Simulate data ingestion | Elasticsearch API documentation

Query parameters

pipelinestring
The pipeline to use as the default pipeline. This value can be used to override the default pipeline of the index.

application/json

BodyRequired

docsarray[object] Required
Sample documents to test in the pipeline.
Hide docs attributes Show docs attributes object
- _idstring
- _indexstring
- _sourceobject Required
  JSON body for the document.
component_template_substitutionsobject
A map of component template names to substitute component template definition objects.
Hide component_template_substitutions attribute Show component_template_substitutions attribute object
- *object
  Hide * attributes Show * attributes object
  templateobject Required
  Hide template attributes Show template attributes object
  _metaobject
  Hide _meta attribute Show _meta attribute object
  *object Additional properties
  versionnumber
  settingsobject
  Hide settings attribute Show settings attribute object
  *object
  Index settings
  mappingsobject
  Hide mappings attributes Show mappings attributes object
  all_fieldobject
  Hide all_field attributes Show all_field attributes object
  analyzerstring Required
  enabledboolean Required
  omit_normsboolean Required
  search_analyzerstring Required
  similaritystring Required
  storeboolean Required
  store_term_vector_offsetsboolean Required
  store_term_vector_payloadsboolean Required
  store_term_vector_positionsboolean Required
  store_term_vectorsboolean Required
  date_detectionboolean
  dynamicstring
  Values are strict, runtime, true, or false.
  dynamic_date_formatsarray[string]
  dynamic_templatesarray[object]
  _field_namesobject
  Hide _field_names attribute Show _field_names attribute object
  enabledboolean Required
  index_fieldobject
  Hide index_field attribute Show index_field attribute object
  enabledboolean Required
  _metaobject
  Hide _meta attribute Show _meta attribute object
  *object Additional properties
  numeric_detectionboolean
  propertiesobject
  _routingobject
  Hide _routing attribute Show _routing attribute object
  requiredboolean Required
  _sizeobject
  Hide _size attribute Show _size attribute object
  enabledboolean Required
  _sourceobject
  Hide _source attributes Show _source attributes object
  compressboolean
  compress_thresholdstring
  enabledboolean
  excludesarray[string]
  includesarray[string]
  modestring
  Values are disabled, stored, or synthetic.
  runtimeobject
  Hide runtime attribute Show runtime attribute object
  *object Additional properties
  Hide * attributes Show * attributes object
  fieldsobject
  For type composite
  fetch_fieldsarray[object]
  For type lookup
  formatstring
  A custom format for date type runtime fields.
  input_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_indexstring
  scriptobject
  typestring Required
  Values are boolean, composite, date, double, geo_point, geo_shape, ip, keyword, long, or lookup.
  enabledboolean
  subobjectsstring
  Values are true or false.
  _data_stream_timestampobject
  Hide _data_stream_timestamp attribute Show _data_stream_timestamp attribute object
  enabledboolean Required
  aliasesobject
  Hide aliases attribute Show aliases attribute object
  *object Additional properties
  Hide * attributes Show * attributes object
  filterobject
  An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
  External documentation
  index_routingstring
  Value used to route indexing operations to a specific shard. If specified, this overwrites the routing value for indexing operations.
  is_write_indexboolean
  If true, the index is the write index for the alias.
  routingstring
  Value used to route indexing and search operations to a specific shard.
  search_routingstring
  Value used to route search operations to a specific shard. If specified, this overwrites the routing value for search operations.
  is_hiddenboolean Generally available; Added in 7.16.0
  If true, the alias is hidden. All indices for the alias must have the same is_hidden value.
  lifecycleobject
  Data stream lifecycle with rollover can be used to display the configuration including the default rollover conditions, if asked.
  Hide lifecycle attributes Show lifecycle attributes object
  data_retentionstring
  A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
  downsamplingobject
  Hide downsampling attribute Show downsampling attribute object
  roundsarray[object] Required
  The list of downsampling rounds to execute as part of this downsampling configuration
  enabledboolean
  If defined, it turns data stream lifecycle on/off (true/false) for this data stream. A data stream lifecycle that's disabled (enabled: false) will have no effect on the data stream.
  rolloverobject
  Hide rollover attributes Show rollover attributes object
  min_agestring
  A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
  max_agestring
  min_docsnumber
  max_docsnumber
  min_size
  max_size
  min_primary_shard_size
  max_primary_shard_size
  min_primary_shard_docsnumber
  max_primary_shard_docsnumber
  data_stream_optionsobject | string | null
  One of:
  DataStreamOptionsTemplateobject string-2string | null
  versionnumber
  _metaobject
  Hide _meta attribute Show _meta attribute object
  *object Additional properties
  deprecatedboolean
index_template_substitutionsobject
A map of index template names to substitute index template definition objects.
Hide index_template_substitutions attribute Show index_template_substitutions attribute object
- *object
  Hide * attributes Show * attributes object
  index_patternsstring | array[string] Required
  composed_ofarray[string] Required
  An ordered list of component template names. Component templates are merged in the order specified, meaning that the last component template specified has the highest precedence.
  templateobject
  Hide template attributes Show template attributes object
  aliasesobject
  Aliases to add. If the index template includes a data_stream object, these are data stream aliases. Otherwise, these are index aliases. Data stream aliases ignore the index_routing, routing, and search_routing options.
  Hide aliases attribute Show aliases attribute object
  *object Additional properties
  Hide * attributes Show * attributes object
  filterobject
  An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
  External documentation
  index_routingstring
  is_hiddenboolean
  If true, the alias is hidden. All indices for the alias must have the same is_hidden value.
  is_write_indexboolean
  If true, the index is the write index for the alias.
  routingstring
  search_routingstring
  mappingsobject
  Hide mappings attributes Show mappings attributes object
  all_fieldobject
  Hide all_field attributes Show all_field attributes object
  analyzerstring Required
  enabledboolean Required
  omit_normsboolean Required
  search_analyzerstring Required
  similaritystring Required
  storeboolean Required
  store_term_vector_offsetsboolean Required
  store_term_vector_payloadsboolean Required
  store_term_vector_positionsboolean Required
  store_term_vectorsboolean Required
  date_detectionboolean
  dynamicstring
  Values are strict, runtime, true, or false.
  dynamic_date_formatsarray[string]
  dynamic_templatesarray[object]
  _field_namesobject
  Hide _field_names attribute Show _field_names attribute object
  enabledboolean Required
  index_fieldobject
  Hide index_field attribute Show index_field attribute object
  enabledboolean Required
  _metaobject
  Hide _meta attribute Show _meta attribute object
  *object Additional properties
  numeric_detectionboolean
  propertiesobject
  _routingobject
  Hide _routing attribute Show _routing attribute object
  requiredboolean Required
  _sizeobject
  Hide _size attribute Show _size attribute object
  enabledboolean Required
  _sourceobject
  Hide _source attributes Show _source attributes object
  compressboolean
  compress_thresholdstring
  enabledboolean
  excludesarray[string]
  includesarray[string]
  modestring
  Values are disabled, stored, or synthetic.
  runtimeobject
  Hide runtime attribute Show runtime attribute object
  *object Additional properties
  Hide * attributes Show * attributes object
  fieldsobject
  For type composite
  fetch_fieldsarray[object]
  For type lookup
  formatstring
  A custom format for date type runtime fields.
  input_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_indexstring
  scriptobject
  typestring Required
  Values are boolean, composite, date, double, geo_point, geo_shape, ip, keyword, long, or lookup.
  enabledboolean
  subobjectsstring
  Values are true or false.
  _data_stream_timestampobject
  Hide _data_stream_timestamp attribute Show _data_stream_timestamp attribute object
  enabledboolean Required
  settingsobject
  Index settings
  lifecycleobject
  Data stream lifecycle with rollover can be used to display the configuration including the default rollover conditions, if asked.
  Hide lifecycle attributes Show lifecycle attributes object
  data_retentionstring
  A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
  downsamplingobject
  Hide downsampling attribute Show downsampling attribute object
  roundsarray[object] Required
  The list of downsampling rounds to execute as part of this downsampling configuration
  enabledboolean
  If defined, it turns data stream lifecycle on/off (true/false) for this data stream. A data stream lifecycle that's disabled (enabled: false) will have no effect on the data stream.
  rolloverobject
  Hide rollover attributes Show rollover attributes object
  min_agestring
  A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
  max_agestring
  min_docsnumber
  max_docsnumber
  min_size
  max_size
  min_primary_shard_size
  max_primary_shard_size
  min_primary_shard_docsnumber
  max_primary_shard_docsnumber
  data_stream_optionsobject | string | null
  One of:
  DataStreamOptionsTemplateobject string-2string | null
  versionnumber
  prioritynumber
  Priority to determine index template precedence when a new data stream or index is created. The index template with the highest priority is chosen. If no priority is specified the template is treated as though it is of priority 0 (lowest priority). This number is not automatically generated by Elasticsearch.
  _metaobject
  Hide _meta attribute Show _meta attribute object
  *object Additional properties
  allow_auto_createboolean
  data_streamobject
  Hide data_stream attributes Show data_stream attributes object
  hiddenboolean
  If true, the data stream is hidden.
  allow_custom_routingboolean
  If true, the data stream supports custom routing.
  deprecatedboolean Generally available; Added in 8.12.0
  Marks this index template as deprecated. When creating or updating a non-deprecated index template that uses deprecated components, Elasticsearch will emit a deprecation warning.
  ignore_missing_component_templatesstring | array[string]
mapping_additionobject
Hide mapping_addition attributes Show mapping_addition attributes object
pipeline_substitutionsobject
Pipelines to test. If you don’t specify the pipeline request path parameter, this parameter is required. If you specify both this and the request path parameter, the API only uses the request path parameter.
Hide pipeline_substitutions attribute Show pipeline_substitutions attribute object
- *object Additional properties
  Hide * attributes Show * attributes object
  descriptionstring
  Description of the ingest pipeline.
  on_failurearray[object]
  Processors to run immediately after a processor failure.
  Hide on_failure attributes Show on_failure attributes object
  appendobject
  Hide append attributes Show append attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  value
  allow_duplicatesboolean
  If false, the processor does not append values already present in the field.
  attachmentobject
  Hide attachment attributes Show attachment attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  indexed_charsnumber
  The number of chars being used for extraction to prevent huge fields. Use -1 for no limit.
  indexed_chars_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Array of properties to select to be stored. Can be content, title, name, author, keywords, date, content_type, content_length, language.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  remove_binaryboolean
  If true, the binary field will be removed from the document
  resource_namestring
  Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
  bytesobject
  Hide bytes attributes Show bytes attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  circleobject
  Hide circle attributes Show circle attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  error_distancenumber Required
  The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for geo_shape, unit-less for shape).
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  shape_typestring Required
  Values are geo_shape or shape.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  community_idobject
  Hide community_id attributes Show community_id attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  source_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  source_portstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_portstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  iana_numberstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  icmp_typestring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  icmp_codestring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  transportstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  seednumber
  Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  convertobject
  Hide convert attributes Show convert attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  typestring Required
  Values are integer, long, double, float, boolean, ip, string, or auto.
  csvobject
  Hide csv attributes Show csv attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  empty_valueobject
  Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes ("").
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  quotestring
  Quote used in CSV, has to be single character string.
  separatorstring
  Separator used in CSV, has to be single character string.
  target_fieldsstring | array[string] Required
  trimboolean
  Trim whitespaces in unquoted fields.
  dateobject
  Hide date attributes Show date attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  formatsarray[string] Required
  An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  localestring
  The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  timezonestring
  The timezone to use when parsing the date. Supports template snippets.
  output_formatstring
  The format to use when writing the date to target_field. Must be a valid java time pattern.
  date_index_nameobject
  Hide date_index_name attributes Show date_index_name attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  date_formatsarray[string]
  An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  date_roundingstring Required
  How to round the date when formatting the date into the index name. Valid values are: y (year), M (month), w (week), d (day), h (hour), m (minute) and s (second). Supports template snippets.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  index_name_formatstring
  The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
  index_name_prefixstring
  A prefix of the index name to be prepended before the printed date. Supports template snippets.
  localestring
  The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
  timezonestring
  The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
  dissectobject
  Hide dissect attributes Show dissect attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  append_separatorstring
  The character(s) that separate the appended fields.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  patternstring Required
  The pattern to apply to the field.
  dot_expanderobject
  Hide dot_expander attributes Show dot_expander attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  overrideboolean
  Controls the behavior when there is already an existing nested object that conflicts with the expanded field. When false, the processor will merge conflicts by combining the old and the new values into an array. When true, the value from the expanded field will overwrite the existing value.
  pathstring
  The field that contains the field to expand. Only required if the field to expand is part another object field, because the field option can only understand leaf fields.
  dropobject
  Hide drop attributes Show drop attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  enrichobject
  Hide enrich attributes Show enrich attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  max_matchesnumber
  The maximum number of matched documents to include under the configured target field. The target_field will be turned into a json array if max_matches is higher than 1, otherwise target_field will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128.
  overrideboolean
  If processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
  policy_namestring Required
  The name of the enrich policy to use.
  shape_relationstring
  Values are intersects, disjoint, within, or contains.
  target_fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  failobject
  Hide fail attributes Show fail attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  messagestring Required
  The error message thrown by the processor. Supports template snippets.
  fingerprintobject
  Hide fingerprint attributes Show fingerprint attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldsstring | array[string] Required
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  saltstring
  Salt value for the hash function.
  methodstring
  Values are MD5, SHA-1, SHA-256, SHA-512, or MurmurHash3.
  ignore_missingboolean
  If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
  foreachobject
  Hide foreach attributes Show foreach attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true, the processor silently exits without changing the document if the field is null or missing.
  processorobject Required
  ip_locationobject
  Hide ip_location attributes Show ip_location attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  database_filestring
  The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  first_onlyboolean
  If true, only the first found IP location data will be returned, even if the field contains an array.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  propertiesarray[string]
  Controls what properties are added to the target_field based on the IP location lookup.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  download_database_on_pipeline_creationboolean
  If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
  geo_gridobject
  Hide geo_grid attributes Show geo_grid attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  The field to interpret as a geo-tile.= The field format is determined by the tile_type.
  tile_typestring Required
  Values are geotile, geohex, or geohash.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  parent_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  children_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  non_children_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  precision_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_formatstring
  Values are geojson or wkt.
  geoipobject
  Hide geoip attributes Show geoip attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  database_filestring
  The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  first_onlyboolean
  If true, only the first found geoip data will be returned, even if the field contains an array.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  propertiesarray[string]
  Controls what properties are added to the target_field based on the geoip lookup.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  download_database_on_pipeline_creationboolean
  If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
  grokobject
  Hide grok attributes Show grok attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  ecs_compatibilitystring
  Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  pattern_definitionsobject
  A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
  patternsarray[string] Required
  An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
  trace_matchboolean
  When true, _ingest._grok_match_index will be inserted into your matched document’s metadata with the index into the pattern found in patterns that matched.
  gsubobject
  Hide gsub attributes Show gsub attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  patternstring Required
  The pattern to be replaced.
  replacementstring Required
  The string to replace the matching patterns with.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  html_stripobject
  Hide html_strip attributes Show html_strip attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document,
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  inferenceobject
  Hide inference attributes Show inference attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  model_idstring Required
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  field_mapobject
  Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
  inference_configobject
  input_output
  ignore_missingboolean
  If true and any of the input fields defined in input_ouput are missing then those missing fields are quietly ignored, otherwise a missing field causes a failure. Only applies when using input_output configurations to explicitly list the input fields.
  joinobject
  Hide join attributes Show join attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  separatorstring Required
  The separator character.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  jsonobject
  Hide json attributes Show json attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  add_to_rootboolean
  Flag that forces the parsed JSON to be added at the top level of the document. target_field must not be set when this option is chosen.
  add_to_root_conflict_strategystring
  Values are replace or merge.
  allow_duplicate_keysboolean
  When set to true, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  kvobject
  Hide kv attributes Show kv attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  exclude_keysarray[string]
  List of keys to exclude from document.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  field_splitstring Required
  Regex pattern to use for splitting key-value pairs.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  include_keysarray[string]
  List of keys to filter and insert into document. Defaults to including all keys.
  prefixstring
  Prefix to be added to extracted keys.
  strip_bracketsboolean
  If true. strip brackets (), <>, [] as well as quotes ' and " from extracted values.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  trim_keystring
  String of characters to trim from extracted keys.
  trim_valuestring
  String of characters to trim from extracted values.
  value_splitstring Required
  Regex pattern to use for splitting the key from the value within a key-value pair.
  lowercaseobject
  Hide lowercase attributes Show lowercase attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  network_directionobject
  Hide network_direction attributes Show network_direction attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  source_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  internal_networksarray[string]
  List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
  internal_networks_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  pipelineobject
  Hide pipeline attributes Show pipeline attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  namestring Required
  ignore_missing_pipelineboolean
  Whether to ignore missing pipelines instead of failing.
  redactobject
  Hide redact attributes Show redact attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  patternsarray[string] Required
  A list of grok expressions to match and redact named captures with
  pattern_definitionsobject
  prefixstring
  Start a redacted section with this token
  suffixstring
  End a redacted section with this token
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  skip_if_unlicensedboolean
  If true and the current license does not support running redact processors, then the processor quietly exits without modifying the document
  trace_redactboolean Generally available; Added in 8.16.0
  If true then ingest metadata _ingest._redact._is_redacted is set to true if the document has been redacted
  registered_domainobject
  Hide registered_domain attributes Show registered_domain attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  removeobject
  Hide remove attributes Show remove attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring | array[string] Required
  keepstring | array[string]
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  renameobject
  Hide rename attributes Show rename attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  rerouteobject
  Hide reroute attributes Show reroute attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  destinationstring
  A static value for the target. Can’t be set when the dataset or namespace option is set.
  dataset
  namespace
  scriptobject
  Hide script attributes Show script attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  idstring
  lang
  paramsobject
  Object containing parameters for the script.
  source
  setobject
  Hide set attributes Show set attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  copy_fromstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_empty_valueboolean
  If true and value is a template snippet that evaluates to null or the empty string, the processor quietly exits without modifying the document.
  media_typestring
  The media type for encoding value. Applies only when value is a template snippet. Must be one of application/json, text/plain, or application/x-www-form-urlencoded.
  overrideboolean
  If true processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
  valueobject
  The value to be set for the field. Supports template snippets. May specify only one of value or copy_from.
  set_security_userobject
  Hide set_security_user attributes Show set_security_user attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Controls what user related properties are added to the field.
  sortobject
  Hide sort attributes Show sort attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  orderstring
  Values are asc or desc.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  splitobject
  Hide split attributes Show split attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  preserve_trailingboolean
  Preserves empty trailing fields, if any.
  separatorstring Required
  A regex which matches the separator, for example, , or \s+.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  terminateobject
  Hide terminate attributes Show terminate attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  trimobject
  Hide trim attributes Show trim attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  uppercaseobject
  Hide uppercase attributes Show uppercase attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  urldecodeobject
  Hide urldecode attributes Show urldecode attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  uri_partsobject
  Hide uri_parts attributes Show uri_parts attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  keep_originalboolean
  If true, the processor copies the unparsed URI to <target_field>.original.
  remove_if_successfulboolean
  If true, the processor removes the field after parsing the URI string. If parsing fails, the processor does not remove the field.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  user_agentobject
  Hide user_agent attributes Show user_agent attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  regex_filestring
  The name of the file in the config/ingest-user-agent directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the regexes.yaml from uap-core it ships with.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Controls what properties are added to target_field.
  Values are name, os, device, original, or version.
  extract_device_typeboolean Beta; Added in 8.9.0
  Extracts device type from the user agent string on a best-effort basis.
  processorsarray[object]
  Processors used to perform transformations on documents before indexing. Processors run sequentially in the order specified.
  Hide processors attributes Show processors attributes object
  appendobject
  Hide append attributes Show append attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  value
  allow_duplicatesboolean
  If false, the processor does not append values already present in the field.
  attachmentobject
  Hide attachment attributes Show attachment attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  indexed_charsnumber
  The number of chars being used for extraction to prevent huge fields. Use -1 for no limit.
  indexed_chars_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Array of properties to select to be stored. Can be content, title, name, author, keywords, date, content_type, content_length, language.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  remove_binaryboolean
  If true, the binary field will be removed from the document
  resource_namestring
  Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
  bytesobject
  Hide bytes attributes Show bytes attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  circleobject
  Hide circle attributes Show circle attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  error_distancenumber Required
  The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for geo_shape, unit-less for shape).
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  shape_typestring Required
  Values are geo_shape or shape.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  community_idobject
  Hide community_id attributes Show community_id attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  source_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  source_portstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_portstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  iana_numberstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  icmp_typestring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  icmp_codestring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  transportstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  seednumber
  Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  convertobject
  Hide convert attributes Show convert attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  typestring Required
  Values are integer, long, double, float, boolean, ip, string, or auto.
  csvobject
  Hide csv attributes Show csv attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  empty_valueobject
  Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes ("").
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  quotestring
  Quote used in CSV, has to be single character string.
  separatorstring
  Separator used in CSV, has to be single character string.
  target_fieldsstring | array[string] Required
  trimboolean
  Trim whitespaces in unquoted fields.
  dateobject
  Hide date attributes Show date attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  formatsarray[string] Required
  An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  localestring
  The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  timezonestring
  The timezone to use when parsing the date. Supports template snippets.
  output_formatstring
  The format to use when writing the date to target_field. Must be a valid java time pattern.
  date_index_nameobject
  Hide date_index_name attributes Show date_index_name attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  date_formatsarray[string]
  An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  date_roundingstring Required
  How to round the date when formatting the date into the index name. Valid values are: y (year), M (month), w (week), d (day), h (hour), m (minute) and s (second). Supports template snippets.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  index_name_formatstring
  The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
  index_name_prefixstring
  A prefix of the index name to be prepended before the printed date. Supports template snippets.
  localestring
  The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
  timezonestring
  The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
  dissectobject
  Hide dissect attributes Show dissect attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  append_separatorstring
  The character(s) that separate the appended fields.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  patternstring Required
  The pattern to apply to the field.
  dot_expanderobject
  Hide dot_expander attributes Show dot_expander attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  overrideboolean
  Controls the behavior when there is already an existing nested object that conflicts with the expanded field. When false, the processor will merge conflicts by combining the old and the new values into an array. When true, the value from the expanded field will overwrite the existing value.
  pathstring
  The field that contains the field to expand. Only required if the field to expand is part another object field, because the field option can only understand leaf fields.
  dropobject
  Hide drop attributes Show drop attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  enrichobject
  Hide enrich attributes Show enrich attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  max_matchesnumber
  The maximum number of matched documents to include under the configured target field. The target_field will be turned into a json array if max_matches is higher than 1, otherwise target_field will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128.
  overrideboolean
  If processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
  policy_namestring Required
  The name of the enrich policy to use.
  shape_relationstring
  Values are intersects, disjoint, within, or contains.
  target_fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  failobject
  Hide fail attributes Show fail attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  messagestring Required
  The error message thrown by the processor. Supports template snippets.
  fingerprintobject
  Hide fingerprint attributes Show fingerprint attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldsstring | array[string] Required
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  saltstring
  Salt value for the hash function.
  methodstring
  Values are MD5, SHA-1, SHA-256, SHA-512, or MurmurHash3.
  ignore_missingboolean
  If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
  foreachobject
  Hide foreach attributes Show foreach attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true, the processor silently exits without changing the document if the field is null or missing.
  processorobject Required
  ip_locationobject
  Hide ip_location attributes Show ip_location attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  database_filestring
  The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  first_onlyboolean
  If true, only the first found IP location data will be returned, even if the field contains an array.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  propertiesarray[string]
  Controls what properties are added to the target_field based on the IP location lookup.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  download_database_on_pipeline_creationboolean
  If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
  geo_gridobject
  Hide geo_grid attributes Show geo_grid attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  The field to interpret as a geo-tile.= The field format is determined by the tile_type.
  tile_typestring Required
  Values are geotile, geohex, or geohash.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  parent_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  children_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  non_children_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  precision_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_formatstring
  Values are geojson or wkt.
  geoipobject
  Hide geoip attributes Show geoip attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  database_filestring
  The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  first_onlyboolean
  If true, only the first found geoip data will be returned, even if the field contains an array.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  propertiesarray[string]
  Controls what properties are added to the target_field based on the geoip lookup.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  download_database_on_pipeline_creationboolean
  If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
  grokobject
  Hide grok attributes Show grok attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  ecs_compatibilitystring
  Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  pattern_definitionsobject
  A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
  patternsarray[string] Required
  An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
  trace_matchboolean
  When true, _ingest._grok_match_index will be inserted into your matched document’s metadata with the index into the pattern found in patterns that matched.
  gsubobject
  Hide gsub attributes Show gsub attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  patternstring Required
  The pattern to be replaced.
  replacementstring Required
  The string to replace the matching patterns with.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  html_stripobject
  Hide html_strip attributes Show html_strip attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document,
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  inferenceobject
  Hide inference attributes Show inference attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  model_idstring Required
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  field_mapobject
  Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
  inference_configobject
  input_output
  ignore_missingboolean
  If true and any of the input fields defined in input_ouput are missing then those missing fields are quietly ignored, otherwise a missing field causes a failure. Only applies when using input_output configurations to explicitly list the input fields.
  joinobject
  Hide join attributes Show join attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  separatorstring Required
  The separator character.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  jsonobject
  Hide json attributes Show json attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  add_to_rootboolean
  Flag that forces the parsed JSON to be added at the top level of the document. target_field must not be set when this option is chosen.
  add_to_root_conflict_strategystring
  Values are replace or merge.
  allow_duplicate_keysboolean
  When set to true, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  kvobject
  Hide kv attributes Show kv attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  exclude_keysarray[string]
  List of keys to exclude from document.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  field_splitstring Required
  Regex pattern to use for splitting key-value pairs.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  include_keysarray[string]
  List of keys to filter and insert into document. Defaults to including all keys.
  prefixstring
  Prefix to be added to extracted keys.
  strip_bracketsboolean
  If true. strip brackets (), <>, [] as well as quotes ' and " from extracted values.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  trim_keystring
  String of characters to trim from extracted keys.
  trim_valuestring
  String of characters to trim from extracted values.
  value_splitstring Required
  Regex pattern to use for splitting the key from the value within a key-value pair.
  lowercaseobject
  Hide lowercase attributes Show lowercase attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  network_directionobject
  Hide network_direction attributes Show network_direction attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  source_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  internal_networksarray[string]
  List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
  internal_networks_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  pipelineobject
  Hide pipeline attributes Show pipeline attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  namestring Required
  ignore_missing_pipelineboolean
  Whether to ignore missing pipelines instead of failing.
  redactobject
  Hide redact attributes Show redact attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  patternsarray[string] Required
  A list of grok expressions to match and redact named captures with
  pattern_definitionsobject
  prefixstring
  Start a redacted section with this token
  suffixstring
  End a redacted section with this token
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  skip_if_unlicensedboolean
  If true and the current license does not support running redact processors, then the processor quietly exits without modifying the document
  trace_redactboolean Generally available; Added in 8.16.0
  If true then ingest metadata _ingest._redact._is_redacted is set to true if the document has been redacted
  registered_domainobject
  Hide registered_domain attributes Show registered_domain attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  removeobject
  Hide remove attributes Show remove attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring | array[string] Required
  keepstring | array[string]
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  renameobject
  Hide rename attributes Show rename attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  rerouteobject
  Hide reroute attributes Show reroute attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  destinationstring
  A static value for the target. Can’t be set when the dataset or namespace option is set.
  dataset
  namespace
  scriptobject
  Hide script attributes Show script attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  idstring
  lang
  paramsobject
  Object containing parameters for the script.
  source
  setobject
  Hide set attributes Show set attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  copy_fromstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_empty_valueboolean
  If true and value is a template snippet that evaluates to null or the empty string, the processor quietly exits without modifying the document.
  media_typestring
  The media type for encoding value. Applies only when value is a template snippet. Must be one of application/json, text/plain, or application/x-www-form-urlencoded.
  overrideboolean
  If true processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
  valueobject
  The value to be set for the field. Supports template snippets. May specify only one of value or copy_from.
  set_security_userobject
  Hide set_security_user attributes Show set_security_user attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Controls what user related properties are added to the field.
  sortobject
  Hide sort attributes Show sort attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  orderstring
  Values are asc or desc.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  splitobject
  Hide split attributes Show split attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  preserve_trailingboolean
  Preserves empty trailing fields, if any.
  separatorstring Required
  A regex which matches the separator, for example, , or \s+.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  terminateobject
  Hide terminate attributes Show terminate attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  trimobject
  Hide trim attributes Show trim attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  uppercaseobject
  Hide uppercase attributes Show uppercase attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  urldecodeobject
  Hide urldecode attributes Show urldecode attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  uri_partsobject
  Hide uri_parts attributes Show uri_parts attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  keep_originalboolean
  If true, the processor copies the unparsed URI to <target_field>.original.
  remove_if_successfulboolean
  If true, the processor removes the field after parsing the URI string. If parsing fails, the processor does not remove the field.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  user_agentobject
  Hide user_agent attributes Show user_agent attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  regex_filestring
  The name of the file in the config/ingest-user-agent directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the regexes.yaml from uap-core it ships with.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Controls what properties are added to target_field.
  Values are name, os, device, original, or version.
  extract_device_typeboolean Beta; Added in 8.9.0
  Extracts device type from the user agent string on a best-effort basis.
  versionnumber
  deprecatedboolean
  Marks this ingest pipeline as deprecated. When a deprecated ingest pipeline is referenced as the default or final pipeline when creating or updating a non-deprecated index template, Elasticsearch will emit a deprecation warning.
  _metaobject
  Hide _meta attribute Show _meta attribute object
  *object Additional properties

In this example the index `my-index` has a default pipeline called `my-pipeline` and a final pipeline called `my-final-pipeline`. Since both documents are being ingested into `my-index`, both pipelines are run using the pipeline definitions that are already in the system.

{
  "docs": [
    {
      "_id": 123,
      "_index": "my-index",
      "_source": {
        "foo": "bar"
      }
    },
    {
      "_id": 456,
      "_index": "my-index",
      "_source": {
        "foo": "rab"
      }
    }
  ]
}

In this example the index `my-index` has a default pipeline called `my-pipeline` and a final pipeline called `my-final-pipeline`. But a substitute definition of `my-pipeline` is provided in `pipeline_substitutions`. The substitute `my-pipeline` will be used in place of the `my-pipeline` that is in the system, and then the `my-final-pipeline` that is already defined in the system will run.

{
  "docs": [
    {
      "_index": "my-index",
      "_id": 123,
      "_source": {
        "foo": "bar"
      }
    },
    {
      "_index": "my-index",
      "_id": 456,
      "_source": {
        "foo": "rab"
      }
    }
  ],
  "pipeline_substitutions": {
    "my-pipeline": {
      "processors": [
        {
          "uppercase": {
            "field": "foo"
          }
        }
      ]
    }
  }
}

In this example, imagine that the index `my-index` has a strict mapping with only the `foo` keyword field defined. Say that field mapping came from a component template named `my-mappings-template`. You want to test adding a new field, `bar`. So a substitute definition of `my-mappings-template` is provided in `component_template_substitutions`. The substitute `my-mappings-template` will be used in place of the existing mapping for `my-index` and in place of the `my-mappings-template` that is in the system.

{
  "docs": [
    {
      "_index": "my-index",
      "_id": "123",
      "_source": {
        "foo": "foo"
      }
    },
    {
      "_index": "my-index",
      "_id": "456",
      "_source": {
        "bar": "rab"
      }
    }
  ],
  "component_template_substitutions": {
    "my-mappings_template": {
      "template": {
        "mappings": {
          "dynamic": "strict",
          "properties": {
            "foo": {
              "type": "keyword"
            },
            "bar": {
              "type": "keyword"
            }
          }
        }
      }
    }
  }
}

The pipeline, component template, and index template substitutions replace the existing pipeline details for the duration of this request.

{
  "docs": [
    {
      "_id": "id",
      "_index": "my-index",
      "_source": {
        "foo": "bar"
      }
    },
    {
      "_id": "id",
      "_index": "my-index",
      "_source": {
        "foo": "rab"
      }
    }
  ],
  "pipeline_substitutions": {
    "my-pipeline": {
      "processors": [
        {
          "set": {
            "field": "field3",
            "value": "value3"
          }
        }
      ]
    }
  },
  "component_template_substitutions": {
    "my-component-template": {
      "template": {
        "mappings": {
          "dynamic": true,
          "properties": {
            "field3": {
              "type": "keyword"
            }
          }
        },
        "settings": {
          "index": {
            "default_pipeline": "my-pipeline"
          }
        }
      }
    }
  },
  "index_template_substitutions": {
    "my-index-template": {
      "index_patterns": [
        "my-index-*"
      ],
      "composed_of": [
        "component_template_1",
        "component_template_2"
      ]
    }
  },
  "mapping_addition": {
    "dynamic": "strict",
    "properties": {
      "foo": {
        "type": "keyword"
      }
    }
  }
}

Response examples (200)

A successful response when the simulation uses pipeline definitions that are already in the system.

{
  "docs": [
    {
      "doc": null,
      "_id": 123,
      "_index": "my-index",
      "_version": -3,
      "_source": {
        "field1": "value1",
        "field2": "value2",
        "foo": "bar"
      },
      "executed_pipelines": [
        "my-pipeline",
        "my-final-pipeline"
      ]
    },
    {
      "doc": null,
      "_id": 456,
      "_index": "my-index",
      "_version": "-3,",
      "_source": {
        "field1": "value1",
        "field2": "value2",
        "foo": "rab"
      },
      "executed_pipelines": [
        "my-pipeline",
        "my-final-pipeline"
      ]
    }
  ]
}

A successful response when the simulation uses pipeline substitutions.

{
  "docs": [
    {
      "doc": null,
      "_id": 123,
      "_index": "my-index",
      "_version": -3,
      "_source": {
        "field2": "value2",
        "foo": "BAR"
      },
      "executed_pipelines": [
        "my-pipeline",
        "my-final-pipeline"
      ]
    },
    {
      "doc": null,
      "_id": 456,
      "_index": "my-index",
      "_version": -3,
      "_source": {
        "field2": "value2",
        "foo": "RAB"
      },
      "executed_pipelines": [
        "my-pipeline",
        "my-final-pipeline"
      ]
    }
  ]
}

A successful response when the simulation uses pipeline substitutions.

{
  "docs": [
    {
      "doc": {
        "_id": "123",
        "_index": "my-index",
        "_version": -3,
        "_source": {
          "foo": "foo"
        },
        "executed_pipelines": []
      }
    },
    {
      "doc": {
        "_id": "456",
        "_index": "my-index",
        "_version": -3,
        "_source": {
          "bar": "rab"
        },
      "executed_pipelines": []
      }
    }
  ]
}

Query parameters

BodyRequired

data_stream_optionsobject | string | null

failure_storeobject | string | null

data_stream_optionsobject | string | null

failure_storeobject | string | null

Responses

_versionnumber | string Required

reasonstring | null