Simulate data ingestion | Elasticsearch API documentation (original) (raw)
Dismiss highlight Show more
Path parameters
- The index to simulate ingesting into. This value can be overridden by specifying an index on each document. If you specify this parameter in the request path, it is used for any documents that do not explicitly specify an index argument.
Query parameters
- The pipeline to use as the default pipeline. This value can be used to override the default pipeline of the index.
application/json
Body Required
- docs
array[object] Required
Sample documents to test in the pipeline.
Hide docs attributes Show docs attributes object- JSON body for the document.
- A map of component template names to substitute component template definition objects.
Hide component_template_substitutions attribute Show component_template_substitutions attribute object- Hide * attributes Show * attributes object
* Hide template attributes Show template attributes object
* Hide _meta attribute Show _meta attribute object
* *
object Additional properties
* Hide settings attribute Show settings attribute object
* Hide * attributes Show * attributes object
* Hide soft_deletes attributes Show soft_deletes attributes object
* Indicates whether soft deletes are enabled on the index.
* Hide sort attributes Show sort attributes object
* field
string | array[string]
* Values aretrue
,false
, orchecksum
.
* #### routing_partition_size number | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
* #### auto_expand_replicas string | null
Anull
value that is to be interpreted as an actual value, unless other uses ofnull
that are equivalent to a missing value. It is used for exemple in settings, where using theNullValue
for a setting will reset it to its default value.
* Hide merge attribute Show merge attribute object
* Hide search attributes Show search attributes object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Hide blocks attributes Show blocks attributes object
* Hide analyze attribute Show analyze attribute object
* Hide highlight attribute Show highlight attribute object
* Hide routing attributes Show routing attributes object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Hide lifecycle attributes Show lifecycle attributes object
* If specified, this is the timestamp used to calculate the index age for its phase transitions. Use this setting if you create a new index that contains old data and want to use the original creation date to calculate the index age. Specified as a Unix epoch value in milliseconds.
* Set to true to parse the origination date from the index name. This origination date is used to calculate the index age for its phase transitions. The index name must match the pattern .*-{date_format}-\d+, where the date_format is yyyy.MM.dd and the trailing digits are optional. An index that was rolled over would normally match the full format, for example logs-2016.10.31-000002). If the index name doesn’t match the pattern, index creation fails.
* The index alias to update when the index rolls over. Specify when using a policy that contains a rollover action. When the index rolls over, the alias is updated to reflect that the index is no longer the write index. For more information about rolling indices, see Rollover.
* Hide version attributes Show version attributes object
* Hide translog attributes Show translog attributes object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Values arerequest
,REQUEST
,async
, orASYNC
.
* Hide query_string attribute Show query_string attribute object
* Hide analysis attributes Show analysis attributes object
* Hide time_series attributes Show time_series attributes object
* Hide queries attribute Show queries attribute object
* Configure custom similarity settings to customize how search results are scored.
* Hide mapping attributes Show mapping attributes object
* Hide indexing.slowlog attributes Show indexing.slowlog attributes object
* Hide indexing_pressure attribute Show indexing_pressure attribute object
* Hide store attributes Show store attributes object
* You can restrict the use of the mmapfs and the related hybridfs store type via the setting node.store.allow_mmap. This is a boolean setting indicating whether or not memory-mapping is allowed. The default is to allow it. This setting is useful, for example, if you are in an environment where you can not control the ability to create a lot of memory maps so you need disable the ability to use memory-mapping.
* Hide mappings attributes Show mappings attributes object
* Hide all_field attributes Show all_field attributes object
* Values arestrict
,runtime
,true
, orfalse
.
* Hide _field_names attribute Show _field_names attribute object
* Hide index_field attribute Show index_field attribute object
* Hide _meta attribute Show _meta attribute object
* *
object Additional properties
* Hide _routing attribute Show _routing attribute object
* Hide _size attribute Show _size attribute object
* Hide _source attributes Show _source attributes object
* Values aredisabled
,stored
, orsynthetic
.
* Hide runtime attribute Show runtime attribute object
* *
object Additional properties
Hide * attributes Show * attributes object
* For typecomposite
* For typelookup
* A custom format fordate
type runtime fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Values areboolean
,composite
,date
,double
,geo_point
,geo_shape
,ip
,keyword
,long
, orlookup
.
* Values aretrue
orfalse
.
* Hide _data_stream_timestamp attribute Show _data_stream_timestamp attribute object
* Hide aliases attribute Show aliases attribute object
* *
object Additional properties
Hide * attributes Show * attributes object
* An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation
* Value used to route indexing operations to a specific shard. If specified, this overwrites therouting
value for indexing operations.
* Iftrue
, the index is the write index for the alias.
* Value used to route indexing and search operations to a specific shard.
* Value used to route search operations to a specific shard. If specified, this overwrites therouting
value for search operations.
* Iftrue
, the alias is hidden. All indices for the alias must have the sameis_hidden
value.
* Hide lifecycle attributes Show lifecycle attributes object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Hide downsampling attribute Show downsampling attribute object
* The list of downsampling rounds to execute as part of this downsampling configuration
* If defined, it turns data stream lifecycle on/off (true
/false
) for this data stream. A data stream lifecycle that's disabled (enabled:false
) will have no effect on the data stream.
* Hide rollover attributes Show rollover attributes object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Hide _meta attribute Show _meta attribute object
* *
object Additional properties
- Hide * attributes Show * attributes object
- A map of index template names to substitute index template definition objects.
Hide index_template_substitutions attribute Show index_template_substitutions attribute object- Hide * attributes Show * attributes object
* An ordered list of component template names. Component templates are merged in the order specified, meaning that the last component template specified has the highest precedence.
* Hide template attributes Show template attributes object
* Aliases to add. If the index template includes adata_stream
object, these are data stream aliases. Otherwise, these are index aliases. Data stream aliases ignore theindex_routing
,routing
, andsearch_routing
options.
Hide aliases attribute Show aliases attribute object
* *
object Additional properties
Hide * attributes Show * attributes object
* An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
External documentation
* Iftrue
, the alias is hidden. All indices for the alias must have the sameis_hidden
value.
* Iftrue
, the index is the write index for the alias.
* Hide mappings attributes Show mappings attributes object
* Hide all_field attributes Show all_field attributes object
* Values arestrict
,runtime
,true
, orfalse
.
* Hide _field_names attribute Show _field_names attribute object
* Hide index_field attribute Show index_field attribute object
* Hide _meta attribute Show _meta attribute object
* *
object Additional properties
* Hide _routing attribute Show _routing attribute object
* Hide _size attribute Show _size attribute object
* Hide _source attributes Show _source attributes object
* Values aredisabled
,stored
, orsynthetic
.
* Hide runtime attribute Show runtime attribute object
* *
object Additional properties
Hide * attributes Show * attributes object
* For typecomposite
* For typelookup
* A custom format fordate
type runtime fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Values areboolean
,composite
,date
,double
,geo_point
,geo_shape
,ip
,keyword
,long
, orlookup
.
* Values aretrue
orfalse
.
* Hide _data_stream_timestamp attribute Show _data_stream_timestamp attribute object
* Hide settings attributes Show settings attributes object
* Hide soft_deletes attributes Show soft_deletes attributes object
* Indicates whether soft deletes are enabled on the index.
* Hide retention_lease attribute Show retention_lease attribute object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Hide sort attributes Show sort attributes object
* field
string | array[string]
* #### order string | array[string]
Supported values include:asc
(orASC
),desc
(orDESC
)
Values areasc
,ASC
,desc
, orDESC
.
Values areasc
,ASC
,desc
, orDESC
.
* #### mode string | array[string]
Supported values include:min
(orMIN
),max
(orMAX
)
Values aremin
,MIN
,max
, orMAX
.
Values aremin
,MIN
,max
, orMAX
.
* #### missing string | array[string]
Supported values include:_last
,_first
Values are_last
or_first
.
Values are_last
or_first
.
* Values aretrue
,false
, orchecksum
.
* #### routing_partition_size number | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
* #### auto_expand_replicas string | null
Anull
value that is to be interpreted as an actual value, unless other uses ofnull
that are equivalent to a missing value. It is used for exemple in settings, where using theNullValue
for a setting will reset it to its default value.
* Hide merge attribute Show merge attribute object
* Hide scheduler attributes Show scheduler attributes object
* Hide search attributes Show search attributes object
* Hide idle attribute Show idle attribute object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Hide slowlog attributes Show slowlog attributes object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Hide blocks attributes Show blocks attributes object
* #### read_only boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
* #### read_only_allow_delete boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
* #### read boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
* #### write boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
* #### metadata boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
* Hide analyze attribute Show analyze attribute object
* #### max_token_count number | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
* Hide highlight attribute Show highlight attribute object
* Hide routing attributes Show routing attributes object
* Hide allocation attributes Show allocation attributes object
* Values areall
,primaries
,new_primaries
, ornone
.
* Hide rebalance attribute Show rebalance attribute object
* Values areall
,primaries
,replicas
, ornone
.
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Hide lifecycle attributes Show lifecycle attributes object
* #### indexing_complete boolean | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
* If specified, this is the timestamp used to calculate the index age for its phase transitions. Use this setting if you create a new index that contains old data and want to use the original creation date to calculate the index age. Specified as a Unix epoch value in milliseconds.
* Set to true to parse the origination date from the index name. This origination date is used to calculate the index age for its phase transitions. The index name must match the pattern .*-{date_format}-\d+, where the date_format is yyyy.MM.dd and the trailing digits are optional. An index that was rolled over would normally match the full format, for example logs-2016.10.31-000002). If the index name doesn’t match the pattern, index creation fails.
* Hide step attribute Show step attribute object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* The index alias to update when the index rolls over. Specify when using a policy that contains a rollover action. When the index rolls over, the alias is updated to reflect that the index is no longer the write index. For more information about rolling indices, see Rollover.
* #### prefer_ilm boolean | string
Preference for the system that manages a data stream backing index (preferring ILM when both ILM and DLM are applicable for an index).
* #### creation_date number | string
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
Time unit for milliseconds
* #### creation_date_string string | number
A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.
Time unit for milliseconds
* Hide version attributes Show version attributes object
* Hide translog attributes Show translog attributes object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Values arerequest
,REQUEST
,async
, orASYNC
.
* Hide retention attributes Show retention attributes object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Hide query_string attribute Show query_string attribute object
* #### lenient boolean | string Required
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
* Hide analysis attributes Show analysis attributes object
* Hide time_series attributes Show time_series attributes object
* Hide queries attribute Show queries attribute object
* Hide cache attribute Show cache attribute object
* Configure custom similarity settings to customize how search results are scored.
* Hide mapping attributes Show mapping attributes object
* Hide total_fields attributes Show total_fields attributes object
* Hide depth attribute Show depth attribute object
* The maximum depth for a field, which is measured as the number of inner objects. For instance, if all fields are defined at the root object level, then the depth is 1. If there is one object mapping, then the depth is 2, etc.
* Hide nested_fields attribute Show nested_fields attribute object
* The maximum number of distinct nested mappings in an index. The nested type should only be used in special cases, when arrays of objects need to be queried independently of each other. To safeguard against poorly designed mappings, this setting limits the number of unique nested types per index.
* Hide nested_objects attribute Show nested_objects attribute object
* The maximum number of nested JSON objects that a single document can contain across all nested types. This limit helps to prevent out of memory errors when a document contains too many nested objects.
* Hide field_name_length attribute Show field_name_length attribute object
* Setting for the maximum length of a field name. This setting isn’t really something that addresses mappings explosion but might still be useful if you want to limit the field length. It usually shouldn’t be necessary to set this setting. The default is okay unless a user starts to add a huge number of fields with really long names. Default isLong.MAX_VALUE
(no limit).
* Hide dimension_fields attribute Show dimension_fields attribute object
* [preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
* Hide source attribute Show source attribute object
* Values aredisabled
,stored
, orsynthetic
.
* Hide indexing.slowlog attributes Show indexing.slowlog attributes object
* Hide threshold attribute Show threshold attribute object
* Hide indexing_pressure attribute Show indexing_pressure attribute object
* Hide memory attribute Show memory attribute object
* Number of outstanding bytes that may be consumed by indexing requests. When this limit is reached or exceeded, the node will reject new coordinating and primary operations. When replica operations consume 1.5x this limit, the node will reject new replica operations. Defaults to 10% of the heap.
* Hide store attributes Show store attributes object
* #### type string Required
Values arefs
,niofs
,mmapfs
, orhybridfs
.
* You can restrict the use of the mmapfs and the related hybridfs store type via the setting node.store.allow_mmap. This is a boolean setting indicating whether or not memory-mapping is allowed. The default is to allow it. This setting is useful, for example, if you are in an environment where you can not control the ability to create a lot of memory maps so you need disable the ability to use memory-mapping.
* Hide lifecycle attributes Show lifecycle attributes object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Hide downsampling attribute Show downsampling attribute object
* The list of downsampling rounds to execute as part of this downsampling configuration
* If defined, it turns data stream lifecycle on/off (true
/false
) for this data stream. A data stream lifecycle that's disabled (enabled:false
) will have no effect on the data stream.
* Hide rollover attributes Show rollover attributes object
* A duration. Units can benanos
,micros
,ms
(milliseconds),s
(seconds),m
(minutes),h
(hours) andd
(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
* Priority to determine index template precedence when a new data stream or index is created. The index template with the highest priority is chosen. If no priority is specified the template is treated as though it is of priority 0 (lowest priority). This number is not automatically generated by Elasticsearch.
* Hide _meta attribute Show _meta attribute object
* *
object Additional properties
* Hide data_stream attributes Show data_stream attributes object
* If true, the data stream is hidden.
* If true, the data stream supports custom routing.
* Marks this index template as deprecated. When creating or updating a non-deprecated index template that uses deprecated components, Elasticsearch will emit a deprecation warning.
- Hide * attributes Show * attributes object
- Hide mapping_addition attributes Show mapping_addition attributes object
- Hide all_field attributes Show all_field attributes object
- Values are
strict
,runtime
,true
, orfalse
. - Hide _field_names attribute Show _field_names attribute object
- Hide index_field attribute Show index_field attribute object
- Hide _meta attribute Show _meta attribute object
* *
object Additional properties - Hide _routing attribute Show _routing attribute object
- Hide _size attribute Show _size attribute object
- Hide _source attributes Show _source attributes object
* Values aredisabled
,stored
, orsynthetic
. - Hide runtime attribute Show runtime attribute object
* *
object Additional properties
Hide * attributes Show * attributes object
* For typecomposite
Hide fields attribute Show fields attribute object
* *
object Additional properties
Hide * attribute Show * attribute object
* Values areboolean
,composite
,date
,double
,geo_point
,geo_shape
,ip
,keyword
,long
, orlookup
.
* For typelookup
Hide fetch_fields attributes Show fetch_fields attributes object
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* A custom format fordate
type runtime fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide script attributes Show script attributes object
* Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
Hide params attribute Show params attribute object
* *
object Additional properties
* #### lang string
Values arepainless
,expression
,mustache
, orjava
.
* Hide options attribute Show options attribute object
* *
string Additional properties
* Values areboolean
,composite
,date
,double
,geo_point
,geo_shape
,ip
,keyword
,long
, orlookup
. - Values are
true
orfalse
. - Hide _data_stream_timestamp attribute Show _data_stream_timestamp attribute object
- Pipelines to test. If you don’t specify the
pipeline
request path parameter, this parameter is required. If you specify both this and the request path parameter, the API only uses the request path parameter.
Hide pipeline_substitutions attribute Show pipeline_substitutions attribute object- *
object Additional properties
Hide * attributes Show * attributes object
* Description of the ingest pipeline.
* Processors to run immediately after a processor failure.
Hide on_failure attributes Show on_failure attributes object
* Hide append attributes Show append attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iffalse
, the processor does not append values already present in the field.
* Hide attachment attributes Show attachment attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
and field does not exist, the processor quietly exits without modifying the document.
* The number of chars being used for extraction to prevent huge fields. Use-1
for no limit.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Array of properties to select to be stored. Can becontent
,title
,name
,author
,keywords
,date
,content_type
,content_length
,language
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* If true, the binary field will be removed from the document
* Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
* Hide bytes attributes Show bytes attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide circle attributes Show circle attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters forgeo_shape
, unit-less forshape
).
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Values aregeo_shape
orshape
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide community_id attributes Show community_id attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
* If true and any required fields are missing, the processor quietly exits without modifying the document.
* Hide convert attributes Show convert attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Values areinteger
,long
,double
,float
,boolean
,ip
,string
, orauto
.
* Hide csv attributes Show csv attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes (""
).
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Quote used in CSV, has to be single character string.
* Separator used in CSV, has to be single character string.
* Trim whitespaces in unquoted fields.
* Hide date attributes Show date attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
* The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* The timezone to use when parsing the date. Supports template snippets.
* The format to use when writing the date to target_field. Must be a valid java time pattern.
* Hide date_index_name attributes Show date_index_name attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
* How to round the date when formatting the date into the index name. Valid values are:y
(year),M
(month),w
(week),d
(day),h
(hour),m
(minute) ands
(second). Supports template snippets.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
* A prefix of the index name to be prepended before the printed date. Supports template snippets.
* The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
* The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
* Hide dissect attributes Show dissect attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The character(s) that separate the appended fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* The pattern to apply to the field.
* Hide dot_expander attributes Show dot_expander attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Controls the behavior when there is already an existing nested object that conflicts with the expanded field. Whenfalse
, the processor will merge conflicts by combining the old and the new values into an array. Whentrue
, the value from the expanded field will overwrite the existing value.
* The field that contains the field to expand. Only required if the field to expand is part another object field, because thefield
option can only understand leaf fields.
* Hide drop attributes Show drop attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Hide enrich attributes Show enrich attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* The maximum number of matched documents to include under the configured target field. Thetarget_field
will be turned into a json array ifmax_matches
is higher than 1, otherwisetarget_field
will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128.
* If processor will update fields with pre-existing non-null-valued field. When set tofalse
, such fields will not be touched.
* The name of the enrich policy to use.
* Values areintersects
,disjoint
,within
, orcontains
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide fail attributes Show fail attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The error message thrown by the processor. Supports template snippets.
* Hide fingerprint attributes Show fingerprint attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* fields
string | array[string] Required
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Salt value for the hash function.
* Values areMD5
,SHA-1
,SHA-256
,SHA-512
, orMurmurHash3
.
* If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
* Hide foreach attributes Show foreach attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
, the processor silently exits without changing the document if thefield
isnull
or missing.
* Hide ip_location attributes Show ip_location attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
, only the first found IP location data will be returned, even if the field contains an array.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Controls what properties are added to thetarget_field
based on the IP location lookup.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
(and ifingest.geoip.downloader.eager.download
isfalse
), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as thedefault_pipeline
orfinal_pipeline
in an index.
* Hide geo_grid attributes Show geo_grid attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The field to interpret as a geo-tile.= The field format is determined by thetile_type
.
* Values aregeotile
,geohex
, orgeohash
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Values aregeojson
orwkt
.
* Hide geoip attributes Show geoip attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
, only the first found geoip data will be returned, even if the field contains an array.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Controls what properties are added to thetarget_field
based on the geoip lookup.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
(and ifingest.geoip.downloader.eager.download
isfalse
), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as thedefault_pipeline
orfinal_pipeline
in an index.
* Hide grok attributes Show grok attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
* An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
* Whentrue
,_ingest._grok_match_index
will be inserted into your matched document’s metadata with the index into the pattern found inpatterns
that matched.
* Hide gsub attributes Show gsub attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* The pattern to be replaced.
* The string to replace the matching patterns with.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide html_strip attributes Show html_strip attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document,
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide inference attributes Show inference attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
* If true and any of the input fields defined in input_ouput are missing then those missing fields are quietly ignored, otherwise a missing field causes a failure. Only applies when using input_output configurations to explicitly list the input fields.
* Hide join attributes Show join attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* The separator character.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide json attributes Show json attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Flag that forces the parsed JSON to be added at the top level of the document.target_field
must not be set when this option is chosen.
* Values arereplace
ormerge
.
* When set totrue
, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide kv attributes Show kv attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* List of keys to exclude from document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Regex pattern to use for splitting key-value pairs.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* List of keys to filter and insert into document. Defaults to including all keys.
* Prefix to be added to extracted keys.
* Iftrue
. strip brackets()
,<>
,[]
as well as quotes'
and"
from extracted values.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* String of characters to trim from extracted keys.
* String of characters to trim from extracted values.
* Regex pattern to use for splitting the key from the value within a key-value pair.
* Hide lowercase attributes Show lowercase attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide network_direction attributes Show network_direction attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* If true and any required fields are missing, the processor quietly exits without modifying the document.
* Hide pipeline attributes Show pipeline attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Whether to ignore missing pipelines instead of failing.
* Hide redact attributes Show redact attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* A list of grok expressions to match and redact named captures with
* Start a redacted section with this token
* End a redacted section with this token
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Iftrue
and the current license does not support running redact processors, then the processor quietly exits without modifying the document
* Iftrue
then ingest metadata_ingest._redact._is_redacted
is set totrue
if the document has been redacted
* Hide registered_domain attributes Show registered_domain attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* If true and any required fields are missing, the processor quietly exits without modifying the document.
* Hide remove attributes Show remove attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* field
string | array[string] Required
* keep
string | array[string]
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Hide rename attributes Show rename attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide reroute attributes Show reroute attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* A static value for the target. Can’t be set when the dataset or namespace option is set.
* Hide script attributes Show script attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Object containing parameters for the script.
* Hide set attributes Show set attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andvalue
is a template snippet that evaluates tonull
or the empty string, the processor quietly exits without modifying the document.
* The media type for encodingvalue
. Applies only when value is a template snippet. Must be one ofapplication/json
,text/plain
, orapplication/x-www-form-urlencoded
.
* Iftrue
processor will update fields with pre-existing non-null-valued field. When set tofalse
, such fields will not be touched.
* The value to be set for the field. Supports template snippets. May specify only one ofvalue
orcopy_from
.
* Hide set_security_user attributes Show set_security_user attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Controls what user related properties are added to the field.
* Hide sort attributes Show sort attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide split attributes Show split attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Preserves empty trailing fields, if any.
* A regex which matches the separator, for example,,
or\s+
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide terminate attributes Show terminate attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Hide trim attributes Show trim attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide uppercase attributes Show uppercase attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide urldecode attributes Show urldecode attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide uri_parts attributes Show uri_parts attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Iftrue
, the processor copies the unparsed URI to<target_field>.original
.
* Iftrue
, the processor removes thefield
after parsing the URI string. If parsing fails, the processor does not remove thefield
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide user_agent attributes Show user_agent attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* The name of the file in theconfig/ingest-user-agent
directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use theregexes.yaml
from uap-core it ships with.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Controls what properties are added totarget_field
.
Values arename
,os
,device
,original
, orversion
.
* Extracts device type from the user agent string on a best-effort basis.
* Processors used to perform transformations on documents before indexing. Processors run sequentially in the order specified.
Hide processors attributes Show processors attributes object
* Hide append attributes Show append attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iffalse
, the processor does not append values already present in the field.
* Hide attachment attributes Show attachment attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
and field does not exist, the processor quietly exits without modifying the document.
* The number of chars being used for extraction to prevent huge fields. Use-1
for no limit.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Array of properties to select to be stored. Can becontent
,title
,name
,author
,keywords
,date
,content_type
,content_length
,language
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* If true, the binary field will be removed from the document
* Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
* Hide bytes attributes Show bytes attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide circle attributes Show circle attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters forgeo_shape
, unit-less forshape
).
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Values aregeo_shape
orshape
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide community_id attributes Show community_id attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
* If true and any required fields are missing, the processor quietly exits without modifying the document.
* Hide convert attributes Show convert attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Values areinteger
,long
,double
,float
,boolean
,ip
,string
, orauto
.
* Hide csv attributes Show csv attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes (""
).
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Quote used in CSV, has to be single character string.
* Separator used in CSV, has to be single character string.
* Trim whitespaces in unquoted fields.
* Hide date attributes Show date attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
* The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* The timezone to use when parsing the date. Supports template snippets.
* The format to use when writing the date to target_field. Must be a valid java time pattern.
* Hide date_index_name attributes Show date_index_name attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
* How to round the date when formatting the date into the index name. Valid values are:y
(year),M
(month),w
(week),d
(day),h
(hour),m
(minute) ands
(second). Supports template snippets.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
* A prefix of the index name to be prepended before the printed date. Supports template snippets.
* The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
* The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
* Hide dissect attributes Show dissect attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The character(s) that separate the appended fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* The pattern to apply to the field.
* Hide dot_expander attributes Show dot_expander attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Controls the behavior when there is already an existing nested object that conflicts with the expanded field. Whenfalse
, the processor will merge conflicts by combining the old and the new values into an array. Whentrue
, the value from the expanded field will overwrite the existing value.
* The field that contains the field to expand. Only required if the field to expand is part another object field, because thefield
option can only understand leaf fields.
* Hide drop attributes Show drop attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Hide enrich attributes Show enrich attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* The maximum number of matched documents to include under the configured target field. Thetarget_field
will be turned into a json array ifmax_matches
is higher than 1, otherwisetarget_field
will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128.
* If processor will update fields with pre-existing non-null-valued field. When set tofalse
, such fields will not be touched.
* The name of the enrich policy to use.
* Values areintersects
,disjoint
,within
, orcontains
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide fail attributes Show fail attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The error message thrown by the processor. Supports template snippets.
* Hide fingerprint attributes Show fingerprint attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* fields
string | array[string] Required
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Salt value for the hash function.
* Values areMD5
,SHA-1
,SHA-256
,SHA-512
, orMurmurHash3
.
* If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
* Hide foreach attributes Show foreach attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
, the processor silently exits without changing the document if thefield
isnull
or missing.
* Hide ip_location attributes Show ip_location attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
, only the first found IP location data will be returned, even if the field contains an array.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Controls what properties are added to thetarget_field
based on the IP location lookup.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
(and ifingest.geoip.downloader.eager.download
isfalse
), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as thedefault_pipeline
orfinal_pipeline
in an index.
* Hide geo_grid attributes Show geo_grid attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The field to interpret as a geo-tile.= The field format is determined by thetile_type
.
* Values aregeotile
,geohex
, orgeohash
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Values aregeojson
orwkt
.
* Hide geoip attributes Show geoip attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
, only the first found geoip data will be returned, even if the field contains an array.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Controls what properties are added to thetarget_field
based on the geoip lookup.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
(and ifingest.geoip.downloader.eager.download
isfalse
), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as thedefault_pipeline
orfinal_pipeline
in an index.
* Hide grok attributes Show grok attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
* An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
* Whentrue
,_ingest._grok_match_index
will be inserted into your matched document’s metadata with the index into the pattern found inpatterns
that matched.
* Hide gsub attributes Show gsub attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* The pattern to be replaced.
* The string to replace the matching patterns with.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide html_strip attributes Show html_strip attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document,
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide inference attributes Show inference attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
* If true and any of the input fields defined in input_ouput are missing then those missing fields are quietly ignored, otherwise a missing field causes a failure. Only applies when using input_output configurations to explicitly list the input fields.
* Hide join attributes Show join attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* The separator character.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide json attributes Show json attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Flag that forces the parsed JSON to be added at the top level of the document.target_field
must not be set when this option is chosen.
* Values arereplace
ormerge
.
* When set totrue
, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide kv attributes Show kv attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* List of keys to exclude from document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Regex pattern to use for splitting key-value pairs.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* List of keys to filter and insert into document. Defaults to including all keys.
* Prefix to be added to extracted keys.
* Iftrue
. strip brackets()
,<>
,[]
as well as quotes'
and"
from extracted values.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* String of characters to trim from extracted keys.
* String of characters to trim from extracted values.
* Regex pattern to use for splitting the key from the value within a key-value pair.
* Hide lowercase attributes Show lowercase attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide network_direction attributes Show network_direction attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* If true and any required fields are missing, the processor quietly exits without modifying the document.
* Hide pipeline attributes Show pipeline attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Whether to ignore missing pipelines instead of failing.
* Hide redact attributes Show redact attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* A list of grok expressions to match and redact named captures with
* Start a redacted section with this token
* End a redacted section with this token
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Iftrue
and the current license does not support running redact processors, then the processor quietly exits without modifying the document
* Iftrue
then ingest metadata_ingest._redact._is_redacted
is set totrue
if the document has been redacted
* Hide registered_domain attributes Show registered_domain attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* If true and any required fields are missing, the processor quietly exits without modifying the document.
* Hide remove attributes Show remove attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* field
string | array[string] Required
* keep
string | array[string]
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Hide rename attributes Show rename attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide reroute attributes Show reroute attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* A static value for the target. Can’t be set when the dataset or namespace option is set.
* Hide script attributes Show script attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Object containing parameters for the script.
* Hide set attributes Show set attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andvalue
is a template snippet that evaluates tonull
or the empty string, the processor quietly exits without modifying the document.
* The media type for encodingvalue
. Applies only when value is a template snippet. Must be one ofapplication/json
,text/plain
, orapplication/x-www-form-urlencoded
.
* Iftrue
processor will update fields with pre-existing non-null-valued field. When set tofalse
, such fields will not be touched.
* The value to be set for the field. Supports template snippets. May specify only one ofvalue
orcopy_from
.
* Hide set_security_user attributes Show set_security_user attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Controls what user related properties are added to the field.
* Hide sort attributes Show sort attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide split attributes Show split attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Preserves empty trailing fields, if any.
* A regex which matches the separator, for example,,
or\s+
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide terminate attributes Show terminate attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Hide trim attributes Show trim attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide uppercase attributes Show uppercase attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide urldecode attributes Show urldecode attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist or isnull
, the processor quietly exits without modifying the document.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide uri_parts attributes Show uri_parts attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* Iftrue
, the processor copies the unparsed URI to<target_field>.original
.
* Iftrue
, the processor removes thefield
after parsing the URI string. If parsing fails, the processor does not remove thefield
.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Hide user_agent attributes Show user_agent attributes object
* Description of the processor. Useful for describing the purpose of the processor or its configuration.
* Ignore failures for the processor.
* Handle failures for the processor.
* Identifier for the processor. Useful for debugging and metrics.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Iftrue
andfield
does not exist, the processor quietly exits without modifying the document.
* The name of the file in theconfig/ingest-user-agent
directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use theregexes.yaml
from uap-core it ships with.
* Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
* Controls what properties are added totarget_field
.
Values arename
,os
,device
,original
, orversion
.
* Extracts device type from the user agent string on a best-effort basis.
* Marks this ingest pipeline as deprecated. When a deprecated ingest pipeline is referenced as the default or final pipeline when creating or updating a non-deprecated index template, Elasticsearch will emit a deprecation warning.
* Hide _meta attribute Show _meta attribute object
* *
object Additional properties
- *
Responses
- 200 application/json
Hide response attribute Show response attribute object- docs
array[object] Required
Hide docs attribute Show docs attribute object
* Hide doc attributes Show doc attributes object
* JSON body for the document.
Hide _source attribute Show _source attribute object
* *
object Additional properties
* #### _version number | string Required
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
* A list of the names of the pipelines executed on this document.
* A list of the fields that would be ignored at the indexing step. For example, a field whose value is larger than the allowed limit would make it through all of the pipelines, but would not be indexed into Elasticsearch.
Hide ignored_fields attribute Show ignored_fields attribute object
* *
string Additional properties
* Hide error attributes Show error attributes object
* The type of error
* A human-readable explanation of the error, in English.
* The server stack trace. Present only if theerror_trace=true
parameter was sent with the request.
- docs