Appends one or more values to an existing array if the field already exists and it is an array.
Converts a scalar to an array and appends one or more values to it if the field exists and it is a scalar.
Creates an array containing the provided values if the field doesn’t exist.
Accepts a single value or an array of values.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to be appended to.
Supports template snippets.
valueuniononeOf
The value to be appended. Supports template snippets. May specify only one of value or copy_from.
One of:object[]orobject
media_typestring · default: "application/json"
The media type for encoding value.
Applies only when value is a template snippet.
Must be one of application/json, text/plain, or application/x-www-form-urlencoded.
copy_fromstring
The origin field which will be appended to field, cannot set value simultaneously.
allow_duplicatesboolean · default: true
If false, the processor does not append values already present in the field.
ignore_empty_valuesboolean · default: false
If true, the processor will skip empty values from the source (e.g. empty strings, and null values),
rather than appending them to the field.
attachmentobject
The attachment processor lets Elasticsearch extract file attachments in common formats (such as PPT, XLS, and PDF) by using the Apache text extraction library Tika.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to get the base64 encoded field from.
ignore_missingboolean · default: false
If true and field does not exist, the processor quietly exits without modifying the document.
indexed_charsnumber · default: 100000
The number of chars being used for extraction to prevent huge fields.
Use -1 for no limit.
indexed_chars_fieldstring · default: null
Field name from which you can overwrite the number of chars being used for extraction.
max_field_bytesnumber | string · default: -1
Maximum allowed size of the attachment field value in bytes: length of a string (if base64 in JSON,
checked before base64 decoding) or byte array length for binary (for example, CBOR).
If set to -1, there is no per-processor limit.
The node setting ingest.attachment.max_field_size also applies.
propertiesstring[]
Array of properties to select to be stored.
Can be content, title, name, author, keywords, date, content_type, content_length, language.
target_fieldstring · default: attachment
The field that will hold the attachment information.
remove_binaryboolean · default: false
If true, the binary field will be removed from the document
resource_namestring
Field containing the name of the resource to decode.
If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
bytesobject
Converts a human readable byte value (for example 1kb) to its value in bytes (for example 1024).
If the field is an array of strings, all members of the array will be converted.
Supported human readable units are "b", "kb", "mb", "gb", "tb", "pb" case insensitive.
An error will occur if the field is not a supported format or resultant value exceeds 2^63.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to convert.
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
target_fieldstring · default: field
The field to assign the converted value to.
By default, the field is updated in-place.
cefobject
Converts a CEF message into a structured format.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field containing the CEF message.
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
target_fieldstring · default: 'cef'
The field to assign the converted value to.
By default, the target_field is 'cef'
ignore_empty_valuesboolean · default: false
If true and value is anempty string in extensions, the processor quietly exits without modifying the document.
timezonestring · default: UTC
The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
circleobject
Converts circle definitions of shapes to regular polygons which approximate them.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
error_distancenumberrequired
The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for geo_shape, unit-less for shape).
fieldstringrequired
The field to interpret as a circle. Either a string in WKT format or a map for GeoJSON.
ignore_missingboolean · default: false
If true and field does not exist, the processor quietly exits without modifying the document.
shape_typeenumrequired
Which field mapping type is to be used when processing the circle: geo_shape or shape.
Values:geo_shapeshape
target_fieldstring
The field to assign the polygon shape to
By default, the field is updated in-place.
community_idobject
Computes the Community ID for network flow data as defined in the
Community ID Specification. You can use a community ID to correlate network
events related to a single flow.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
Field containing the transport protocol name or number. Used only when the
iana_number field is not present. The following protocol names are currently
supported: eigrp, gre, icmp, icmpv6, igmp, ipv6-icmp, ospf, pim, sctp, tcp, udp
Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The
seed can prevent hash collisions between network domains, such as a staging
and production network that use the same addressing scheme.
ignore_missingboolean · default: true
If true and any required fields are missing, the processor quietly exits
without modifying the document.
convertobject
Converts a field in the currently ingested document to a different type, such as converting a string to an integer.
If the field value is an array, all members will be converted.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field whose value is to be converted.
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
target_fieldstring · default: field
The field to assign the converted value to.
By default, the field is updated in-place.
typeenumrequired
The type to convert the existing value to.
Values:integerlongdoublefloatbooleanipstringauto
csvobject
Extracts fields from CSV line out of a single text field within a document.
Any empty field in CSV will be skipped.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
empty_valueobject
Value used to fill empty fields.
Empty fields are skipped if this is not provided.
An empty field is one with no value (2 consecutive separators) or empty quotes ("").
fieldstringrequired
The field to extract data from.
ignore_missingboolean
If true and field does not exist, the processor quietly exits without modifying the document.
quotestring · default: "
Quote used in CSV, has to be single character string.
separatorstring · default: ,
Separator used in CSV, has to be single character string.
target_fieldsuniononeOfrequired
The array of fields to assign extracted values to.
One of:string[]orstring
trimboolean
Trim whitespaces in unquoted fields.
dateobject
Parses dates from fields, and then uses the date or timestamp as the timestamp for the document.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to get the date from.
formatsstring[]required
An array of the expected date formats.
Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
localestring · default: ENGLISH
The locale to use when parsing the date, relevant when parsing month names or week days.
Supports template snippets.
target_fieldstring · default: @timestamp
The field that will hold the parsed date.
timezonestring · default: UTC
The timezone to use when parsing the date.
Supports template snippets.
The format to use when writing the date to target_field. Must be a valid
java time pattern.
date_index_nameobject
The purpose of this processor is to point documents to the right time based index based on a date or timestamp field in a document by using the date math index name support.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
date_formatsstring[]
An array of the expected date formats for parsing dates / timestamps in the document being preprocessed.
Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
date_roundingstringrequired
How to round the date when formatting the date into the index name. Valid values are:
y (year), M (month), w (week), d (day), h (hour), m (minute) and s (second).
Supports template snippets.
fieldstringrequired
The field to get the date or timestamp from.
index_name_formatstring · default: yyyy-MM-dd
The format to be used when printing the parsed date into the index name.
A valid java time pattern is expected here.
Supports template snippets.
index_name_prefixstring
A prefix of the index name to be prepended before the printed date.
Supports template snippets.
localestring · default: ENGLISH
The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
timezonestring · default: UTC
The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
dissectobject
Extracts structured fields out of a single text field by matching the text field against a delimiter-based pattern.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
append_separatorstring · default: ""
The character(s) that separate the appended fields.
fieldstringrequired
The field to dissect.
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
patternstringrequired
The pattern to apply to the field.
dot_expanderobject
Expands a field with dots into an object field.
This processor allows fields with dots in the name to be accessible by other processors in the pipeline.
Otherwise these fields can’t be accessed by any processor.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to expand into an object field.
If set to *, all top-level fields will be expanded.
overrideboolean · default: false
Controls the behavior when there is already an existing nested object that conflicts with the expanded field.
When false, the processor will merge conflicts by combining the old and the new values into an array.
When true, the value from the expanded field will overwrite the existing value.
pathstring
The field that contains the field to expand.
Only required if the field to expand is part another object field, because the field option can only understand leaf fields.
dropobject
Drops the document without raising any errors.
This is useful to prevent the document from getting indexed based on some condition.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
enrichobject
The enrich processor can enrich documents with data from another index.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field in the input document that matches the policies match_field used to retrieve the enrichment data.
Supports template snippets.
ignore_missingboolean · default: false
If true and field does not exist, the processor quietly exits without modifying the document.
max_matchesnumber · default: 1
The maximum number of matched documents to include under the configured target field.
The target_field will be turned into a json array if max_matches is higher than 1, otherwise target_field will become a json object.
In order to avoid documents getting too large, the maximum allowed value is 128.
overrideboolean · default: true
If processor will update fields with pre-existing non-null-valued field.
When set to false, such fields will not be touched.
policy_namestringrequired
The name of the enrich policy to use.
shape_relationenum · default: INTERSECTS
A spatial relation operator used to match the geoshape of incoming documents to documents in the enrich index.
This option is only used for geo_match enrich policy types.
Supported values include:
intersects: Return all documents whose geo_shape or geo_point field intersects the query geometry.
disjoint: Return all documents whose geo_shape or geo_point field has nothing in common with the query geometry.
within: Return all documents whose geo_shape or geo_point field is within the query geometry.
Line geometries are not supported.
contains: Return all documents whose geo_shape or geo_point field contains the query geometry.
Values:intersectsdisjointwithincontains
target_fieldstringrequired
Field added to incoming documents to contain enrich data. This field contains both the match_field and enrich_fields specified in the enrich policy.
Supports template snippets.
failobject
Raises an exception.
This is useful for when you expect a pipeline to fail and want to relay a specific message to the requester.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
messagestringrequired
The error message thrown by the processor.
Supports template snippets.
fingerprintobject
Computes a hash of the document’s content. You can use this hash for
content fingerprinting.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldsuniononeOfrequired
Array of fields to include in the fingerprint. For objects, the processor
hashes both the field key and value. For other fields, the processor hashes
only the field value.
One of:string[]orstring
target_fieldstring · default: fingerprint
Output field for the fingerprint.
saltstring
Salt value for the hash function.
methodenum · default: SHA-1
The hash method used to compute the fingerprint. Must be one of MD5, SHA-1,
SHA-256, SHA-512, or MurmurHash3.
Values:MD5SHA-1SHA-256SHA-512MurmurHash3
ignore_missingboolean · default: false
If true, the processor ignores any missing fields. If all fields are
missing, the processor silently exits without modifying the document.
foreachobject
Runs an ingest processor on each element of an array or object.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
Field containing array or object values.
ignore_missingboolean · default: false
If true, the processor silently exits without changing the document if the field is null or missing.
processorProcessorrequired
Ingest processor to run on each element.
ip_locationobject
Currently an undocumented alias for GeoIP Processor.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
database_filestring · default: GeoLite2-City.mmdb
The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
fieldstringrequired
The field to get the ip address from for the geographical lookup.
first_onlyboolean · default: true
If true, only the first found IP location data will be returned, even if the field contains an array.
ignore_missingboolean · default: false
If true and field does not exist, the processor quietly exits without modifying the document.
propertiesstring[]
Controls what properties are added to the target_field based on the IP location lookup.
target_fieldstring · default: geoip
The field that will hold the geographical information looked up from the MaxMind database.
download_database_on_pipeline_creationboolean
If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created.
Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
geo_gridobject
Converts geo-grid definitions of grid tiles or cells to regular bounding boxes or polygons which describe their shape.
This is useful if there is a need to interact with the tile shapes as spatially indexable fields.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to interpret as a geo-tile.=
The field format is determined by the tile_type.
tile_typeenumrequired
Three tile formats are understood: geohash, geotile and geohex.
Values:geotilegeohexgeohash
target_fieldstring · default: field
The field to assign the polygon shape to, by default, the field is updated in-place.
parent_fieldstring
If specified and a parent tile exists, save that tile address to this field.
children_fieldstring
If specified and children tiles exist, save those tile addresses to this field as an array of strings.
non_children_fieldstring
If specified and intersecting non-child tiles exist, save their addresses to this field as an array of strings.
precision_fieldstring
If specified, save the tile precision (zoom) as an integer to this field.
ignore_missingboolean · default: false
If true and field does not exist, the processor quietly exits without modifying the document.
target_formatenum · default: geojson
Which format to save the generated polygon in.
Values:geojsonwkt
geoipobject
The geoip processor adds information about the geographical location of an IPv4 or IPv6 address.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
database_filestring · default: GeoLite2-City.mmdb
The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
fieldstringrequired
The field to get the ip address from for the geographical lookup.
first_onlyboolean · default: true
If true, only the first found geoip data will be returned, even if the field contains an array.
ignore_missingboolean · default: false
If true and field does not exist, the processor quietly exits without modifying the document.
propertiesstring[]
Controls what properties are added to the target_field based on the geoip lookup.
target_fieldstring · default: geoip
The field that will hold the geographical information looked up from the MaxMind database.
download_database_on_pipeline_creationboolean
If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created.
Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
grokobject
Extracts structured fields out of a single text field within a document.
You choose which field to extract matched fields from, as well as the grok pattern you expect will match.
A grok pattern is like a regular expression that supports aliased expressions that can be reused.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
ecs_compatibilitystring · default: disabled
Must be disabled or v1. If v1, the processor uses patterns with Elastic
Common Schema (ECS) field names.
fieldstringrequired
The field to use for grok expression parsing.
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
pattern_definitionsmapstring to string
A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor.
Patterns matching existing names will override the pre-existing definition.
patternsstring[]required
An ordered list of grok expression to match and extract named captures with.
Returns on the first expression in the list that matches.
trace_matchboolean · default: false
When true, _ingest._grok_match_index will be inserted into your matched document’s metadata with the index into the pattern found in patterns that matched.
validate_onlyboolean · default: false
When true, the processor does matching but does not extract structured fields
gsubobject
Converts a string field by applying a regular expression and a replacement.
If the field is an array of string, all members of the array will be converted.
If any non-string values are encountered, the processor will throw an exception.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to apply the replacement to.
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
patternstringrequired
The pattern to be replaced.
replacementstringrequired
The string to replace the matching patterns with.
target_fieldstring · default: field
The field to assign the converted value to
By default, the field is updated in-place.
html_stripobject
Removes HTML tags from the field.
If the field is an array of strings, HTML tags will be removed from all members of the array.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The string-valued field to remove HTML tags from.
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document,
target_fieldstring · default: field
The field to assign the converted value to
By default, the field is updated in-place.
inferenceobject
Uses a pre-trained data frame analytics model or a model deployed for natural language processing tasks to infer against the data that is being ingested in the pipeline.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
model_idstringrequired
The ID or alias for the trained model, or the ID of the deployment.
Field added to incoming documents to contain results objects.
field_mapmapstring to object
Maps the document field names to the known field names of the model.
This mapping takes precedence over any default mappings provided in the model configuration.
Specifies the field to which the top classes are written.
prediction_field_typestring
Specifies the type of the predicted field to write.
Valid values are: string, number, boolean.
input_outputuniononeOf
Input fields for inference and output (destination) fields for the inference results.
This option is incompatible with the target_field and field_map options.
objectorobject[]
input_fieldstringrequired
output_fieldstringrequired
ignore_missingboolean
If true and any of the input fields defined in input_ouput are missing
then those missing fields are quietly ignored, otherwise a missing field causes a failure.
Only applies when using input_output configurations to explicitly list the input fields.
joinobject
Joins each element of an array into a single string using a separator character between each element.
Throws an error when the field is not an array.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
Field containing array values to join.
separatorstringrequired
The separator character.
target_fieldstring · default: field
The field to assign the joined value to.
By default, the field is updated in-place.
jsonobject
Parses a string containing JSON data into a structured object, string, or other value.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
add_to_rootboolean · default: false
Flag that forces the parsed JSON to be added at the top level of the document.
target_field must not be set when this option is chosen.
add_to_root_conflict_strategyenum
When set to replace, root fields that conflict with fields from the parsed JSON will be overridden.
When set to merge, conflicting fields will be merged.
Only applicable if add_to_root is set to true.
Supported values include:
replace: Root fields that conflict with fields from the parsed JSON will be overridden.
merge: Conflicting fields will be merged.
Values:replacemerge
allow_duplicate_keysboolean · default: false
When set to true, the JSON parser will not fail if the JSON contains duplicate keys.
Instead, the last encountered value for any duplicate key wins.
fieldstringrequired
The field to be parsed.
target_fieldstring · default: field
The field that the converted structured object will be written into.
Any existing content in this field will be overwritten.
kvobject
This processor helps automatically parse messages (or specific event fields) which are of the foo=bar variety.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
exclude_keysstring[]
List of keys to exclude from document.
fieldstringrequired
The field to be parsed.
Supports template snippets.
field_splitstringrequired
Regex pattern to use for splitting key-value pairs.
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
include_keysstring[]
List of keys to filter and insert into document.
Defaults to including all keys.
prefixstring · default: null
Prefix to be added to extracted keys.
strip_bracketsboolean · default: false
If true. strip brackets (), <>, [] as well as quotes ' and " from extracted values.
target_fieldstring
The field to insert the extracted keys into.
Defaults to the root of the document.
Supports template snippets.
trim_keystring
String of characters to trim from extracted keys.
trim_valuestring
String of characters to trim from extracted values.
value_splitstringrequired
Regex pattern to use for splitting the key from the value within a key-value pair.
lowercaseobject
Converts a string to its lowercase equivalent.
If the field is an array of strings, all members of the array will be converted.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to make lowercase.
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
target_fieldstring · default: field
The field to assign the converted value to.
By default, the field is updated in-place.
network_directionobject
Calculates the network direction given a source IP address, destination IP
address, and a list of internal networks.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
source_ipstring · default: source.ip
Field containing the source IP address.
destination_ipstring · default: destination.ip
Field containing the destination IP address.
target_fieldstring · default: network.direction
Output field for the network direction.
internal_networksstring[]
List of internal networks. Supports IPv4 and IPv6 addresses and ranges in
CIDR notation. Also supports the named ranges listed below. These may be
constructed with template snippets. Must specify only one of
internal_networks or internal_networks_field.
internal_networks_fieldstring
A field on the given document to read the internal_networks configuration
from.
ignore_missingboolean · default: true
If true and any required fields are missing, the processor quietly exits
without modifying the document.
pipelineobject
Executes another pipeline.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
namestringrequired
The name of the pipeline to execute.
Supports template snippets.
ignore_missing_pipelineboolean · default: false
Whether to ignore missing pipelines instead of failing.
recover_failure_documentobject
Recovers documents that have been stored in a data stream's failure store by restoring them to their original format.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
redactobject
The Redact processor uses the Grok rules engine to obscure text in the input document matching the given Grok patterns.
The processor can be used to obscure Personal Identifying Information (PII) by configuring it to detect known patterns such as email or IP addresses.
Text that matches a Grok pattern is replaced with a configurable string such as <EMAIL> where an email address is matched or simply replace all matches with the text <REDACTED> if preferred.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to be redacted
patternsstring[]required
A list of grok expressions to match and redact named captures with
pattern_definitionsmapstring to string
prefixstring · default: <
Start a redacted section with this token
suffixstring · default: >
End a redacted section with this token
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
skip_if_unlicensedboolean · default: false
If true and the current license does not support running redact processors, then the processor quietly exits without modifying the document
trace_redactboolean · default: false
If true then ingest metadata _ingest._redact._is_redacted is set to true if the document has been redacted
registered_domainobject
Extracts the registered domain (also known as the effective top-level
domain or eTLD), sub-domain, and top-level domain from a fully qualified
domain name (FQDN). Uses the registered domains defined in the Mozilla
Public Suffix List.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
Field containing the source FQDN.
target_fieldstring
Object field containing extracted domain components. If an empty string,
the processor adds components to the document’s root.
ignore_missingboolean · default: true
If true and any required fields are missing, the processor quietly exits
without modifying the document.
removeobject
Removes existing fields.
If one field doesn’t exist, an exception will be thrown.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fielduniononeOfrequired
Fields to be removed. Supports template snippets.
One of:string[]orstring
keepuniononeOf
Fields to be kept. When set, all fields other than those specified are removed.
One of:string[]orstring
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
renameobject
Renames an existing field.
If the field doesn’t exist or the new name is already used, an exception will be thrown.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to be renamed.
Supports template snippets.
ignore_missingboolean · default: false
If true and field does not exist, the processor quietly exits without modifying the document.
overrideboolean · default: false
If true, the processor overwrites target_field if it already exists.
If false, the processor fails when target_field already exists.
target_fieldstringrequired
The new name of the field.
Supports template snippets.
rerouteobject
Routes a document to another target index or data stream.
When setting the destination option, the target is explicitly specified and the dataset and namespace options can’t be set.
When the destination option is not set, this processor is in a data stream mode. Note that in this mode, the reroute processor can only be used on data streams that follow the data stream naming scheme.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
destinationstring
A static value for the target. Can’t be set when the dataset or namespace option is set.
datasetunionstring | string[]
Field references or a static value for the dataset part of the data stream name.
In addition to the criteria for index names, cannot contain - and must be no longer than 100 characters.
Example values are nginx.access and nginx.error.
Supports field references with a mustache-like syntax (denoted as {{double}} or {{{triple}}} curly braces).
When resolving field references, the processor replaces invalid characters with _. Uses the
default {{data_stream.dataset}}
namespaceunionstring | string[]
Field references or a static value for the namespace part of the data stream name. See the criteria for
index names for allowed characters. Must be no longer than 100 characters.
Supports field references with a mustache-like syntax (denoted as {{double}} or {{{triple}}} curly braces).
When resolving field references, the processor replaces invalid characters with _. Uses the
default {{data_stream.namespace}}
scriptobject
Runs an inline or stored script on incoming documents.
The script runs in the ingest context.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
idstring
ID of a stored script.
If no source is specified, this parameter is required.
langunionanyOf · default: painless
Script language.
Supported values include:
painless: Painless scripting language, purpose-built for Elasticsearch.
expression: Lucene’s expressions language, compiles a JavaScript expression to bytecode.
mustache: Mustache templated, used for templates.
java: Expert Java API
Values:painlessexpressionmustachejava
paramsmapstring to object
Object containing parameters for the script.
sourceuniononeOf
Inline script.
If no id is specified, this parameter is required.
A wildcard pattern. The request returns values for field names matching this pattern.
formatstring
The format in which the values are returned.
include_unmappedboolean
explainboolean
highlightobject
typeunionanyOf
Supported values include:
plain: The plain highlighter uses the standard Lucene highlighter
fvh: The fvh highlighter uses the Lucene Fast Vector highlighter.
unified: The unified highlighter uses the Lucene Unified Highlighter.
Values:plainfvhunified
boundary_charsstring · default: .,!? \t\n
A string that contains each boundary character.
boundary_max_scannumber · default: 20
How far to scan for boundary characters.
boundary_scannerenum
Specifies how to break the highlighted fragments: chars, sentence, or word.
Only valid for the unified and fvh highlighters.
Defaults to sentence for the unified highlighter. Defaults to chars for the fvh highlighter.
Supported values include:
chars: Use the characters specified by boundary_chars as highlighting boundaries.
The boundary_max_scan setting controls how far to scan for boundary characters.
Only valid for the fvh highlighter.
sentence: Break highlighted fragments at the next sentence boundary, as determined by Java’s BreakIterator.
You can specify the locale to use with boundary_scanner_locale.
When used with the unified highlighter, the sentence scanner splits sentences bigger than fragment_size at the first word boundary next to fragment_size.
You can set fragment_size to 0 to never split any sentence.
word: Break highlighted fragments at the next word boundary, as determined by Java’s BreakIterator.
You can specify the locale to use with boundary_scanner_locale.
Controls which locale is used to search for sentence and word boundaries.
This parameter takes a form of a language tag, for example: "en-US", "fr-FR", "ja-JP".
force_sourcebooleandeprecated
fragmenterenum · default: span
Specifies how text should be broken up in highlight snippets: simple or span.
Only valid for the plain highlighter.
Values:simplespan
fragment_sizenumber · default: 100
The size of the highlighted fragment in characters.
Highlight matches for a query other than the search query.
This is especially useful if you use a rescore query because those are not taken into account by highlighting by default.
max_fragment_lengthnumber
max_analyzed_offsetnumber
If set to a non-negative value, highlighting stops at this defined maximum limit.
The rest of the text is not processed, thus not highlighted and no error is returned
The max_analyzed_offset query setting does not override the index.highlight.max_analyzed_offset setting, which prevails when it’s set to lower value than the query setting.
no_match_sizenumber · default: 0
The amount of text you want to return from the beginning of the field if there are no matching fragments to highlight.
number_of_fragmentsnumber · default: 5
The maximum number of fragments to return.
If the number of fragments is set to 0, no fragments are returned.
Instead, the entire field contents are highlighted and returned.
This can be handy when you need to highlight short texts such as a title or address, but fragmentation is not required.
If number_of_fragments is 0, fragment_size is ignored.
optionsmapstring to object
orderenum · default: none
Sorts highlighted fragments by score when set to score.
By default, fragments will be output in the order they appear in the field (order: none).
Setting this option to score will output the most relevant fragments first.
Each highlighter applies its own logic to compute relevancy scores.
Values:score
phrase_limitnumber · default: 256
Controls the number of matching phrases in a document that are considered.
Prevents the fvh highlighter from analyzing too many phrases and consuming too much memory.
When using matched_fields, phrase_limit phrases per matched field are considered. Raising the limit increases query time and consumes more memory.
Only supported by the fvh highlighter.
post_tagsstring[]
Use in conjunction with pre_tags to define the HTML tags to use for the highlighted text.
By default, highlighted text is wrapped in <em> and </em> tags.
pre_tagsstring[]
Use in conjunction with post_tags to define the HTML tags to use for the highlighted text.
By default, highlighted text is wrapped in <em> and </em> tags.
require_field_matchboolean · default: true
By default, only fields that contains a query match are highlighted.
Set to false to highlight all fields.
tags_schemaenum
Set to styled to use the built-in tag schema.
Values:styled
encoderenum
Values:defaulthtml
fieldsuniononeOfrequired
map string to objector[] map string to object
ignore_unmappedboolean
script_fieldsmapstring to object
<string>object
scriptstringrequired
ignore_failureboolean
seq_no_primary_termboolean
fieldstring[]
fieldsobject[]
fieldstringrequired
A wildcard pattern. The request returns values for field names matching this pattern.
formatstring
The format in which the values are returned.
include_unmappedboolean
sortuniononeOf
How the inner hits should be sorted per inner_hits.
By default, inner hits are sorted by score.
A value or an array; each item is one of:
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
_scoreobject
orderenum
Supported values include:
asc: Ascending (smallest to largest)
desc: Descending (largest to smallest)
Values:ascdesc
_docobject
orderenum
Supported values include:
asc: Ascending (smallest to largest)
desc: Descending (largest to smallest)
Values:ascdesc
_geo_distanceobject
modeenum
Values:minmaxsumavgmedian
distance_typeenum
Supported values include:
arc: The arc calculation is the most accurate.
plane: The plane calculation is faster but less accurate.
If true, vector fields are excluded from the returned source.
This option takes precedence over includes: any vector field will
remain excluded even if it matches an includes rule.
excludesuniononeOf
A list of fields to exclude from the returned source.
One of:string[]orstring
includesuniononeOf
A list of fields to include in the returned source.
One of:string[]orstring
stored_fieldsuniononeOf
One of:string[]orstring
track_scoresboolean · default: false
versionboolean
max_concurrent_group_searchesnumber
The number of concurrent requests allowed to retrieve the inner_hits per group
explainboolean · default: false
If true, the request returns detailed information about score computation as part of a hit.
extmapstring to object
Configuration of search extensions defined by Elasticsearch plugins.
fromnumber · default: 0
The starting document offset, which must be non-negative.
By default, you cannot page through more than 10,000 hits using the from and size parameters.
To page through more hits, use the search_after parameter.
highlightobject
Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results.
Number of hits matching the query to count accurately.
If true, the exact number of hits is returned at the cost of some performance.
If false, the response does not include the total number of hits matching the query.
indices_booststring to number[]
Boost the _score of documents from specified indices.
The boost value is the factor by which scores are multiplied.
A boost value greater than 1.0 increases the score.
A boost value between 0 and 1.0 decreases the score.
An array of wildcard (*) field patterns.
The request returns doc values for field names matching these patterns in the hits.fields property of the response.
Use the post_filter parameter to filter search results.
The search hits are filtered after the aggregations are calculated.
A post filter has no impact on the aggregation results.
profileboolean · default: false
Set to true to return detailed timing information about the execution of individual components in a search request.
NOTE: This is a debugging tool and adds significant overhead to search execution.
The query to use for rescoring.
This query is only run on the Top-K results returned by the query and post_filter phases.
query_weightnumber · default: 1
Relative importance of the original query versus the rescore query.
rescore_query_weightnumber · default: 1
Relative importance of the rescore query versus the original query.
score_modeenum · default: total
Determines how scores are combined.
Supported values include:
avg: Average the original score and the rescore query score.
max: Take the max of original score and the rescore query score.
min: Take the min of the original score and the rescore query score.
multiply: Multiply the original score by the rescore query score.
Useful for function query rescores.
total: Add the original score and the rescore query score.
Values:avgmaxminmultiplytotal
learning_to_rankobject
model_idstringrequired
The unique identifier of the trained model uploaded to Elasticsearch
paramsmapstring to object
Named parameters to be passed to the query templates used for feature
scriptobject
scriptstringrequired
retrieverobject
A retriever is a specification to describe top documents returned from a search.
A retriever replaces other elements of the search API that also return top documents such as query and knn.
Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
_namestring
Retriever name.
fieldstringrequired
The name of the vector field to search against.
query_vectoruniononeOf
Query vector. Must have the same number of dimensions as the vector field you are searching against. You must provide a query_vector_builder or query_vector, but not both.
Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
_namestring
Retriever name.
retrieversuniononeOf[]required
A list of child retrievers to specify which sets of returned top documents will have the RRF formula applied to them. Each retriever can optionally include a weight parameter.
One of:
rank_constantnumber
This value determines how much influence documents in individual result sets per query have over the final ranked result set.
rank_window_sizenumber
This value determines the size of the individual result sets per query.
querystring
fieldsstring[]
text_similarity_rerankerobject
A retriever that reranks the top documents based on a reranking model using the InferenceAPI
This value determines how many documents we will consider from the nested retriever.
inference_idstring
Unique identifier of the inference endpoint created using the inference API.
inference_textstringrequired
The text snippet used as the basis for similarity comparison.
fieldstringrequired
The document field to be used for text similarity comparisons. This field should contain the text that will be evaluated against the inference_text.
chunk_rescorerobject
Whether to rescore on only the best matching chunks.
sizenumber
The number of chunks per document to evaluate for reranking.
chunking_settingsobject
Chunking settings to apply
max_chunk_sizenumber · default: 250required
The maximum size of a chunk in words.
This value cannot be lower than 20 (for sentence strategy) or 10 (for word strategy).
This value should not exceed the window size for the associated model.
overlapnumber · default: 100
The number of overlapping words for chunks.
It is applicable only to a word chunking strategy.
This value cannot be higher than half the max_chunk_size value.
sentence_overlapnumber · default: 1
The number of overlapping sentences for chunks.
It is applicable only for a sentence chunking strategy.
It can be either 1 or 0.
separator_groupstring
Only applicable to the recursive strategy and required when using it.
Sets a predefined list of separators in the saved chunking settings based on the selected text type.
Values can be markdown or plaintext.
Using this parameter is an alternative to manually specifying a custom separators list.
separatorsstring[]
Only applicable to the recursive strategy and required when using it.
A list of strings used as possible split points when chunking text.
Each string can be a plain string or a regular expression (regex) pattern.
The system tries each separator in order to split the text, starting from the first item in the list.
After splitting, it attempts to recombine smaller pieces into larger chunks that stay within
the max_chunk_size limit, to reduce the total number of chunks generated.
strategystring · default: sentence
The chunking strategy: sentence, word, none or recursive.
If strategy is set to recursive, you must also specify:
max_chunk_size
either separators orseparator_group
Learn more about different chunking strategies in the linked documentation.
Weight multiplier for this retriever's contribution to the linear combination.
Must be non-negative.
normalizerenum · default: none
Score normalizer to apply to this retriever's results before weighting.
Falls back to the top-level normalizer on the linear retriever if unset,
then to none (identity) if neither is set.
Values:noneminmaxl2_norm
rank_window_sizenumber
querystring
fieldsstring[]
normalizerenum
Values:noneminmaxl2_norm
pinnedobject
A pinned retriever applies pinned documents to the underlying retriever.
This retriever will rewrite to a PinnedQueryBuilder.
Controls the trade-off between relevance and diversity for MMR. A value of 0.0 focuses solely on diversity, while a value of 1.0 focuses solely on relevance. Required for MMR
script_fieldsmapstring to object
Retrieve a script evaluation (based on different fields) for each hit.
<string>object
scriptstringrequired
ignore_failureboolean
search_afterunion[]
Used to retrieve the next page of hits using a set of sort values from the previous page.
The number of hits to return, which must not be negative.
By default, you cannot page through more than 10,000 hits using the from and size parameters.
To page through more hits, use the search_after property.
sliceobject
Split a scrolled search into multiple slices that can be consumed independently.
The source fields that are returned for matching documents.
These fields are returned in the hits._source property of the search response.
If the stored_fields property is specified, the _source property defaults to false.
Otherwise, it defaults to true.
If true, vector fields are excluded from the returned source.
This option takes precedence over includes: any vector field will
remain excluded even if it matches an includes rule.
excludesuniononeOf
A list of fields to exclude from the returned source.
One of:string[]orstring
includesuniononeOf
A list of fields to include in the returned source.
One of:string[]orstring
fieldsobject[]
An array of wildcard (*) field patterns.
The request returns values for field names matching these patterns in the hits.fields property of the response.
fieldstringrequired
A wildcard pattern. The request returns values for field names matching this pattern.
formatstring
The format in which the values are returned.
include_unmappedboolean
suggestobject
Defines a suggester that provides similar looking terms based on a provided text.
Global suggest text, to avoid repetition when the same text is used in several suggesters
terminate_afternumber · default: 0
The maximum number of documents to collect for each shard.
If a query reaches this limit, Elasticsearch terminates the query early.
Elasticsearch collects documents before sorting.
Important
Use with caution.
Elasticsearch applies this property to each shard handling the request.
When possible, let Elasticsearch perform early termination automatically.
Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers.
If set to 0 (default), the query does not terminate early.
timeoutstring
The period of time to wait for a response from each shard.
If no response is received before the timeout expires, the request fails and returns an error.
Defaults to no timeout.
track_scoresboolean · default: false
If true, calculate and return document scores, even if the scores are not used for sorting.
versionboolean · default: false
If true, the request returns the document version as part of a hit.
seq_no_primary_termboolean
If true, the request returns sequence number and primary term of the last modification of each hit.
A comma-separated list of stored fields to return as part of a hit.
If no fields are specified, no stored fields are included in the response.
If this field is specified, the _source property defaults to false.
You can pass _source: true to return both source fields and stored fields in the search response.
The stats groups to associate with the search.
Each group maintains a statistics aggregation for its associated searches.
You can retrieve these stats using the indices stats API.
setobject
Adds a field with the specified value.
If the field already exists, its value will be replaced with the provided one.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
copy_fromstring
The origin field which will be copied to field, cannot set value simultaneously.
Supported data types are boolean, number, array, object, string, date, etc.
fieldstringrequired
The field to insert, upsert, or update.
Supports template snippets.
ignore_empty_valueboolean · default: false
If true and value is a template snippet that evaluates to null or the empty string, the processor quietly exits without modifying the document.
media_typestring · default: "application/json"
The media type for encoding value.
Applies only when value is a template snippet.
Must be one of application/json, text/plain, or application/x-www-form-urlencoded.
overrideboolean · default: true
If true processor will update fields with pre-existing non-null-valued field.
When set to false, such fields will not be touched.
valueobject
The value to be set for the field.
Supports template snippets.
May specify only one of value or copy_from.
set_security_userobject
Sets user-related details (such as username, roles, email, full_name, metadata, api_key, realm and authentication_type) from the current authenticated user to the current document by pre-processing the ingest.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to store the user information into.
propertiesstring[]
Controls what user related properties are added to the field.
sortobject
Sorts the elements of an array ascending or descending.
Homogeneous arrays of numbers will be sorted numerically, while arrays of strings or heterogeneous arrays of strings + numbers will be sorted lexicographically.
Throws an error when the field is not an array.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to be sorted.
orderenum · default: asc
The sort order to use.
Accepts "asc" or "desc".
Supported values include:
asc: Ascending (smallest to largest)
desc: Descending (largest to smallest)
Values:ascdesc
target_fieldstring
The field to assign the sorted value to.
By default, the field is updated in-place.
splitobject
Splits a field into an array using a separator character.
Only works on string fields.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to split.
ignore_missingboolean · default: false
If true and field does not exist, the processor quietly exits without modifying the document.
preserve_trailingboolean · default: false
Preserves empty trailing fields, if any.
separatorstringrequired
A regex which matches the separator, for example, , or \s+.
target_fieldstring · default: field
The field to assign the split value to.
By default, the field is updated in-place.
terminateobject
Terminates the current ingest pipeline, causing no further processors to be run.
This will normally be executed conditionally, using the if option.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
trimobject
Trims whitespace from a field.
If the field is an array of strings, all members of the array will be trimmed.
This only works on leading and trailing whitespace.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The string-valued field to trim whitespace from.
ignore_missingboolean · default: false
If true and field does not exist, the processor quietly exits without modifying the document.
target_fieldstring · default: field
The field to assign the trimmed value to.
By default, the field is updated in-place.
uppercaseobject
Converts a string to its uppercase equivalent.
If the field is an array of strings, all members of the array will be converted.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to make uppercase.
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
target_fieldstring · default: field
The field to assign the converted value to.
By default, the field is updated in-place.
urldecodeobject
URL-decodes a string.
If the field is an array of strings, all members of the array will be decoded.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field to decode.
ignore_missingboolean · default: false
If true and field does not exist or is null, the processor quietly exits without modifying the document.
target_fieldstring · default: field
The field to assign the converted value to.
By default, the field is updated in-place.
uri_partsobject
Parses a Uniform Resource Identifier (URI) string and extracts its components as an object.
This URI object includes properties for the URI’s domain, path, fragment, port, query, scheme, user info, username, and password.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
Field containing the URI string.
ignore_missingboolean · default: false
If true and field does not exist, the processor quietly exits without modifying the document.
keep_originalboolean · default: true
If true, the processor copies the unparsed URI to <target_field>.original.
remove_if_successfulboolean · default: false
If true, the processor removes the field after parsing the URI string.
If parsing fails, the processor does not remove the field.
target_fieldstring · default: url
Output field for the URI object.
user_agentobject
The user_agent processor extracts details from the user agent string a browser sends with its web requests.
This processor adds this information by default under the user_agent field.
descriptionstring
Description of the processor.
Useful for describing the purpose of the processor or its configuration.
ifstring
Conditionally execute the processor.
ignore_failureboolean
Ignore failures for the processor.
on_failureProcessor[]
Handle failures for the processor.
tagstring
Identifier for the processor.
Useful for debugging and metrics.
fieldstringrequired
The field containing the user agent string.
ignore_missingboolean · default: false
If true and field does not exist, the processor quietly exits without modifying the document.
regex_filestring
The name of the file in the config/ingest-user-agent directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the regexes.yaml from uap-core it ships with.
target_fieldstring · default: user_agent
The field that will be filled with the user agent details.
propertiesenum[]
Controls what properties are added to target_field.