Simulate a pipeline | Elasticsearch API documentation (v8)

Path parameters

idstring Required
The pipeline to test. If you don't specify a pipeline in the request body, this parameter is required.

Query parameters

verboseboolean
If true, the response includes output data for each processor in the executed pipeline.

application/json

BodyRequired

docsarray[object] Required
Sample documents to test in the pipeline.
Hide docs attributes Show docs attributes object
- _idstring
- _indexstring
- _sourceobject Required
  JSON body for the document.
pipelineobject Additional properties
Hide pipeline attributes Show pipeline attributes object
- descriptionstring
  Description of the ingest pipeline.
- on_failurearray[object]
  Processors to run immediately after a processor failure.
  Hide on_failure attributes Show on_failure attributes object
  appendobject
  Hide append attributes Show append attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  valueobject | array[object] Required
  The value to be appended. Supports template snippets.
  One of:
  object-1object array-2array[object]
  allow_duplicatesboolean
  If false, the processor does not append values already present in the field.
  attachmentobject
  Hide attachment attributes Show attachment attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  indexed_charsnumber
  The number of chars being used for extraction to prevent huge fields. Use -1 for no limit.
  indexed_chars_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Array of properties to select to be stored. Can be content, title, name, author, keywords, date, content_type, content_length, language.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  remove_binaryboolean
  If true, the binary field will be removed from the document
  resource_namestring
  Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
  bytesobject
  Hide bytes attributes Show bytes attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  circleobject
  Hide circle attributes Show circle attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  error_distancenumber Required
  The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for geo_shape, unit-less for shape).
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  shape_typestring Required
  Values are geo_shape or shape.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  community_idobject
  Hide community_id attributes Show community_id attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  source_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  source_portstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_portstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  iana_numberstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  icmp_typestring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  icmp_codestring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  transportstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  seednumber
  Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  convertobject
  Hide convert attributes Show convert attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  typestring Required
  Values are integer, long, double, float, boolean, ip, string, or auto.
  csvobject
  Hide csv attributes Show csv attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  empty_valueobject
  Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes ("").
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  quotestring
  Quote used in CSV, has to be single character string.
  separatorstring
  Separator used in CSV, has to be single character string.
  target_fieldsstring | array[string] Required
  trimboolean
  Trim whitespaces in unquoted fields.
  dateobject
  Hide date attributes Show date attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  formatsarray[string] Required
  An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  localestring
  The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  timezonestring
  The timezone to use when parsing the date. Supports template snippets.
  output_formatstring
  The format to use when writing the date to target_field. Must be a valid java time pattern.
  date_index_nameobject
  Hide date_index_name attributes Show date_index_name attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  date_formatsarray[string] Required
  An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  date_roundingstring Required
  How to round the date when formatting the date into the index name. Valid values are: y (year), M (month), w (week), d (day), h (hour), m (minute) and s (second). Supports template snippets.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  index_name_formatstring
  The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
  index_name_prefixstring
  A prefix of the index name to be prepended before the printed date. Supports template snippets.
  localestring
  The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
  timezonestring
  The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
  dissectobject
  Hide dissect attributes Show dissect attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  append_separatorstring
  The character(s) that separate the appended fields.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  patternstring Required
  The pattern to apply to the field.
  dot_expanderobject
  Hide dot_expander attributes Show dot_expander attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  overrideboolean
  Controls the behavior when there is already an existing nested object that conflicts with the expanded field. When false, the processor will merge conflicts by combining the old and the new values into an array. When true, the value from the expanded field will overwrite the existing value.
  pathstring
  The field that contains the field to expand. Only required if the field to expand is part another object field, because the field option can only understand leaf fields.
  dropobject
  Hide drop attributes Show drop attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  enrichobject
  Hide enrich attributes Show enrich attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  max_matchesnumber
  The maximum number of matched documents to include under the configured target field. The target_field will be turned into a json array if max_matches is higher than 1, otherwise target_field will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128.
  overrideboolean
  If processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
  policy_namestring Required
  The name of the enrich policy to use.
  shape_relationstring
  Values are intersects, disjoint, within, or contains.
  target_fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  failobject
  Hide fail attributes Show fail attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  messagestring Required
  The error message thrown by the processor. Supports template snippets.
  fingerprintobject
  Hide fingerprint attributes Show fingerprint attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldsstring | array[string] Required
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  saltstring
  Salt value for the hash function.
  methodstring
  Values are MD5, SHA-1, SHA-256, SHA-512, or MurmurHash3.
  ignore_missingboolean
  If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
  foreachobject
  Hide foreach attributes Show foreach attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true, the processor silently exits without changing the document if the field is null or missing.
  processorobject Required
  ip_locationobject
  Hide ip_location attributes Show ip_location attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  database_filestring
  The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  first_onlyboolean
  If true, only the first found IP location data will be returned, even if the field contains an array.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  propertiesarray[string]
  Controls what properties are added to the target_field based on the IP location lookup.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  download_database_on_pipeline_creationboolean
  If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
  geo_gridobject
  Hide geo_grid attributes Show geo_grid attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  The field to interpret as a geo-tile.= The field format is determined by the tile_type.
  tile_typestring Required
  Values are geotile, geohex, or geohash.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  parent_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  children_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  non_children_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  precision_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_formatstring
  Values are geojson or wkt.
  geoipobject
  Hide geoip attributes Show geoip attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  database_filestring
  The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  first_onlyboolean
  If true, only the first found geoip data will be returned, even if the field contains an array.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  propertiesarray[string]
  Controls what properties are added to the target_field based on the geoip lookup.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  download_database_on_pipeline_creationboolean
  If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
  grokobject
  Hide grok attributes Show grok attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  ecs_compatibilitystring
  Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  pattern_definitionsobject
  A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
  Hide pattern_definitions attribute Show pattern_definitions attribute object
  *string Additional properties
  patternsarray[string] Required
  An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
  trace_matchboolean
  When true, _ingest._grok_match_index will be inserted into your matched document’s metadata with the index into the pattern found in patterns that matched.
  gsubobject
  Hide gsub attributes Show gsub attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  patternstring Required
  The pattern to be replaced.
  replacementstring Required
  The string to replace the matching patterns with.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  html_stripobject
  Hide html_strip attributes Show html_strip attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document,
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  inferenceobject
  Hide inference attributes Show inference attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  model_idstring Required
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  field_mapobject
  Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
  Hide field_map attribute Show field_map attribute object
  *object Additional properties
  inference_configobject
  Hide inference_config attributes Show inference_config attributes object
  regressionobject
  classificationobject
  input_outputobject | array[object]
  Input fields for inference and output (destination) fields for the inference results. This option is incompatible with the target_field and field_map options.
  One of:
  InputConfigobject array-2array[object]
  ignore_missingboolean
  If true and any of the input fields defined in input_ouput are missing then those missing fields are quietly ignored, otherwise a missing field causes a failure. Only applies when using input_output configurations to explicitly list the input fields.
  joinobject
  Hide join attributes Show join attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  separatorstring Required
  The separator character.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  jsonobject
  Hide json attributes Show json attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  add_to_rootboolean
  Flag that forces the parsed JSON to be added at the top level of the document. target_field must not be set when this option is chosen.
  add_to_root_conflict_strategystring
  Values are replace or merge.
  allow_duplicate_keysboolean
  When set to true, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  kvobject
  Hide kv attributes Show kv attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  exclude_keysarray[string]
  List of keys to exclude from document.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  field_splitstring Required
  Regex pattern to use for splitting key-value pairs.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  include_keysarray[string]
  List of keys to filter and insert into document. Defaults to including all keys.
  prefixstring
  Prefix to be added to extracted keys.
  strip_bracketsboolean
  If true. strip brackets (), <>, [] as well as quotes ' and " from extracted values.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  trim_keystring
  String of characters to trim from extracted keys.
  trim_valuestring
  String of characters to trim from extracted values.
  value_splitstring Required
  Regex pattern to use for splitting the key from the value within a key-value pair.
  lowercaseobject
  Hide lowercase attributes Show lowercase attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  network_directionobject
  Hide network_direction attributes Show network_direction attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  source_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  internal_networksarray[string]
  List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
  internal_networks_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  pipelineobject
  Hide pipeline attributes Show pipeline attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  namestring Required
  ignore_missing_pipelineboolean
  Whether to ignore missing pipelines instead of failing.
  redactobject
  Hide redact attributes Show redact attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  patternsarray[string] Required
  A list of grok expressions to match and redact named captures with
  pattern_definitionsobject
  Hide pattern_definitions attribute Show pattern_definitions attribute object
  *string Additional properties
  prefixstring
  Start a redacted section with this token
  suffixstring
  End a redacted section with this token
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  skip_if_unlicensedboolean
  If true and the current license does not support running redact processors, then the processor quietly exits without modifying the document
  trace_redactboolean
  If true then ingest metadata _ingest._redact._is_redacted is set to true if the document has been redacted
  registered_domainobject
  Hide registered_domain attributes Show registered_domain attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  removeobject
  Hide remove attributes Show remove attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring | array[string] Required
  keepstring | array[string]
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  renameobject
  Hide rename attributes Show rename attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  rerouteobject
  Hide reroute attributes Show reroute attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  destinationstring
  A static value for the target. Can’t be set when the dataset or namespace option is set.
  datasetstring | array[string]
  Field references or a static value for the dataset part of the data stream name. In addition to the criteria for index names, cannot contain - and must be no longer than 100 characters. Example values are nginx.access and nginx.error.
  Supports field references with a mustache-like syntax (denoted as {{double}} or {{{triple}}} curly braces). When resolving field references, the processor replaces invalid characters with _. Uses the part of the index name as a fallback if all field references resolve to a null, missing, or non-string value.
  default {{data_stream.dataset}}
  One of:
  string-1string array-2array[string]
  namespacestring | array[string]
  Field references or a static value for the namespace part of the data stream name. See the criteria for index names for allowed characters. Must be no longer than 100 characters.
  Supports field references with a mustache-like syntax (denoted as {{double}} or {{{triple}}} curly braces). When resolving field references, the processor replaces invalid characters with _. Uses the part of the index name as a fallback if all field references resolve to a null, missing, or non-string value.
  default {{data_stream.namespace}}
  One of:
  string-1string array-2array[string]
  scriptobject
  Hide script attributes Show script attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  idstring
  langstring
  Script language.
  paramsobject
  Object containing parameters for the script.
  Hide params attribute Show params attribute object
  *object Additional properties
  sourcestring
  Inline script. If no id is specified, this parameter is required.
  setobject
  Hide set attributes Show set attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  copy_fromstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_empty_valueboolean
  If true and value is a template snippet that evaluates to null or the empty string, the processor quietly exits without modifying the document.
  media_typestring
  The media type for encoding value. Applies only when value is a template snippet. Must be one of application/json, text/plain, or application/x-www-form-urlencoded.
  overrideboolean
  If true processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
  valueobject
  The value to be set for the field. Supports template snippets. May specify only one of value or copy_from.
  set_security_userobject
  Hide set_security_user attributes Show set_security_user attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Controls what user related properties are added to the field.
  sortobject
  Hide sort attributes Show sort attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  orderstring
  Values are asc or desc.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  splitobject
  Hide split attributes Show split attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  preserve_trailingboolean
  Preserves empty trailing fields, if any.
  separatorstring Required
  A regex which matches the separator, for example, , or \s+.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  terminateobject
  Hide terminate attributes Show terminate attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  trimobject
  Hide trim attributes Show trim attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  uppercaseobject
  Hide uppercase attributes Show uppercase attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  urldecodeobject
  Hide urldecode attributes Show urldecode attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  uri_partsobject
  Hide uri_parts attributes Show uri_parts attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  keep_originalboolean
  If true, the processor copies the unparsed URI to <target_field>.original.
  remove_if_successfulboolean
  If true, the processor removes the field after parsing the URI string. If parsing fails, the processor does not remove the field.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  user_agentobject
  Hide user_agent attributes Show user_agent attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  regex_filestring
  The name of the file in the config/ingest-user-agent directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the regexes.yaml from uap-core it ships with.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Controls what properties are added to target_field.
  Values are name, os, device, original, or version.
  extract_device_typeboolean Beta
  Extracts device type from the user agent string on a best-effort basis.
- processorsarray[object]
  Processors used to perform transformations on documents before indexing. Processors run sequentially in the order specified.
  Hide processors attributes Show processors attributes object
  appendobject
  Hide append attributes Show append attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  valueobject | array[object] Required
  The value to be appended. Supports template snippets.
  One of:
  object-1object array-2array[object]
  allow_duplicatesboolean
  If false, the processor does not append values already present in the field.
  attachmentobject
  Hide attachment attributes Show attachment attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  indexed_charsnumber
  The number of chars being used for extraction to prevent huge fields. Use -1 for no limit.
  indexed_chars_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Array of properties to select to be stored. Can be content, title, name, author, keywords, date, content_type, content_length, language.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  remove_binaryboolean
  If true, the binary field will be removed from the document
  resource_namestring
  Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
  bytesobject
  Hide bytes attributes Show bytes attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  circleobject
  Hide circle attributes Show circle attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  error_distancenumber Required
  The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for geo_shape, unit-less for shape).
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  shape_typestring Required
  Values are geo_shape or shape.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  community_idobject
  Hide community_id attributes Show community_id attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  source_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  source_portstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_portstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  iana_numberstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  icmp_typestring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  icmp_codestring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  transportstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  seednumber
  Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  convertobject
  Hide convert attributes Show convert attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  typestring Required
  Values are integer, long, double, float, boolean, ip, string, or auto.
  csvobject
  Hide csv attributes Show csv attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  empty_valueobject
  Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes ("").
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  quotestring
  Quote used in CSV, has to be single character string.
  separatorstring
  Separator used in CSV, has to be single character string.
  target_fieldsstring | array[string] Required
  trimboolean
  Trim whitespaces in unquoted fields.
  dateobject
  Hide date attributes Show date attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  formatsarray[string] Required
  An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  localestring
  The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  timezonestring
  The timezone to use when parsing the date. Supports template snippets.
  output_formatstring
  The format to use when writing the date to target_field. Must be a valid java time pattern.
  date_index_nameobject
  Hide date_index_name attributes Show date_index_name attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  date_formatsarray[string] Required
  An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  date_roundingstring Required
  How to round the date when formatting the date into the index name. Valid values are: y (year), M (month), w (week), d (day), h (hour), m (minute) and s (second). Supports template snippets.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  index_name_formatstring
  The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
  index_name_prefixstring
  A prefix of the index name to be prepended before the printed date. Supports template snippets.
  localestring
  The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
  timezonestring
  The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
  dissectobject
  Hide dissect attributes Show dissect attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  append_separatorstring
  The character(s) that separate the appended fields.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  patternstring Required
  The pattern to apply to the field.
  dot_expanderobject
  Hide dot_expander attributes Show dot_expander attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  overrideboolean
  Controls the behavior when there is already an existing nested object that conflicts with the expanded field. When false, the processor will merge conflicts by combining the old and the new values into an array. When true, the value from the expanded field will overwrite the existing value.
  pathstring
  The field that contains the field to expand. Only required if the field to expand is part another object field, because the field option can only understand leaf fields.
  dropobject
  Hide drop attributes Show drop attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  enrichobject
  Hide enrich attributes Show enrich attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  max_matchesnumber
  The maximum number of matched documents to include under the configured target field. The target_field will be turned into a json array if max_matches is higher than 1, otherwise target_field will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128.
  overrideboolean
  If processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
  policy_namestring Required
  The name of the enrich policy to use.
  shape_relationstring
  Values are intersects, disjoint, within, or contains.
  target_fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  failobject
  Hide fail attributes Show fail attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  messagestring Required
  The error message thrown by the processor. Supports template snippets.
  fingerprintobject
  Hide fingerprint attributes Show fingerprint attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldsstring | array[string] Required
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  saltstring
  Salt value for the hash function.
  methodstring
  Values are MD5, SHA-1, SHA-256, SHA-512, or MurmurHash3.
  ignore_missingboolean
  If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
  foreachobject
  Hide foreach attributes Show foreach attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true, the processor silently exits without changing the document if the field is null or missing.
  processorobject Required
  ip_locationobject
  Hide ip_location attributes Show ip_location attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  database_filestring
  The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  first_onlyboolean
  If true, only the first found IP location data will be returned, even if the field contains an array.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  propertiesarray[string]
  Controls what properties are added to the target_field based on the IP location lookup.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  download_database_on_pipeline_creationboolean
  If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
  geo_gridobject
  Hide geo_grid attributes Show geo_grid attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  The field to interpret as a geo-tile.= The field format is determined by the tile_type.
  tile_typestring Required
  Values are geotile, geohex, or geohash.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  parent_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  children_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  non_children_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  precision_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_formatstring
  Values are geojson or wkt.
  geoipobject
  Hide geoip attributes Show geoip attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  database_filestring
  The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  first_onlyboolean
  If true, only the first found geoip data will be returned, even if the field contains an array.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  propertiesarray[string]
  Controls what properties are added to the target_field based on the geoip lookup.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  download_database_on_pipeline_creationboolean
  If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
  grokobject
  Hide grok attributes Show grok attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  ecs_compatibilitystring
  Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  pattern_definitionsobject
  A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
  Hide pattern_definitions attribute Show pattern_definitions attribute object
  *string Additional properties
  patternsarray[string] Required
  An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
  trace_matchboolean
  When true, _ingest._grok_match_index will be inserted into your matched document’s metadata with the index into the pattern found in patterns that matched.
  gsubobject
  Hide gsub attributes Show gsub attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  patternstring Required
  The pattern to be replaced.
  replacementstring Required
  The string to replace the matching patterns with.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  html_stripobject
  Hide html_strip attributes Show html_strip attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document,
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  inferenceobject
  Hide inference attributes Show inference attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  model_idstring Required
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  field_mapobject
  Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
  Hide field_map attribute Show field_map attribute object
  *object Additional properties
  inference_configobject
  Hide inference_config attributes Show inference_config attributes object
  regressionobject
  classificationobject
  input_outputobject | array[object]
  Input fields for inference and output (destination) fields for the inference results. This option is incompatible with the target_field and field_map options.
  One of:
  InputConfigobject array-2array[object]
  ignore_missingboolean
  If true and any of the input fields defined in input_ouput are missing then those missing fields are quietly ignored, otherwise a missing field causes a failure. Only applies when using input_output configurations to explicitly list the input fields.
  joinobject
  Hide join attributes Show join attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  separatorstring Required
  The separator character.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  jsonobject
  Hide json attributes Show json attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  add_to_rootboolean
  Flag that forces the parsed JSON to be added at the top level of the document. target_field must not be set when this option is chosen.
  add_to_root_conflict_strategystring
  Values are replace or merge.
  allow_duplicate_keysboolean
  When set to true, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  kvobject
  Hide kv attributes Show kv attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  exclude_keysarray[string]
  List of keys to exclude from document.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  field_splitstring Required
  Regex pattern to use for splitting key-value pairs.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  include_keysarray[string]
  List of keys to filter and insert into document. Defaults to including all keys.
  prefixstring
  Prefix to be added to extracted keys.
  strip_bracketsboolean
  If true. strip brackets (), <>, [] as well as quotes ' and " from extracted values.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  trim_keystring
  String of characters to trim from extracted keys.
  trim_valuestring
  String of characters to trim from extracted values.
  value_splitstring Required
  Regex pattern to use for splitting the key from the value within a key-value pair.
  lowercaseobject
  Hide lowercase attributes Show lowercase attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  network_directionobject
  Hide network_direction attributes Show network_direction attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  source_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  internal_networksarray[string]
  List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
  internal_networks_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  pipelineobject
  Hide pipeline attributes Show pipeline attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  namestring Required
  ignore_missing_pipelineboolean
  Whether to ignore missing pipelines instead of failing.
  redactobject
  Hide redact attributes Show redact attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  patternsarray[string] Required
  A list of grok expressions to match and redact named captures with
  pattern_definitionsobject
  Hide pattern_definitions attribute Show pattern_definitions attribute object
  *string Additional properties
  prefixstring
  Start a redacted section with this token
  suffixstring
  End a redacted section with this token
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  skip_if_unlicensedboolean
  If true and the current license does not support running redact processors, then the processor quietly exits without modifying the document
  trace_redactboolean
  If true then ingest metadata _ingest._redact._is_redacted is set to true if the document has been redacted
  registered_domainobject
  Hide registered_domain attributes Show registered_domain attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  removeobject
  Hide remove attributes Show remove attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring | array[string] Required
  keepstring | array[string]
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  renameobject
  Hide rename attributes Show rename attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  rerouteobject
  Hide reroute attributes Show reroute attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  destinationstring
  A static value for the target. Can’t be set when the dataset or namespace option is set.
  datasetstring | array[string]
  Field references or a static value for the dataset part of the data stream name. In addition to the criteria for index names, cannot contain - and must be no longer than 100 characters. Example values are nginx.access and nginx.error.
  Supports field references with a mustache-like syntax (denoted as {{double}} or {{{triple}}} curly braces). When resolving field references, the processor replaces invalid characters with _. Uses the part of the index name as a fallback if all field references resolve to a null, missing, or non-string value.
  default {{data_stream.dataset}}
  One of:
  string-1string array-2array[string]
  namespacestring | array[string]
  Field references or a static value for the namespace part of the data stream name. See the criteria for index names for allowed characters. Must be no longer than 100 characters.
  Supports field references with a mustache-like syntax (denoted as {{double}} or {{{triple}}} curly braces). When resolving field references, the processor replaces invalid characters with _. Uses the part of the index name as a fallback if all field references resolve to a null, missing, or non-string value.
  default {{data_stream.namespace}}
  One of:
  string-1string array-2array[string]
  scriptobject
  Hide script attributes Show script attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  idstring
  langstring
  Script language.
  paramsobject
  Object containing parameters for the script.
  Hide params attribute Show params attribute object
  *object Additional properties
  sourcestring
  Inline script. If no id is specified, this parameter is required.
  setobject
  Hide set attributes Show set attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  copy_fromstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_empty_valueboolean
  If true and value is a template snippet that evaluates to null or the empty string, the processor quietly exits without modifying the document.
  media_typestring
  The media type for encoding value. Applies only when value is a template snippet. Must be one of application/json, text/plain, or application/x-www-form-urlencoded.
  overrideboolean
  If true processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
  valueobject
  The value to be set for the field. Supports template snippets. May specify only one of value or copy_from.
  set_security_userobject
  Hide set_security_user attributes Show set_security_user attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Controls what user related properties are added to the field.
  sortobject
  Hide sort attributes Show sort attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  orderstring
  Values are asc or desc.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  splitobject
  Hide split attributes Show split attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  preserve_trailingboolean
  Preserves empty trailing fields, if any.
  separatorstring Required
  A regex which matches the separator, for example, , or \s+.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  terminateobject
  Hide terminate attributes Show terminate attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  trimobject
  Hide trim attributes Show trim attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  uppercaseobject
  Hide uppercase attributes Show uppercase attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  urldecodeobject
  Hide urldecode attributes Show urldecode attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  uri_partsobject
  Hide uri_parts attributes Show uri_parts attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  keep_originalboolean
  If true, the processor copies the unparsed URI to <target_field>.original.
  remove_if_successfulboolean
  If true, the processor removes the field after parsing the URI string. If parsing fails, the processor does not remove the field.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  user_agentobject
  Hide user_agent attributes Show user_agent attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifstring
  Conditionally execute the processor.
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  regex_filestring
  The name of the file in the config/ingest-user-agent directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the regexes.yaml from uap-core it ships with.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Controls what properties are added to target_field.
  Values are name, os, device, original, or version.
  extract_device_typeboolean Beta
  Extracts device type from the user agent string on a best-effort basis.
- versionnumber
- deprecatedboolean
  Marks this ingest pipeline as deprecated. When a deprecated ingest pipeline is referenced as the default or final pipeline when creating or updating a non-deprecated index template, Elasticsearch will emit a deprecation warning.
- _metaobject
  Hide _meta attribute Show _meta attribute object
  *object Additional properties

Responses

200 application/json
Hide response attribute Show response attribute object
- docsarray[object] Required
  Hide docs attributes Show docs attributes object
  docobject
  Hide doc attributes Show doc attributes object
  _idstring Required
  _indexstring Required
  _ingestobject Required
  Hide _ingest attributes Show _ingest attributes object
  _redactobject
  Hide _redact attribute Show _redact attribute object
  _is_redactedboolean Required
  indicates if document has been redacted
  timestampstring
  pipelinestring
  _routingstring
  Value used to send the document to a specific primary shard.
  _sourceobject Required
  JSON body for the document.
  Hide _source attribute Show _source attribute object
  *object Additional properties
  _versionnumber | string
  Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
  Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
  One of:
  VersionNumbernumber StringifiedVersionNumberstring
  _version_typestring
  Values are internal, external, external_gte, or force.
  errorobject
  Hide error attributes Show error attributes object
  typestring Required
  The type of error
  reasonstring
  A human-readable explanation of the error, in English.
  stack_tracestring
  The server stack trace. Present only if the error_trace=true parameter was sent with the request.
  caused_byobject
  root_causearray[object]
  suppressedarray[object]
  processor_resultsarray[object]
  Hide processor_results attributes Show processor_results attributes object
  docobject
  Hide doc attributes Show doc attributes object
  _idstring Required
  _indexstring Required
  _ingestobject Required
  _routingstring
  Value used to send the document to a specific primary shard.
  _sourceobject Required
  JSON body for the document.
  _version
  _version_typestring
  Values are internal, external, external_gte, or force.
  tagstring
  processor_typestring
  statusstring
  Values are success, error, error_ignored, skipped, or dropped.
  descriptionstring
  ignored_errorobject
  Hide ignored_error attributes Show ignored_error attributes object
  typestring Required
  The type of error
  reasonstring
  A human-readable explanation of the error, in English.
  stack_tracestring
  The server stack trace. Present only if the error_trace=true parameter was sent with the request.
  caused_byobject
  root_causearray[object]
  suppressedarray[object]
  errorobject
  Hide error attributes Show error attributes object
  typestring Required
  The type of error
  reasonstring
  A human-readable explanation of the error, in English.
  stack_tracestring
  The server stack trace. Present only if the error_trace=true parameter was sent with the request.
  caused_byobject
  root_causearray[object]
  suppressedarray[object]

POST /_ingest/pipeline/{id}/_simulate

curl \
 --request POST 'http://api.example.com/_ingest/pipeline/{id}/_simulate' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '"{\n  \"pipeline\" :\n  {\n    \"description\": \"_description\",\n    \"processors\": [\n      {\n        \"set\" : {\n          \"field\" : \"field2\",\n          \"value\" : \"_value\"\n        }\n      }\n    ]\n  },\n  \"docs\": [\n    {\n      \"_index\": \"index\",\n      \"_id\": \"id\",\n      \"_source\": {\n        \"foo\": \"bar\"\n      }\n    },\n    {\n      \"_index\": \"index\",\n      \"_id\": \"id\",\n      \"_source\": {\n        \"foo\": \"rab\"\n      }\n    }\n  ]\n}"'

Request example

You can specify the used pipeline either in the request body or as a path parameter.

{
  "pipeline" :
  {
    "description": "_description",
    "processors": [
      {
        "set" : {
          "field" : "field2",
          "value" : "_value"
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "foo": "bar"
      }
    },
    {
      "_index": "index",
      "_id": "id",
      "_source": {
        "foo": "rab"
      }
    }
  ]
}

Response examples (200)

A successful response for running an ingest pipeline against a set of provided documents.

{
   "docs": [
      {
         "doc": {
            "_id": "id",
            "_index": "index",
            "_version": "-3",
            "_source": {
               "field2": "_value",
               "foo": "bar"
            },
            "_ingest": {
               "timestamp": "2017-05-04T22:30:03.187Z"
            }
         }
      },
      {
         "doc": {
            "_id": "id",
            "_index": "index",
            "_version": "-3",
            "_source": {
               "field2": "_value",
               "foo": "rab"
            },
            "_ingest": {
               "timestamp": "2017-05-04T22:30:03.188Z"
            }
         }
      }
   ]
}

Path parameters

Query parameters

BodyRequired

valueobject | array[object] Required

input_outputobject | array[object]

datasetstring | array[string]

namespacestring | array[string]

valueobject | array[object] Required

input_outputobject | array[object]

datasetstring | array[string]

namespacestring | array[string]

Responses

_versionnumber | string