to filter and insert into document. Defaults to including all keys.
    * Prefix to be added to extracted keys.
    * If true. strip brackets (), <>, [] as well as quotes ' and " from extracted values.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * String of characters to trim from extracted keys.
    * String of characters to trim from extracted values.
    * Regex pattern to use for splitting the key from the value within a key-value pair.
    * Hide lowercase attributes Show lowercase attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide network_direction attributes Show network_direction attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and any required fields are missing, the processor quietly exits without modifying the document.
    * Hide pipeline attributes Show pipeline attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Whether to ignore missing pipelines instead of failing.
    * Hide redact attributes Show redact attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * A list of grok expressions to match and redact named captures with
    * Hide pattern_definitions attribute Show pattern_definitions attribute object
    * *
    string Additional properties
    * Start a redacted section with this token
    * End a redacted section with this token
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * If true and the current license does not support running redact processors, then the processor quietly exits without modifying the document
    * If true then ingest metadata _ingest._redact._is_redacted is set to true if the document has been redacted
    * Hide registered_domain attributes Show registered_domain attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and any required fields are missing, the processor quietly exits without modifying the document.
    * Hide remove attributes Show remove attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * field
    string | array[string] Required
    * keep
    string | array[string]
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Hide rename attributes Show rename attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide reroute attributes Show reroute attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * A static value for the target. Can’t be set when the dataset or namespace option is set.
    * #### dataset string | array[string]
    Field references or a static value for the dataset part of the data stream name. In addition to the criteria for index names, cannot contain - and must be no longer than 100 characters. Example values are nginx.access and nginx.error.
    Supports field references with a mustache-like syntax (denoted as {{double}} or {{{triple}}} curly braces). When resolving field references, the processor replaces invalid characters with _. Uses the part of the index name as a fallback if all field references resolve to a null, missing, or non-string value.
    default {{data_stream.dataset}}
    * #### namespace string | array[string]
    Field references or a static value for the namespace part of the data stream name. See the criteria for index names for allowed characters. Must be no longer than 100 characters.
    Supports field references with a mustache-like syntax (denoted as {{double}} or {{{triple}}} curly braces). When resolving field references, the processor replaces invalid characters with _. Uses the part of the index name as a fallback if all field references resolve to a null, missing, or non-string value.
    default {{data_stream.namespace}}
    * Hide script attributes Show script attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * #### lang string
    Values are painless, expression, mustache, or java.
    * Object containing parameters for the script.
    Hide params attribute Show params attribute object
    * *
    object Additional properties
    * Hide set attributes Show set attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and value is a template snippet that evaluates to null or the empty string, the processor quietly exits without modifying the document.
    * The media type for encoding value. Applies only when value is a template snippet. Must be one of application/json, text/plain, or application/x-www-form-urlencoded.
    * If true processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
    * The value to be set for the field. Supports template snippets. May specify only one of value or copy_from.
    * Hide set_security_user attributes Show set_security_user attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Controls what user related properties are added to the field.
    * Hide sort attributes Show sort attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide split attributes Show split attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Preserves empty trailing fields, if any.
    * A regex which matches the separator, for example, , or \s+.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide terminate attributes Show terminate attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Hide trim attributes Show trim attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide uppercase attributes Show uppercase attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide urldecode attributes Show urldecode attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide uri_parts attributes Show uri_parts attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * If true, the processor copies the unparsed URI to <target_field>.original.
    * If true, the processor removes the field after parsing the URI string. If parsing fails, the processor does not remove the field.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide user_agent attributes Show user_agent attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * The name of the file in the config/ingest-user-agent directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the regexes.yaml from uap-core it ships with.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Controls what properties are added to target_field.
    Values are name, os, device, original, or version.
    * Extracts device type from the user agent string on a best-effort basis.
  • Processors used to perform transformations on documents before indexing. Processors run sequentially in the order specified.
    Hide processors attributes Show processors attributes object
    * Hide append attributes Show append attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * #### value object | array[object] Required
    The value to be appended. Supports template snippets.
    * If false, the processor does not append values already present in the field.
    * Hide attachment attributes Show attachment attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * The number of chars being used for extraction to prevent huge fields. Use -1 for no limit.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Array of properties to select to be stored. Can be content, title, name, author, keywords, date, content_type, content_length, language.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true, the binary field will be removed from the document
    * Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
    * Hide bytes attributes Show bytes attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide circle attributes Show circle attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for geo_shape, unit-less for shape).
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Values are geo_shape or shape.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide community_id attributes Show community_id attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
    * If true and any required fields are missing, the processor quietly exits without modifying the document.
    * Hide convert attributes Show convert attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Values are integer, long, double, float, boolean, ip, string, or auto.
    * Hide csv attributes Show csv attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes ("").
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Quote used in CSV, has to be single character string.
    * Separator used in CSV, has to be single character string.
    * Trim whitespaces in unquoted fields.
    * Hide date attributes Show date attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
    * The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * The timezone to use when parsing the date. Supports template snippets.
    * The format to use when writing the date to target_field. Must be a valid java time pattern.
    * Hide date_index_name attributes Show date_index_name attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
    * How to round the date when formatting the date into the index name. Valid values are:y (year), M (month), w (week), d (day), h (hour), m (minute) and s (second). Supports template snippets.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
    * A prefix of the index name to be prepended before the printed date. Supports template snippets.
    * The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
    * The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
    * Hide dissect attributes Show dissect attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The character(s) that separate the appended fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * The pattern to apply to the field.
    * Hide dot_expander attributes Show dot_expander attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Controls the behavior when there is already an existing nested object that conflicts with the expanded field. When false, the processor will merge conflicts by combining the old and the new values into an array. When true, the value from the expanded field will overwrite the existing value.
    * The field that contains the field to expand. Only required if the field to expand is part another object field, because the field option can only understand leaf fields.
    * Hide drop attributes Show drop attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Hide enrich attributes Show enrich attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * The maximum number of matched documents to include under the configured target field. The target_field will be turned into a json array if max_matches is higher than 1, otherwise target_field will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128.
    * If processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
    * The name of the enrich policy to use.
    * Values are intersects, disjoint, within, or contains.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide fail attributes Show fail attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The error message thrown by the processor. Supports template snippets.
    * Hide fingerprint attributes Show fingerprint attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * fields
    string | array[string] Required
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Salt value for the hash function.
    * Values are MD5, SHA-1, SHA-256, SHA-512, or MurmurHash3.
    * If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
    * Hide foreach attributes Show foreach attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true, the processor silently exits without changing the document if the field is null or missing.
    * Hide ip_location attributes Show ip_location attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true, only the first found IP location data will be returned, even if the field contains an array.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Controls what properties are added to the target_field based on the IP location lookup.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
    * Hide geo_grid attributes Show geo_grid attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The field to interpret as a geo-tile.= The field format is determined by the tile_type.
    * Values are geotile, geohex, or geohash.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Values are geojson or wkt.
    * Hide geoip attributes Show geoip attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true, only the first found geoip data will be returned, even if the field contains an array.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Controls what properties are added to the target_field based on the geoip lookup.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
    * Hide grok attributes Show grok attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
    Hide pattern_definitions attribute Show pattern_definitions attribute object
    * *
    string Additional properties
    * An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
    * When true, _ingest._grok_match_index will be inserted into your matched document’s metadata with the index into the pattern found in patterns that matched.
    * Hide gsub attributes Show gsub attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * The pattern to be replaced.
    * The string to replace the matching patterns with.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide html_strip attributes Show html_strip attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document,
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide inference attributes Show inference attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
    Hide field_map attribute Show field_map attribute object
    * *
    object Additional properties
    * Hide inference_config attributes Show inference_config attributes object
    * #### input_output object | array[object]
    Input fields for inference and output (destination) fields for the inference results. This option is incompatible with the target_field and field_map options.
    * If true and any of the input fields defined in input_ouput are missing then those missing fields are quietly ignored, otherwise a missing field causes a failure. Only applies when using input_output configurations to explicitly list the input fields.
    * Hide join attributes Show join attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * The separator character.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide json attributes Show json attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Flag that forces the parsed JSON to be added at the top level of the document.target_field must not be set when this option is chosen.
    * Values are replace or merge.
    * When set to true, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide kv attributes Show kv attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * List of keys to exclude from document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Regex pattern to use for splitting key-value pairs.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * List of keys to filter and insert into document. Defaults to including all keys.
    * Prefix to be added to extracted keys.
    * If true. strip brackets (), <>, [] as well as quotes ' and " from extracted values.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * String of characters to trim from extracted keys.
    * String of characters to trim from extracted values.
    * Regex pattern to use for splitting the key from the value within a key-value pair.
    * Hide lowercase attributes Show lowercase attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide network_direction attributes Show network_direction attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and any required fields are missing, the processor quietly exits without modifying the document.
    * Hide pipeline attributes Show pipeline attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Whether to ignore missing pipelines instead of failing.
    * Hide redact attributes Show redact attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * A list of grok expressions to match and redact named captures with
    * Hide pattern_definitions attribute Show pattern_definitions attribute object
    * *
    string Additional properties
    * Start a redacted section with this token
    * End a redacted section with this token
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * If true and the current license does not support running redact processors, then the processor quietly exits without modifying the document
    * If true then ingest metadata _ingest._redact._is_redacted is set to true if the document has been redacted
    * Hide registered_domain attributes Show registered_domain attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and any required fields are missing, the processor quietly exits without modifying the document.
    * Hide remove attributes Show remove attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * field
    string | array[string] Required
    * keep
    string | array[string]
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Hide rename attributes Show rename attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide reroute attributes Show reroute attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * A static value for the target. Can’t be set when the dataset or namespace option is set.
    * #### dataset string | array[string]
    Field references or a static value for the dataset part of the data stream name. In addition to the criteria for index names, cannot contain - and must be no longer than 100 characters. Example values are nginx.access and nginx.error.
    Supports field references with a mustache-like syntax (denoted as {{double}} or {{{triple}}} curly braces). When resolving field references, the processor replaces invalid characters with _. Uses the part of the index name as a fallback if all field references resolve to a null, missing, or non-string value.
    default {{data_stream.dataset}}
    * #### namespace string | array[string]
    Field references or a static value for the namespace part of the data stream name. See the criteria for index names for allowed characters. Must be no longer than 100 characters.
    Supports field references with a mustache-like syntax (denoted as {{double}} or {{{triple}}} curly braces). When resolving field references, the processor replaces invalid characters with _. Uses the part of the index name as a fallback if all field references resolve to a null, missing, or non-string value.
    default {{data_stream.namespace}}
    * Hide script attributes Show script attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * #### lang string
    Values are painless, expression, mustache, or java.
    * Object containing parameters for the script.
    Hide params attribute Show params attribute object
    * *
    object Additional properties
    * Hide set attributes Show set attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and value is a template snippet that evaluates to null or the empty string, the processor quietly exits without modifying the document.
    * The media type for encoding value. Applies only when value is a template snippet. Must be one of application/json, text/plain, or application/x-www-form-urlencoded.
    * If true processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
    * The value to be set for the field. Supports template snippets. May specify only one of value or copy_from.
    * Hide set_security_user attributes Show set_security_user attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Controls what user related properties are added to the field.
    * Hide sort attributes Show sort attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide split attributes Show split attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Preserves empty trailing fields, if any.
    * A regex which matches the separator, for example, , or \s+.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide terminate attributes Show terminate attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Hide trim attributes Show trim attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide uppercase attributes Show uppercase attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide urldecode attributes Show urldecode attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist or is null, the processor quietly exits without modifying the document.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide uri_parts attributes Show uri_parts attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * If true, the processor copies the unparsed URI to <target_field>.original.
    * If true, the processor removes the field after parsing the URI string. If parsing fails, the processor does not remove the field.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Hide user_agent attributes Show user_agent attributes object
    * Description of the processor. Useful for describing the purpose of the processor or its configuration.
    * Hide if attributes Show if attributes object
    * Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
    * Ignore failures for the processor.
    * Handle failures for the processor.
    * Identifier for the processor. Useful for debugging and metrics.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * If true and field does not exist, the processor quietly exits without modifying the document.
    * The name of the file in the config/ingest-user-agent directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the regexes.yaml from uap-core it ships with.
    * Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
    * Controls what properties are added to target_field.
    Values are name, os, device, original, or version.
    * Extracts device type from the user agent string on a best-effort basis.
  • Marks this ingest pipeline as deprecated. When a deprecated ingest pipeline is referenced as the default or final pipeline when creating or updating a non-deprecated index template, Elasticsearch will emit a deprecation warning.
  • Hide _meta attribute Show _meta attribute object
    * *
    object Additional properties

Responses

• 200 application/json
  Hide response attribute Show response attribute object
  • docs
    array[object] Required
    Hide docs attributes Show docs attributes object
    * Hide doc attributes Show doc attributes object
    * Hide _ingest attributes Show _ingest attributes object
    * Hide _redact attribute Show _redact attribute object
    * indicates if document has been redacted
    * Value used to send the document to a specific primary shard.
    * JSON body for the document.
    Hide _source attribute Show _source attribute object
    * *
    object Additional properties
    * #### _version number | string
    Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
    Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
    * Values are internal, external, external_gte, or force.
    * Hide error attributes Show error attributes object
    * The type of error
    * A human-readable explanation of the error, in English.
    * The server stack trace. Present only if the error_trace=true parameter was sent with the request.
    * Hide processor_results attributes Show processor_results attributes object
    * Hide doc attributes Show doc attributes object
    * Value used to send the document to a specific primary shard.
    * JSON body for the document.
    * Values are internal, external, external_gte, or force.
    * Values are success, error, error_ignored, skipped, or dropped.
    * Hide ignored_error attributes Show ignored_error attributes object
    * The type of error
    * A human-readable explanation of the error, in English.
    * The server stack trace. Present only if the error_trace=true parameter was sent with the request.
    * Hide error attributes Show error attributes object
    * The type of error
    * A human-readable explanation of the error, in English.
    * The server stack trace. Present only if the error_trace=true parameter was sent with the request.