---
type: api
title: Processor
url: https://www.elastic.co/docs/api/doc/elasticsearch/types/ingest-_types-processorcontainer
resource: https://www.elastic.co/docs/api/doc/elasticsearch/types/ingest-_types-processorcontainer
products:
  - Elasticsearch
---

# Processor

## Properties

- `append` (object)
  Appends one or more values to an existing array if the field already exists and it is an array.
Converts a scalar to an array and appends one or more values to it if the field exists and it is a scalar.
Creates an array containing the provided values if the field doesn’t exist.
Accepts a single value or an array of values.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to be appended to.
Supports template snippets.
  - `value` (union oneOf)
    The value to be appended. Supports template snippets. May specify only one of `value` or `copy_from`.
    One of: `object[]` or `object`
  - `media_type` (string · default: "application/json")
    The media type for encoding `value`.
Applies only when value is a template snippet.
Must be one of `application/json`, `text/plain`, or `application/x-www-form-urlencoded`.
  - `copy_from` (string)
    The origin field which will be appended to `field`, cannot set `value` simultaneously.
  - `allow_duplicates` (boolean · default: true)
    If `false`, the processor does not append values already present in the field.
  - `ignore_empty_values` (boolean · default: false)
    If `true`, the processor will skip empty values from the source (e.g. empty strings, and null values),
rather than appending them to the field.
- `attachment` (object)
  The attachment processor lets Elasticsearch extract file attachments in common formats (such as PPT, XLS, and PDF) by using the Apache text extraction library Tika.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to get the base64 encoded field from.
  - `ignore_missing` (boolean · default: false)
    If `true` and field does not exist, the processor quietly exits without modifying the document.
  - `indexed_chars` (number · default: 100000)
    The number of chars being used for extraction to prevent huge fields.
Use `-1` for no limit.
  - `indexed_chars_field` (string · default: null)
    Field name from which you can overwrite the number of chars being used for extraction.
  - `max_field_bytes` (number | string · default: -1)
    Maximum allowed size of the attachment `field` value in bytes: length of a string (if base64 in JSON,
checked before base64 decoding) or byte array length for binary (for example, CBOR).
If set to `-1`, there is no per-processor limit.
The node setting `ingest.attachment.max_field_size` also applies.
  - `properties` (string[])
    Array of properties to select to be stored.
Can be `content`, `title`, `name`, `author`, `keywords`, `date`, `content_type`, `content_length`, `language`.
  - `target_field` (string · default: attachment)
    The field that will hold the attachment information.
  - `remove_binary` (boolean · default: false)
    If true, the binary field will be removed from the document
  - `resource_name` (string)
    Field containing the name of the resource to decode.
If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
- `bytes` (object)
  Converts a human readable byte value (for example `1kb`) to its value in bytes (for example `1024`).
If the field is an array of strings, all members of the array will be converted.
Supported human readable units are "b", "kb", "mb", "gb", "tb", "pb" case insensitive.
An error will occur if the field is not a supported format or resultant value exceeds 2^63.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to convert.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
  - `target_field` (string · default: field)
    The field to assign the converted value to.
By default, the field is updated in-place.
- `cef` (object)
  Converts a CEF message into a structured format.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field containing the CEF message.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
  - `target_field` (string · default: 'cef')
    The field to assign the converted value to.
By default, the `target_field` is 'cef'
  - `ignore_empty_values` (boolean · default: false)
    If `true` and value is anempty string in extensions, the processor quietly exits without modifying the document.
  - `timezone` (string · default: UTC)
    The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
- `circle` (object)
  Converts circle definitions of shapes to regular polygons which approximate them.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `error_distance` (number)
    The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for `geo_shape`, unit-less for `shape`).
  - `field` (string)
    The field to interpret as a circle. Either a string in WKT format or a map for GeoJSON.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist, the processor quietly exits without modifying the document.
  - `shape_type` (enum)
    Which field mapping type is to be used when processing the circle: `geo_shape` or `shape`.
    Values: `geo_shape`, `shape`
  - `target_field` (string)
    The field to assign the polygon shape to
By default, the field is updated in-place.
- `community_id` (object)
  Computes the Community ID for network flow data as defined in the
Community ID Specification. You can use a community ID to correlate network
events related to a single flow.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `source_ip` (string · default: source.ip)
    Field containing the source IP address.
  - `source_port` (string · default: source.port)
    Field containing the source port.
  - `destination_ip` (string · default: destination.ip)
    Field containing the destination IP address.
  - `destination_port` (string · default: destination.port)
    Field containing the destination port.
  - `iana_number` (string · default: network.iana_number)
    Field containing the IANA number.
  - `icmp_type` (string · default: icmp.type)
    Field containing the ICMP type.
  - `icmp_code` (string · default: icmp.code)
    Field containing the ICMP code.
  - `transport` (string · default: network.transport)
    Field containing the transport protocol name or number. Used only when the
iana_number field is not present. The following protocol names are currently
supported: eigrp, gre, icmp, icmpv6, igmp, ipv6-icmp, ospf, pim, sctp, tcp, udp
  - `target_field` (string · default: network.community_id)
    Output field for the community ID.
  - `seed` (number · default: 0)
    Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The
seed can prevent hash collisions between network domains, such as a staging
and production network that use the same addressing scheme.
  - `ignore_missing` (boolean · default: true)
    If true and any required fields are missing, the processor quietly exits
without modifying the document.
- `convert` (object)
  Converts a field in the currently ingested document to a different type, such as converting a string to an integer.
If the field value is an array, all members will be converted.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field whose value is to be converted.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
  - `target_field` (string · default: field)
    The field to assign the converted value to.
By default, the `field` is updated in-place.
  - `type` (enum)
    The type to convert the existing value to.
    Values: `integer`, `long`, `double`, `float`, `boolean`, `ip`, `string`, `auto`
- `csv` (object)
  Extracts fields from CSV line out of a single text field within a document.
Any empty field in CSV will be skipped.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `empty_value` (object)
    Value used to fill empty fields.
Empty fields are skipped if this is not provided.
An empty field is one with no value (2 consecutive separators) or empty quotes (`""`).
  - `field` (string)
    The field to extract data from.
  - `ignore_missing` (boolean)
    If `true` and `field` does not exist, the processor quietly exits without modifying the document.
  - `quote` (string · default: ")
    Quote used in CSV, has to be single character string.
  - `separator` (string · default: ,)
    Separator used in CSV, has to be single character string.
  - `target_fields` (union oneOf)
    The array of fields to assign extracted values to.
    One of: `string[]` or `string`
  - `trim` (boolean)
    Trim whitespaces in unquoted fields.
- `date` (object)
  Parses dates from fields, and then uses the date or timestamp as the timestamp for the document.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to get the date from.
  - `formats` (string[])
    An array of the expected date formats.
Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  - `locale` (string · default: ENGLISH)
    The locale to use when parsing the date, relevant when parsing month names or week days.
Supports template snippets.
  - `target_field` (string · default: @timestamp)
    The field that will hold the parsed date.
  - `timezone` (string · default: UTC)
    The timezone to use when parsing the date.
Supports template snippets.
  - `output_format` (string · default: yyyy-MM-dd'T'HH:mm:ss.SSSXXX)
    The format to use when writing the date to target_field. Must be a valid
java time pattern.
- `date_index_name` (object)
  The purpose of this processor is to point documents to the right time based index based on a date or timestamp field in a document by using the date math index name support.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `date_formats` (string[])
    An array of the expected date formats for parsing dates / timestamps in the document being preprocessed.
Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  - `date_rounding` (string)
    How to round the date when formatting the date into the index name. Valid values are:
`y` (year), `M` (month), `w` (week), `d` (day), `h` (hour), `m` (minute) and `s` (second).
Supports template snippets.
  - `field` (string)
    The field to get the date or timestamp from.
  - `index_name_format` (string · default: yyyy-MM-dd)
    The format to be used when printing the parsed date into the index name.
A valid java time pattern is expected here.
Supports template snippets.
  - `index_name_prefix` (string)
    A prefix of the index name to be prepended before the printed date.
Supports template snippets.
  - `locale` (string · default: ENGLISH)
    The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
  - `timezone` (string · default: UTC)
    The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
- `dissect` (object)
  Extracts structured fields out of a single text field by matching the text field against a delimiter-based pattern.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `append_separator` (string · default: "")
    The character(s) that separate the appended fields.
  - `field` (string)
    The field to dissect.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
  - `pattern` (string)
    The pattern to apply to the field.
- `dot_expander` (object)
  Expands a field with dots into an object field.
This processor allows fields with dots in the name to be accessible by other processors in the pipeline.
Otherwise these fields can’t be accessed by any processor.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to expand into an object field.
If set to `*`, all top-level fields will be expanded.
  - `override` (boolean · default: false)
    Controls the behavior when there is already an existing nested object that conflicts with the expanded field.
When `false`, the processor will merge conflicts by combining the old and the new values into an array.
When `true`, the value from the expanded field will overwrite the existing value.
  - `path` (string)
    The field that contains the field to expand.
Only required if the field to expand is part another object field, because the `field` option can only understand leaf fields.
- `drop` (object)
  Drops the document without raising any errors.
This is useful to prevent the document from getting indexed based on some condition.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
- `enrich` (object)
  The `enrich` processor can enrich documents with data from another index.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field in the input document that matches the policies match_field used to retrieve the enrichment data.
Supports template snippets.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist, the processor quietly exits without modifying the document.
  - `max_matches` (number · default: 1)
    The maximum number of matched documents to include under the configured target field.
The `target_field` will be turned into a json array if `max_matches` is higher than 1, otherwise `target_field` will become a json object.
In order to avoid documents getting too large, the maximum allowed value is 128.
  - `override` (boolean · default: true)
    If processor will update fields with pre-existing non-null-valued field.
When set to `false`, such fields will not be touched.
  - `policy_name` (string)
    The name of the enrich policy to use.
  - `shape_relation` (enum · default: INTERSECTS)
    A spatial relation operator used to match the geoshape of incoming documents to documents in the enrich index.
This option is only used for `geo_match` enrich policy types.

Supported values include:
  - `intersects`: Return all documents whose `geo_shape` or `geo_point` field intersects the query geometry.
  - `disjoint`: Return all documents whose `geo_shape` or `geo_point` field has nothing in common with the query geometry.
  - `within`: Return all documents whose `geo_shape` or `geo_point` field is within the query geometry.
Line geometries are not supported.
  - `contains`: Return all documents whose `geo_shape` or `geo_point` field contains the query geometry.
    Values: `intersects`, `disjoint`, `within`, `contains`
  - `target_field` (string)
    Field added to incoming documents to contain enrich data. This field contains both the `match_field` and `enrich_fields` specified in the enrich policy.
Supports template snippets.
- `fail` (object)
  Raises an exception.
This is useful for when you expect a pipeline to fail and want to relay a specific message to the requester.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `message` (string)
    The error message thrown by the processor.
Supports template snippets.
- `fingerprint` (object)
  Computes a hash of the document’s content. You can use this hash for
content fingerprinting.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `fields` (union oneOf)
    Array of fields to include in the fingerprint. For objects, the processor
hashes both the field key and value. For other fields, the processor hashes
only the field value.
    One of: `string[]` or `string`
  - `target_field` (string · default: fingerprint)
    Output field for the fingerprint.
  - `salt` (string)
    Salt value for the hash function.
  - `method` (enum · default: SHA-1)
    The hash method used to compute the fingerprint. Must be one of MD5, SHA-1,
SHA-256, SHA-512, or MurmurHash3.
    Values: `MD5`, `SHA-1`, `SHA-256`, `SHA-512`, `MurmurHash3`
  - `ignore_missing` (boolean · default: false)
    If true, the processor ignores any missing fields. If all fields are
missing, the processor silently exits without modifying the document.
- `foreach` (object)
  Runs an ingest processor on each element of an array or object.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    Field containing array or object values.
  - `ignore_missing` (boolean · default: false)
    If `true`, the processor silently exits without changing the document if the `field` is `null` or missing.
  - `processor` (Processor) — recursive
    Ingest processor to run on each element.
- `ip_location` (object)
  Currently an undocumented alias for GeoIP Processor.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `database_file` (string · default: GeoLite2-City.mmdb)
    The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  - `field` (string)
    The field to get the ip address from for the geographical lookup.
  - `first_only` (boolean · default: true)
    If `true`, only the first found IP location data will be returned, even if the field contains an array.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist, the processor quietly exits without modifying the document.
  - `properties` (string[])
    Controls what properties are added to the `target_field` based on the IP location lookup.
  - `target_field` (string · default: geoip)
    The field that will hold the geographical information looked up from the MaxMind database.
  - `download_database_on_pipeline_creation` (boolean)
    If `true` (and if `ingest.geoip.downloader.eager.download` is `false`), the missing database is downloaded when the pipeline is created.
Else, the download is triggered by when the pipeline is used as the `default_pipeline` or `final_pipeline` in an index.
- `geo_grid` (object)
  Converts geo-grid definitions of grid tiles or cells to regular bounding boxes or polygons which describe their shape.
This is useful if there is a need to interact with the tile shapes as spatially indexable fields.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to interpret as a geo-tile.=
The field format is determined by the `tile_type`.
  - `tile_type` (enum)
    Three tile formats are understood: geohash, geotile and geohex.
    Values: `geotile`, `geohex`, `geohash`
  - `target_field` (string · default: field)
    The field to assign the polygon shape to, by default, the `field` is updated in-place.
  - `parent_field` (string)
    If specified and a parent tile exists, save that tile address to this field.
  - `children_field` (string)
    If specified and children tiles exist, save those tile addresses to this field as an array of strings.
  - `non_children_field` (string)
    If specified and intersecting non-child tiles exist, save their addresses to this field as an array of strings.
  - `precision_field` (string)
    If specified, save the tile precision (zoom) as an integer to this field.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist, the processor quietly exits without modifying the document.
  - `target_format` (enum · default: geojson)
    Which format to save the generated polygon in.
    Values: `geojson`, `wkt`
- `geoip` (object)
  The `geoip` processor adds information about the geographical location of an IPv4 or IPv6 address.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `database_file` (string · default: GeoLite2-City.mmdb)
    The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  - `field` (string)
    The field to get the ip address from for the geographical lookup.
  - `first_only` (boolean · default: true)
    If `true`, only the first found geoip data will be returned, even if the field contains an array.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist, the processor quietly exits without modifying the document.
  - `properties` (string[])
    Controls what properties are added to the `target_field` based on the geoip lookup.
  - `target_field` (string · default: geoip)
    The field that will hold the geographical information looked up from the MaxMind database.
  - `download_database_on_pipeline_creation` (boolean)
    If `true` (and if `ingest.geoip.downloader.eager.download` is `false`), the missing database is downloaded when the pipeline is created.
Else, the download is triggered by when the pipeline is used as the `default_pipeline` or `final_pipeline` in an index.
- `grok` (object)
  Extracts structured fields out of a single text field within a document.
You choose which field to extract matched fields from, as well as the grok pattern you expect will match.
A grok pattern is like a regular expression that supports aliased expressions that can be reused.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `ecs_compatibility` (string · default: disabled)
    Must be disabled or v1. If v1, the processor uses patterns with Elastic
Common Schema (ECS) field names.
  - `field` (string)
    The field to use for grok expression parsing.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
  - `pattern_definitions` (map string to string)
    A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor.
Patterns matching existing names will override the pre-existing definition.
  - `patterns` (string[])
    An ordered list of grok expression to match and extract named captures with.
Returns on the first expression in the list that matches.
  - `trace_match` (boolean · default: false)
    When `true`, `_ingest._grok_match_index` will be inserted into your matched document’s metadata with the index into the pattern found in `patterns` that matched.
  - `validate_only` (boolean · default: false)
    When `true`, the processor does matching but does not extract structured fields
- `gsub` (object)
  Converts a string field by applying a regular expression and a replacement.
If the field is an array of string, all members of the array will be converted.
If any non-string values are encountered, the processor will throw an exception.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to apply the replacement to.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
  - `pattern` (string)
    The pattern to be replaced.
  - `replacement` (string)
    The string to replace the matching patterns with.
  - `target_field` (string · default: field)
    The field to assign the converted value to
By default, the `field` is updated in-place.
- `html_strip` (object)
  Removes HTML tags from the field.
If the field is an array of strings, HTML tags will be removed from all members of the array.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The string-valued field to remove HTML tags from.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document,
  - `target_field` (string · default: field)
    The field to assign the converted value to
By default, the `field` is updated in-place.
- `inference` (object)
  Uses a pre-trained data frame analytics model or a model deployed for natural language processing tasks to infer against the data that is being ingested in the pipeline.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `model_id` (string)
    The ID or alias for the trained model, or the ID of the deployment.
  - `target_field` (string · default: ml.inference.<processor_tag>)
    Field added to incoming documents to contain results objects.
  - `field_map` (map string to object)
    Maps the document field names to the known field names of the model.
This mapping takes precedence over any default mappings provided in the model configuration.
  - `inference_config` (object)
    Contains the inference type and its options.
    - `regression` (object)
      Regression configuration for inference.
      - `results_field` (string · default: <dependent_variable>_prediction)
        The field that is added to incoming documents to contain the inference prediction.
      - `num_top_feature_importance_values` (number · default: 0)
        Specifies the maximum number of feature importance values per document.
    - `classification` (object)
      Classification configuration for inference.
      - `num_top_classes` (number · default: 0)
        Specifies the number of top class predictions to return.
      - `num_top_feature_importance_values` (number · default: 0)
        Specifies the maximum number of feature importance values per document.
      - `results_field` (string · default: <dependent_variable>_prediction)
        The field that is added to incoming documents to contain the inference prediction.
      - `top_classes_results_field` (string · default: top_classes)
        Specifies the field to which the top classes are written.
      - `prediction_field_type` (string)
        Specifies the type of the predicted field to write.
Valid values are: `string`, `number`, `boolean`.
  - `input_output` (union oneOf)
    Input fields for inference and output (destination) fields for the inference results.
This option is incompatible with the target_field and field_map options.
    `object` or `object[]`
    - `input_field` (string)
    - `output_field` (string)
  - `ignore_missing` (boolean)
    If true and any of the input fields defined in input_ouput are missing
then those missing fields are quietly ignored, otherwise a missing field causes a failure.
Only applies when using input_output configurations to explicitly list the input fields.
- `join` (object)
  Joins each element of an array into a single string using a separator character between each element.
Throws an error when the field is not an array.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    Field containing array values to join.
  - `separator` (string)
    The separator character.
  - `target_field` (string · default: field)
    The field to assign the joined value to.
By default, the field is updated in-place.
- `json` (object)
  Parses a string containing JSON data into a structured object, string, or other value.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `add_to_root` (boolean · default: false)
    Flag that forces the parsed JSON to be added at the top level of the document.
`target_field` must not be set when this option is chosen.
  - `add_to_root_conflict_strategy` (enum)
    When set to `replace`, root fields that conflict with fields from the parsed JSON will be overridden.
When set to `merge`, conflicting fields will be merged.
Only applicable `if add_to_root` is set to true.

Supported values include:
  - `replace`: Root fields that conflict with fields from the parsed JSON will be overridden.
  - `merge`: Conflicting fields will be merged.
    Values: `replace`, `merge`
  - `allow_duplicate_keys` (boolean · default: false)
    When set to `true`, the JSON parser will not fail if the JSON contains duplicate keys.
Instead, the last encountered value for any duplicate key wins.
  - `field` (string)
    The field to be parsed.
  - `target_field` (string · default: field)
    The field that the converted structured object will be written into.
Any existing content in this field will be overwritten.
- `kv` (object)
  This processor helps automatically parse messages (or specific event fields) which are of the `foo=bar` variety.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `exclude_keys` (string[])
    List of keys to exclude from document.
  - `field` (string)
    The field to be parsed.
Supports template snippets.
  - `field_split` (string)
    Regex pattern to use for splitting key-value pairs.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
  - `include_keys` (string[])
    List of keys to filter and insert into document.
Defaults to including all keys.
  - `prefix` (string · default: null)
    Prefix to be added to extracted keys.
  - `strip_brackets` (boolean · default: false)
    If `true`. strip brackets `()`, `<>`, `[]` as well as quotes `'` and `"` from extracted values.
  - `target_field` (string)
    The field to insert the extracted keys into.
Defaults to the root of the document.
Supports template snippets.
  - `trim_key` (string)
    String of characters to trim from extracted keys.
  - `trim_value` (string)
    String of characters to trim from extracted values.
  - `value_split` (string)
    Regex pattern to use for splitting the key from the value within a key-value pair.
- `lowercase` (object)
  Converts a string to its lowercase equivalent.
If the field is an array of strings, all members of the array will be converted.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to make lowercase.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
  - `target_field` (string · default: field)
    The field to assign the converted value to.
By default, the field is updated in-place.
- `network_direction` (object)
  Calculates the network direction given a source IP address, destination IP
address, and a list of internal networks.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `source_ip` (string · default: source.ip)
    Field containing the source IP address.
  - `destination_ip` (string · default: destination.ip)
    Field containing the destination IP address.
  - `target_field` (string · default: network.direction)
    Output field for the network direction.
  - `internal_networks` (string[])
    List of internal networks. Supports IPv4 and IPv6 addresses and ranges in
CIDR notation. Also supports the named ranges listed below. These may be
constructed with template snippets. Must specify only one of
internal_networks or internal_networks_field.
  - `internal_networks_field` (string)
    A field on the given document to read the internal_networks configuration
from.
  - `ignore_missing` (boolean · default: true)
    If true and any required fields are missing, the processor quietly exits
without modifying the document.
- `normalize_for_stream` (object)
  Detects whether a document is OpenTelemetry-compliant and, if not, normalizes it so that it can be queried by clients that expect either ECS or OpenTelemetry Semantic Conventions formats.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
- `pipeline` (object)
  Executes another pipeline.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `name` (string)
    The name of the pipeline to execute.
Supports template snippets.
  - `ignore_missing_pipeline` (boolean · default: false)
    Whether to ignore missing pipelines instead of failing.
- `recover_failure_document` (object)
  Recovers documents that have been stored in a data stream's failure store by restoring them to their original format.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
- `redact` (object)
  The Redact processor uses the Grok rules engine to obscure text in the input document matching the given Grok patterns.
The processor can be used to obscure Personal Identifying Information (PII) by configuring it to detect known patterns such as email or IP addresses.
Text that matches a Grok pattern is replaced with a configurable string such as `<EMAIL>` where an email address is matched or simply replace all matches with the text `<REDACTED>` if preferred.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to be redacted
  - `patterns` (string[])
    A list of grok expressions to match and redact named captures with
  - `pattern_definitions` (map string to string)
  - `prefix` (string · default: <)
    Start a redacted section with this token
  - `suffix` (string · default: >)
    End a redacted section with this token
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
  - `skip_if_unlicensed` (boolean · default: false)
    If `true` and the current license does not support running redact processors, then the processor quietly exits without modifying the document
  - `trace_redact` (boolean · default: false)
    If `true` then ingest metadata `_ingest._redact._is_redacted` is set to `true` if the document has been redacted
- `registered_domain` (object)
  Extracts the registered domain (also known as the effective top-level
domain or eTLD), sub-domain, and top-level domain from a fully qualified
domain name (FQDN). Uses the registered domains defined in the Mozilla
Public Suffix List.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    Field containing the source FQDN.
  - `target_field` (string)
    Object field containing extracted domain components. If an empty string,
the processor adds components to the document’s root.
  - `ignore_missing` (boolean · default: true)
    If true and any required fields are missing, the processor quietly exits
without modifying the document.
- `remove` (object)
  Removes existing fields.
If one field doesn’t exist, an exception will be thrown.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (union oneOf)
    Fields to be removed. Supports template snippets.
    One of: `string[]` or `string`
  - `keep` (union oneOf)
    Fields to be kept. When set, all fields other than those specified are removed.
    One of: `string[]` or `string`
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
- `rename` (object)
  Renames an existing field.
If the field doesn’t exist or the new name is already used, an exception will be thrown.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to be renamed.
Supports template snippets.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist, the processor quietly exits without modifying the document.
  - `override` (boolean · default: false)
    If `true`, the processor overwrites `target_field` if it already exists.
If `false`, the processor fails when `target_field` already exists.
  - `target_field` (string)
    The new name of the field.
Supports template snippets.
- `reroute` (object)
  Routes a document to another target index or data stream.
When setting the `destination` option, the target is explicitly specified and the dataset and namespace options can’t be set.
When the `destination` option is not set, this processor is in a data stream mode. Note that in this mode, the reroute processor can only be used on data streams that follow the data stream naming scheme.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `destination` (string)
    A static value for the target. Can’t be set when the dataset or namespace option is set.
  - `dataset` (union string | string[])
    Field references or a static value for the dataset part of the data stream name.
In addition to the criteria for index names, cannot contain - and must be no longer than 100 characters.
Example values are nginx.access and nginx.error.

Supports field references with a mustache-like syntax (denoted as `{{double}}` or `{{{triple}}}` curly braces).
When resolving field references, the processor replaces invalid characters with _. Uses the <dataset> part
of the index name as a fallback if all field references resolve to a null, missing, or non-string value.

default `{{data_stream.dataset}}`
  - `namespace` (union string | string[])
    Field references or a static value for the namespace part of the data stream name. See the criteria for
index names for allowed characters. Must be no longer than 100 characters.

Supports field references with a mustache-like syntax (denoted as `{{double}}` or `{{{triple}}}` curly braces).
When resolving field references, the processor replaces invalid characters with _. Uses the <namespace> part
of the index name as a fallback if all field references resolve to a null, missing, or non-string value.

default `{{data_stream.namespace}}`
- `script` (object)
  Runs an inline or stored script on incoming documents.
The script runs in the `ingest` context.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `id` (string)
    ID of a stored script.
If no `source` is specified, this parameter is required.
  - `lang` (union anyOf · default: painless)
    Script language.

Supported values include:
  - `painless`: Painless scripting language, purpose-built for Elasticsearch.
  - `expression`: Lucene’s expressions language, compiles a JavaScript expression to bytecode.
  - `mustache`: Mustache templated, used for templates.
  - `java`: Expert Java API
    Values: `painless`, `expression`, `mustache`, `java`
  - `params` (map string to object)
    Object containing parameters for the script.
  - `source` (union oneOf)
    Inline script.
If no `id` is specified, this parameter is required.
    - **string**
    - **SearchRequestBody**
      - `aggregations` (map string to {} Aggregation)
        Defines the aggregations that are run as part of the search request.
        See [Aggregation](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-aggregations-aggregationcontainer)
      - `collapse` (object)
        Collapses search results the values of the specified field.
        - `field` (string)
          The field to collapse the result set on
        - `inner_hits` (union oneOf)
          The number of inner hits and their sort order
          `object` or `object[]`
          - `name` (string)
            The name for the particular inner hit definition in the response.
Useful when a search request contains multiple inner hits.
          - `size` (number · default: 3)
            The maximum number of hits to return per `inner_hits`.
          - `from` (number · default: 0)
            Inner hit starting document offset.
          - `collapse` (object) — recursive
            Same fields as `collapse` in `SearchRequestBody`
          - `docvalue_fields` (object[])
            - `field` (string)
              A wildcard pattern. The request returns values for field names matching this pattern.
            - `format` (string)
              The format in which the values are returned.
            - `include_unmapped` (boolean)
          - `explain` (boolean)
          - `highlight` (object)
            - `type` (union anyOf)
              

Supported values include:
  - `plain`: The `plain` highlighter uses the standard Lucene highlighter
  - `fvh`: The fvh highlighter uses the Lucene Fast Vector highlighter.
  - `unified`: The unified highlighter uses the Lucene Unified Highlighter.
              Values: `plain`, `fvh`, `unified`
            - `boundary_chars` (string · default: .,!? \t\n)
              A string that contains each boundary character.
            - `boundary_max_scan` (number · default: 20)
              How far to scan for boundary characters.
            - `boundary_scanner` (enum)
              Specifies how to break the highlighted fragments: chars, sentence, or word.
Only valid for the unified and fvh highlighters.
Defaults to `sentence` for the `unified` highlighter. Defaults to `chars` for the `fvh` highlighter.

Supported values include:
  - `chars`: Use the characters specified by `boundary_chars` as highlighting boundaries.
The `boundary_max_scan` setting controls how far to scan for boundary characters.
Only valid for the `fvh` highlighter.
  - `sentence`: Break highlighted fragments at the next sentence boundary, as determined by Java’s `BreakIterator`.
You can specify the locale to use with `boundary_scanner_locale`.
When used with the `unified` highlighter, the `sentence` scanner splits sentences bigger than `fragment_size` at the first word boundary next to fragment_size.
You can set `fragment_size` to `0` to never split any sentence.
  - `word`: Break highlighted fragments at the next word boundary, as determined by Java’s `BreakIterator`.
You can specify the locale to use with `boundary_scanner_locale`.
              Values: `chars`, `sentence`, `word`
            - `boundary_scanner_locale` (string · default: Locale.ROOT)
              Controls which locale is used to search for sentence and word boundaries.
This parameter takes a form of a language tag, for example: `"en-US"`, `"fr-FR"`, `"ja-JP"`.
            - `force_source` (boolean) — deprecated
            - `fragmenter` (enum · default: span)
              Specifies how text should be broken up in highlight snippets: `simple` or `span`.
Only valid for the `plain` highlighter.
              Values: `simple`, `span`
            - `fragment_size` (number · default: 100)
              The size of the highlighted fragment in characters.
            - `highlight_filter` (boolean)
            - `highlight_query` ({} Query)
              Highlight matches for a query other than the search query.
This is especially useful if you use a rescore query because those are not taken into account by highlighting by default.
              See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
            - `max_fragment_length` (number)
            - `max_analyzed_offset` (number)
              If set to a non-negative value, highlighting stops at this defined maximum limit.
The rest of the text is not processed, thus not highlighted and no error is returned
The `max_analyzed_offset` query setting does not override the `index.highlight.max_analyzed_offset` setting, which prevails when it’s set to lower value than the query setting.
            - `no_match_size` (number · default: 0)
              The amount of text you want to return from the beginning of the field if there are no matching fragments to highlight.
            - `number_of_fragments` (number · default: 5)
              The maximum number of fragments to return.
If the number of fragments is set to `0`, no fragments are returned.
Instead, the entire field contents are highlighted and returned.
This can be handy when you need to highlight short texts such as a title or address, but fragmentation is not required.
If `number_of_fragments` is `0`, `fragment_size` is ignored.
            - `options` (map string to object)
            - `order` (enum · default: none)
              Sorts highlighted fragments by score when set to `score`.
By default, fragments will be output in the order they appear in the field (order: `none`).
Setting this option to `score` will output the most relevant fragments first.
Each highlighter applies its own logic to compute relevancy scores.
              Values: `score`
            - `phrase_limit` (number · default: 256)
              Controls the number of matching phrases in a document that are considered.
Prevents the `fvh` highlighter from analyzing too many phrases and consuming too much memory.
When using `matched_fields`, `phrase_limit` phrases per matched field are considered. Raising the limit increases query time and consumes more memory.
Only supported by the `fvh` highlighter.
            - `post_tags` (string[])
              Use in conjunction with `pre_tags` to define the HTML tags to use for the highlighted text.
By default, highlighted text is wrapped in `<em>` and `</em>` tags.
            - `pre_tags` (string[])
              Use in conjunction with `post_tags` to define the HTML tags to use for the highlighted text.
By default, highlighted text is wrapped in `<em>` and `</em>` tags.
            - `require_field_match` (boolean · default: true)
              By default, only fields that contains a query match are highlighted.
Set to `false` to highlight all fields.
            - `tags_schema` (enum)
              Set to `styled` to use the built-in tag schema.
              Values: `styled`
            - `encoder` (enum)
              Values: `default`, `html`
            - `fields` (union oneOf)
              `map string to object` or `[] map string to object`
          - `ignore_unmapped` (boolean)
          - `script_fields` (map string to object)
            Map values (object)
            - `script` (string)
            - `ignore_failure` (boolean)
          - `seq_no_primary_term` (boolean)
          - `field` (string[])
          - `fields` (object[])
            - `field` (string)
              A wildcard pattern. The request returns values for field names matching this pattern.
            - `format` (string)
              The format in which the values are returned.
            - `include_unmapped` (boolean)
          - `sort` (union oneOf)
            How the inner hits should be sorted per `inner_hits`.
By default, inner hits are sorted by score.
            A value or an array; each item is one of:
            - **string**
              Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
            - **SortOptions**
              - `_score` (object)
                - `order` (enum)
                  

Supported values include:
  - `asc`: Ascending (smallest to largest)
  - `desc`: Descending (largest to smallest)
                  Values: `asc`, `desc`
              - `_doc` (object)
                - `order` (enum)
                  

Supported values include:
  - `asc`: Ascending (smallest to largest)
  - `desc`: Descending (largest to smallest)
                  Values: `asc`, `desc`
              - `_geo_distance` (object)
                - `mode` (enum)
                  Values: `min`, `max`, `sum`, `avg`, `median`
                - `distance_type` (enum)
                  

Supported values include:
  - `arc`: The `arc` calculation is the most accurate.
  - `plane`: The `plane` calculation is faster but less accurate.
                  Values: `arc`, `plane`
                - `ignore_unmapped` (boolean)
                - `order` (enum)
                  

Supported values include:
  - `asc`: Ascending (smallest to largest)
  - `desc`: Descending (largest to smallest)
                  Values: `asc`, `desc`
                - `unit` (enum)
                  Values: `in`, `ft`, `yd`, `mi`, `nmi`, `km`, `m`, `cm`, `mm`
                - `nested` (object)
                  - `filter` ({} Query)
                    See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
                  - `max_children` (number)
                  - `nested` (object) — recursive
                    Same fields as `nested` in `_geo_distance`
                  - `path` (string)
              - `_script` (object)
                - `order` (enum)
                  

Supported values include:
  - `asc`: Ascending (smallest to largest)
  - `desc`: Descending (largest to smallest)
                  Values: `asc`, `desc`
                - `script` (string)
                - `type` (enum)
                  Values: `string`, `number`, `version`
                - `mode` (enum)
                  Values: `min`, `max`, `sum`, `avg`, `median`
                - `nested` (object)
                  - `filter` ({} Query)
                    See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
                  - `max_children` (number)
                  - `nested` (object) — recursive
                    Same fields as `nested` in `_script`
                  - `path` (string)
          - `_source` (union oneOf)
            - **boolean**
            - **SourceFilter**
              - `exclude_vectors` (boolean)
                If `true`, vector fields are excluded from the returned source.

This option takes precedence over `includes`: any vector field will
remain excluded even if it matches an `includes` rule.
              - `excludes` (union oneOf)
                A list of fields to exclude from the returned source.
                One of: `string[]` or `string`
              - `includes` (union oneOf)
                A list of fields to include in the returned source.
                One of: `string[]` or `string`
          - `stored_fields` (union oneOf)
            One of: `string[]` or `string`
          - `track_scores` (boolean · default: false)
          - `version` (boolean)
        - `max_concurrent_group_searches` (number)
          The number of concurrent requests allowed to retrieve the inner_hits per group
      - `explain` (boolean · default: false)
        If `true`, the request returns detailed information about score computation as part of a hit.
      - `ext` (map string to object)
        Configuration of search extensions defined by Elasticsearch plugins.
      - `from` (number · default: 0)
        The starting document offset, which must be non-negative.
By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.
To page through more hits, use the `search_after` parameter.
      - `highlight` (object)
        Specifies the highlighter to use for retrieving highlighted snippets from one or more fields in your search results.
        Same fields as `highlight` in `inner_hits`
      - `track_total_hits` (boolean | number · default: 10000)
        Number of hits matching the query to count accurately.
If `true`, the exact number of hits is returned at the cost of some performance.
If `false`, the  response does not include the total number of hits matching the query.
      - `indices_boost` (string to number[])
        Boost the `_score` of documents from specified indices.
The boost value is the factor by which scores are multiplied.
A boost value greater than `1.0` increases the score.
A boost value between `0` and `1.0` decreases the score.
      - `docvalue_fields` (object[])
        An array of wildcard (`*`) field patterns.
The request returns doc values for field names matching these patterns in the `hits.fields` property of the response.
        - `field` (string)
          A wildcard pattern. The request returns values for field names matching this pattern.
        - `format` (string)
          The format in which the values are returned.
        - `include_unmapped` (boolean)
      - `knn` (union oneOf)
        The approximate kNN search to run.
        `object` or `object[]`
        - `field` (string)
          The name of the vector field to search against
        - `query_vector` (union oneOf)
          The query vector
          One of: `number[]` or `string`
        - `query_vector_builder` (object)
          The query vector builder. You must provide a query_vector_builder or query_vector, but not both.
          - `embedding` (object)
            - `inference_id` (string)
            - `input` (union oneOf)
              - **string**
              - **InferenceStringGroup**
                One of:
                - **[]InferenceString**
                  - `type` (enum)
                    The type of data that the value represents.
                    Values: `text`, `image`, `audio`, `video`, `pdf`
                  - `format` (union enum | string) — nullable
                    The format of the data. If null, the default data format for the given type is used.
                    Values: `text`, `base64`, `url`
                  - `value` (string)
                    String which may be raw text, the string representation of some other data such as an image in base64, or a URL that points to the data.
                - **InferenceString**
                  - `type` (enum)
                    The type of data that the value represents.
                    Values: `text`, `image`, `audio`, `video`, `pdf`
                  - `format` (union enum | string) — nullable
                    The format of the data. If null, the default data format for the given type is used.
                    Values: `text`, `base64`, `url`
                  - `value` (string)
                    String which may be raw text, the string representation of some other data such as an image in base64, or a URL that points to the data.
            - `timeout` (union oneOf)
              Values: `-1`, `0`
          - `text_embedding` (object)
            - `model_id` (string)
              Model ID is required for all dense_vector fields but
may be inferred for semantic_text fields
            - `model_text` (string)
              The text to be converted into a vector by the specified model
          - `lookup` (object)
            Lookup a vector from an existing document.
Must reference a dense_vector field and a single value.
            - `id` (string)
              The ID of the document to fetch the vector from
            - `index` (string)
              The name of the index to fetch the document from
            - `path` (string)
              The name of the field containing the vector
            - `routing` (string)
              The routing value to use when fetching the document
        - `k` (number)
          The final number of nearest neighbors to return as top hits
        - `num_candidates` (number)
          The number of nearest neighbor candidates to consider per shard
        - `visit_percentage` (number)
          The percentage of vectors to explore per shard while doing knn search with bbq_disk
        - `boost` (number)
          Boost value to apply to kNN scores
        - `filter` (union oneOf)
          Filters for the kNN search query
          One of: [`Query[]`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`Query`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
        - `similarity` (number)
          The minimum similarity for a vector to be considered a match
        - `inner_hits` (object)
          If defined, each search hit will contain inner hits.
          - `name` (string)
            The name for the particular inner hit definition in the response.
Useful when a search request contains multiple inner hits.
          - `size` (number · default: 3)
            The maximum number of hits to return per `inner_hits`.
          - `from` (number · default: 0)
            Inner hit starting document offset.
          - `collapse` (object)
            - `field` (string)
              The field to collapse the result set on
            - `inner_hits` (union oneOf) — recursive
              The number of inner hits and their sort order
              `object` or `object[]`
            - `max_concurrent_group_searches` (number)
              The number of concurrent requests allowed to retrieve the inner_hits per group
          - `docvalue_fields` (object[])
            - `field` (string)
              A wildcard pattern. The request returns values for field names matching this pattern.
            - `format` (string)
              The format in which the values are returned.
            - `include_unmapped` (boolean)
          - `explain` (boolean)
          - `highlight` (object)
            Same fields as `highlight` in `inner_hits`
          - `ignore_unmapped` (boolean)
          - `script_fields` (map string to object)
            Map values (object)
            - `script` (string)
            - `ignore_failure` (boolean)
          - `seq_no_primary_term` (boolean)
          - `field` (string[])
          - `fields` (object[])
            - `field` (string)
              A wildcard pattern. The request returns values for field names matching this pattern.
            - `format` (string)
              The format in which the values are returned.
            - `include_unmapped` (boolean)
          - `sort` (union oneOf)
            How the inner hits should be sorted per `inner_hits`.
By default, inner hits are sorted by score.
            Same options as `sort` in `inner_hits`
          - `_source` (union oneOf)
            - **boolean**
            - **SourceFilter**
              - `exclude_vectors` (boolean)
                If `true`, vector fields are excluded from the returned source.

This option takes precedence over `includes`: any vector field will
remain excluded even if it matches an `includes` rule.
              - `excludes` (union oneOf)
                A list of fields to exclude from the returned source.
                One of: `string[]` or `string`
              - `includes` (union oneOf)
                A list of fields to include in the returned source.
                One of: `string[]` or `string`
          - `stored_fields` (union oneOf)
            One of: `string[]` or `string`
          - `track_scores` (boolean · default: false)
          - `version` (boolean)
        - `rescore_vector` (object)
          Apply oversampling and rescoring to quantized vectors
          - `oversample` (number)
            Applies the specified oversample factor to k on the approximate kNN search
        - `_name` (string)
      - `rank` (object)
        The Reciprocal Rank Fusion (RRF) to use.
        - `rrf` (object)
          The reciprocal rank fusion parameters
          - `rank_constant` (number)
            How much influence documents in individual result sets per query have over the final ranked result set
          - `rank_window_size` (number)
            Size of the individual result sets per query
      - `min_score` (number)
        The minimum `_score` for matching documents.
Documents with a lower `_score` are not included in search results or results collected by aggregations.
      - `post_filter` ({} Query)
        Use the `post_filter` parameter to filter search results.
The search hits are filtered after the aggregations are calculated.
A post filter has no impact on the aggregation results.
        See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
      - `profile` (boolean · default: false)
        Set to `true` to return detailed timing information about the execution of individual components in a search request.
NOTE: This is a debugging tool and adds significant overhead to search execution.
      - `query` ({} Query)
        The search definition using the Query DSL.
        See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
      - `rescore` (union oneOf)
        Can be used to improve precision by reordering just the top (for example 100 - 500) documents returned by the `query` and `post_filter` phases.
        `object` or `object[]`
        - `window_size` (number)
        - `query` (object)
          - `rescore_query` ({} Query)
            The query to use for rescoring.
This query is only run on the Top-K results returned by the `query` and `post_filter` phases.
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          - `query_weight` (number · default: 1)
            Relative importance of the original query versus the rescore query.
          - `rescore_query_weight` (number · default: 1)
            Relative importance of the rescore query versus the original query.
          - `score_mode` (enum · default: total)
            Determines how scores are combined.

Supported values include:
  - `avg`: Average the original score and the rescore query score.
  - `max`: Take the max of original score and the rescore query score.
  - `min`: Take the min of the original score and the rescore query score.
  - `multiply`: Multiply the original score by the rescore query score.
Useful for `function` query rescores.
  - `total`: Add the original score and the rescore query score.
            Values: `avg`, `max`, `min`, `multiply`, `total`
        - `learning_to_rank` (object)
          - `model_id` (string)
            The unique identifier of the trained model uploaded to Elasticsearch
          - `params` (map string to object)
            Named parameters to be passed to the query templates used for feature
        - `script` (object)
          - `script` (string)
      - `retriever` (object)
        A retriever is a specification to describe top documents returned from a search.
A retriever replaces other elements of the search API that also return top documents such as `query` and `knn`.
        - `standard` (object)
          A retriever that replaces the functionality of a traditional query.
          - `filter` (union oneOf)
            Query to filter the documents that can match.
            One of: [`Query[]`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`Query`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          - `min_score` (number)
            Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
          - `_name` (string)
            Retriever name.
          - `query` ({} Query)
            Defines a query to retrieve a set of top documents.
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          - `search_after` (union[])
            Defines a search after object parameter used for pagination.
          - `terminate_after` (number)
            Maximum number of documents to collect for each shard.
          - `sort` (union oneOf)
            A sort object that that specifies the order of matching documents.
            Same options as `sort` in `inner_hits`
          - `collapse` (object)
            Collapses the top documents by a specified key into a single top document per key.
            Same fields as `collapse` in `SearchRequestBody`
        - `knn` (object)
          A retriever that replaces the functionality  of a knn search.
          - `filter` (union oneOf)
            Query to filter the documents that can match.
            One of: [`Query[]`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`Query`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          - `min_score` (number)
            Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
          - `_name` (string)
            Retriever name.
          - `field` (string)
            The name of the vector field to search against.
          - `query_vector` (union oneOf)
            Query vector. Must have the same number of dimensions as the vector field you are searching against. You must provide a query_vector_builder or query_vector, but not both.
            One of: `number[]` or `string`
          - `query_vector_builder` (object)
            Defines a model to build a query vector.
            Same fields as `query_vector_builder` in `knn`
          - `k` (number)
            Number of nearest neighbors to return as top hits.
          - `num_candidates` (number)
            Number of nearest neighbor candidates to consider per shard.
          - `visit_percentage` (number)
            The percentage of vectors to explore per shard while doing knn search with bbq_disk
          - `similarity` (number)
            The minimum similarity required for a document to be considered a match.
          - `rescore_vector` (object)
            Apply oversampling and rescoring to quantized vectors
            - `oversample` (number)
              Applies the specified oversample factor to k on the approximate kNN search
        - `rrf` (object)
          A retriever that produces top documents from reciprocal rank fusion (RRF).
          - `filter` (union oneOf)
            Query to filter the documents that can match.
            One of: [`Query[]`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`Query`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          - `min_score` (number)
            Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
          - `_name` (string)
            Retriever name.
          - `retrievers` (union oneOf[]) — recursive
            A list of child retrievers to specify which sets of returned top documents will have the RRF formula applied to them. Each retriever can optionally include a weight parameter.
          - `rank_constant` (number)
            This value determines how much influence documents in individual result sets per query have over the final ranked result set.
          - `rank_window_size` (number)
            This value determines the size of the individual result sets per query.
          - `query` (string)
          - `fields` (string[])
        - `text_similarity_reranker` (object)
          A retriever that reranks the top documents based on a reranking model using the InferenceAPI
          - `filter` (union oneOf)
            Query to filter the documents that can match.
            One of: [`Query[]`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`Query`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          - `min_score` (number)
            Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
          - `_name` (string)
            Retriever name.
          - `retriever` (object) — recursive
            The nested retriever which will produce the first-level results, that will later be used for reranking.
            Same fields as `retriever` in `SearchRequestBody`
          - `rank_window_size` (number)
            This value determines how many documents we will consider from the nested retriever.
          - `inference_id` (string)
            Unique identifier of the inference endpoint created using the inference API.
          - `inference_text` (string)
            The text snippet used as the basis for similarity comparison.
          - `field` (string)
            The document field to be used for text similarity comparisons. This field should contain the text that will be evaluated against the inference_text.
          - `chunk_rescorer` (object)
            Whether to rescore on only the best matching chunks.
            - `size` (number)
              The number of chunks per document to evaluate for reranking.
            - `chunking_settings` (object)
              Chunking settings to apply
              - `max_chunk_size` (number · default: 250)
                The maximum size of a chunk in words.
This value cannot be lower than `20` (for `sentence` strategy) or `10` (for `word` strategy).
This value should not exceed the window size for the associated model.
              - `overlap` (number · default: 100)
                The number of overlapping words for chunks.
It is applicable only to a `word` chunking strategy.
This value cannot be higher than half the `max_chunk_size` value.
              - `sentence_overlap` (number · default: 1)
                The number of overlapping sentences for chunks.
It is applicable only for a `sentence` chunking strategy.
It can be either `1` or `0`.
              - `separator_group` (string)
                Only applicable to the `recursive` strategy and required when using it.

Sets a predefined list of separators in the saved chunking settings based on the selected text type.
Values can be `markdown` or `plaintext`.

Using this parameter is an alternative to manually specifying a custom `separators` list.
              - `separators` (string[])
                Only applicable to the `recursive` strategy and required when using it.

A list of strings used as possible split points when chunking text.

Each string can be a plain string or a regular expression (regex) pattern.
The system tries each separator in order to split the text, starting from the first item in the list.

After splitting, it attempts to recombine smaller pieces into larger chunks that stay within
the `max_chunk_size` limit, to reduce the total number of chunks generated.
              - `strategy` (string · default: sentence)
                The chunking strategy: `sentence`, `word`, `none` or `recursive`.

 * If `strategy` is set to `recursive`, you must also specify:

- `max_chunk_size`
- either `separators` or`separator_group`

Learn more about different chunking strategies in the linked documentation.
        - `rule` (object)
          A retriever that replaces the functionality of a rule query.
          - `filter` (union oneOf)
            Query to filter the documents that can match.
            One of: [`Query[]`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`Query`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          - `min_score` (number)
            Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
          - `_name` (string)
            Retriever name.
          - `ruleset_ids` (union string | string[])
            The ruleset IDs containing the rules this retriever is evaluating against.
          - `match_criteria` (object)
            The match criteria that will determine if a rule in the provided rulesets should be applied.
          - `retriever` (object) — recursive
            The retriever whose results rules should be applied to.
            Same fields as `retriever` in `SearchRequestBody`
          - `rank_window_size` (number)
            This value determines the size of the individual result set.
        - `rescorer` (object)
          A retriever that re-scores only the results produced by its child retriever.
          - `filter` (union oneOf)
            Query to filter the documents that can match.
            One of: [`Query[]`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`Query`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          - `min_score` (number)
            Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
          - `_name` (string)
            Retriever name.
          - `retriever` (object) — recursive
            Inner retriever.
            Same fields as `retriever` in `SearchRequestBody`
          - `rescore` (union oneOf)
            Same options as `rescore` in `SearchRequestBody`
            `object` or `object[]`
        - `linear` (object)
          A retriever that supports the combination of different retrievers through a weighted linear combination.
          - `filter` (union oneOf)
            Query to filter the documents that can match.
            One of: [`Query[]`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`Query`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          - `min_score` (number)
            Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
          - `_name` (string)
            Retriever name.
          - `retrievers` (object[])
            Inner retrievers.
            - `retriever` (object) — recursive
              The nested retriever configuration.
              Same fields as `retriever` in `SearchRequestBody`
            - `weight` (number · default: 1)
              Weight multiplier for this retriever's contribution to the linear combination.
Must be non-negative.
            - `normalizer` (enum · default: none)
              Score normalizer to apply to this retriever's results before weighting.
Falls back to the top-level `normalizer` on the linear retriever if unset,
then to `none` (identity) if neither is set.
              Values: `none`, `minmax`, `l2_norm`
          - `rank_window_size` (number)
          - `query` (string)
          - `fields` (string[])
          - `normalizer` (enum)
            Values: `none`, `minmax`, `l2_norm`
        - `pinned` (object)
          A pinned retriever applies pinned documents to the underlying retriever.
This retriever will rewrite to a PinnedQueryBuilder.
          - `filter` (union oneOf)
            Query to filter the documents that can match.
            One of: [`Query[]`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`Query`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          - `min_score` (number)
            Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
          - `_name` (string)
            Retriever name.
          - `retriever` (object) — recursive
            Inner retriever.
            Same fields as `retriever` in `SearchRequestBody`
          - `ids` (string[])
          - `docs` (object[])
            - `index` (string)
            - `id` (string)
          - `rank_window_size` (number)
        - `diversify` (object)
          A retriever that diversifies the results from its child retriever.
          - `filter` (union oneOf)
            Query to filter the documents that can match.
            One of: [`Query[]`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer) or [`Query`](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
            See [Query](https://www.elastic.co/docs/api/doc/elasticsearch/types/_types-query_dsl-querycontainer)
          - `min_score` (number)
            Minimum _score for matching documents. Documents with a lower _score are not included in the top documents.
          - `_name` (string)
            Retriever name.
          - `type` (enum)
            The diversification strategy to apply.
            Values: `mmr`
          - `field` (string)
            The document field on which to diversify results on.
          - `retriever` (object) — recursive
            The nested retriever whose results will be diversified.
            Same fields as `retriever` in `SearchRequestBody`
          - `size` (number)
            The number of top documents to return after diversification.
          - `rank_window_size` (number)
            The number of top documents from the nested retriever to consider for diversification.
          - `query_vector` (union oneOf)
            The query vector used for diversification.
            One of: `number[]` or `string`
          - `query_vector_builder` (object)
            a dense vector query vector builder to use instead of a static query_vector
            Same fields as `query_vector_builder` in `knn`
          - `lambda` (number)
            Controls the trade-off between relevance and diversity for MMR. A value of 0.0 focuses solely on diversity, while a value of 1.0 focuses solely on relevance. Required for MMR
      - `script_fields` (map string to object)
        Retrieve a script evaluation (based on different fields) for each hit.
        Map values (object)
        - `script` (string)
        - `ignore_failure` (boolean)
      - `search_after` (union[])
        Used to retrieve the next page of hits using a set of sort values from the previous page.
      - `size` (number · default: 10)
        The number of hits to return, which must not be negative.
By default, you cannot page through more than 10,000 hits using the `from` and `size` parameters.
To page through more hits, use the `search_after` property.
      - `slice` (object)
        Split a scrolled search into multiple slices that can be consumed independently.
        - `field` (string)
        - `id` (string)
        - `max` (number)
      - `sort` (union oneOf)
        A comma-separated list of <field>:<direction> pairs.
        Same options as `sort` in `inner_hits`
      - `_source` (union oneOf)
        The source fields that are returned for matching documents.
These fields are returned in the `hits._source` property of the search response.
If the `stored_fields` property is specified, the `_source` property defaults to `false`.
Otherwise, it defaults to `true`.
        - **boolean**
        - **SourceFilter**
          - `exclude_vectors` (boolean)
            If `true`, vector fields are excluded from the returned source.

This option takes precedence over `includes`: any vector field will
remain excluded even if it matches an `includes` rule.
          - `excludes` (union oneOf)
            A list of fields to exclude from the returned source.
            One of: `string[]` or `string`
          - `includes` (union oneOf)
            A list of fields to include in the returned source.
            One of: `string[]` or `string`
      - `fields` (object[])
        An array of wildcard (`*`) field patterns.
The request returns values for field names matching these patterns in the `hits.fields` property of the response.
        - `field` (string)
          A wildcard pattern. The request returns values for field names matching this pattern.
        - `format` (string)
          The format in which the values are returned.
        - `include_unmapped` (boolean)
      - `suggest` (object)
        Defines a suggester that provides similar looking terms based on a provided text.
        - `text` (string)
          Global suggest text, to avoid repetition when the same text is used in several suggesters
      - `terminate_after` (number · default: 0)
        The maximum number of documents to collect for each shard.
If a query reaches this limit, Elasticsearch terminates the query early.
Elasticsearch collects documents before sorting.

IMPORTANT: Use with caution.
Elasticsearch applies this property to each shard handling the request.
When possible, let Elasticsearch perform early termination automatically.
Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers.

If set to `0` (default), the query does not terminate early.
      - `timeout` (string)
        The period of time to wait for a response from each shard.
If no response is received before the timeout expires, the request fails and returns an error.
Defaults to no timeout.
      - `track_scores` (boolean · default: false)
        If `true`, calculate and return document scores, even if the scores are not used for sorting.
      - `version` (boolean · default: false)
        If `true`, the request returns the document version as part of a hit.
      - `seq_no_primary_term` (boolean)
        If `true`, the request returns sequence number and primary term of the last modification of each hit.
      - `stored_fields` (union oneOf)
        A comma-separated list of stored fields to return as part of a hit.
If no fields are specified, no stored fields are included in the response.
If this field is specified, the `_source` property defaults to `false`.
You can pass `_source: true` to return both source fields and stored fields in the search response.
        One of: `string[]` or `string`
      - `pit` (object)
        Limit the search to a point in time (PIT).
If you provide a PIT, you cannot specify an `<index>` in the request path.
        - `id` (string)
        - `keep_alive` (union oneOf)
          Values: `-1`, `0`
      - `runtime_mappings` (object)
        One or more runtime fields in the search request.
These fields take precedence over mapped fields with the same name.
      - `stats` (string[])
        The stats groups to associate with the search.
Each group maintains a statistics aggregation for its associated searches.
You can retrieve these stats using the indices stats API.
- `set` (object)
  Adds a field with the specified value.
If the field already exists, its value will be replaced with the provided one.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `copy_from` (string)
    The origin field which will be copied to `field`, cannot set `value` simultaneously.
Supported data types are `boolean`, `number`, `array`, `object`, `string`, `date`, etc.
  - `field` (string)
    The field to insert, upsert, or update.
Supports template snippets.
  - `ignore_empty_value` (boolean · default: false)
    If `true` and `value` is a template snippet that evaluates to `null` or the empty string, the processor quietly exits without modifying the document.
  - `media_type` (string · default: "application/json")
    The media type for encoding `value`.
Applies only when value is a template snippet.
Must be one of `application/json`, `text/plain`, or `application/x-www-form-urlencoded`.
  - `override` (boolean · default: true)
    If `true` processor will update fields with pre-existing non-null-valued field.
When set to `false`, such fields will not be touched.
  - `value` (object)
    The value to be set for the field.
Supports template snippets.
May specify only one of `value` or `copy_from`.
- `set_security_user` (object)
  Sets user-related details (such as `username`, `roles`, `email`, `full_name`, `metadata`, `api_key`, `realm` and `authentication_type`) from the current authenticated user to the current document by pre-processing the ingest.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to store the user information into.
  - `properties` (string[])
    Controls what user related properties are added to the field.
- `sort` (object)
  Sorts the elements of an array ascending or descending.
Homogeneous arrays of numbers will be sorted numerically, while arrays of strings or heterogeneous arrays of strings + numbers will be sorted lexicographically.
Throws an error when the field is not an array.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to be sorted.
  - `order` (enum · default: asc)
    The sort order to use.
Accepts `"asc"` or `"desc"`.

Supported values include:
  - `asc`: Ascending (smallest to largest)
  - `desc`: Descending (largest to smallest)
    Values: `asc`, `desc`
  - `target_field` (string)
    The field to assign the sorted value to.
By default, the field is updated in-place.
- `split` (object)
  Splits a field into an array using a separator character.
Only works on string fields.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to split.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist, the processor quietly exits without modifying the document.
  - `preserve_trailing` (boolean · default: false)
    Preserves empty trailing fields, if any.
  - `separator` (string)
    A regex which matches the separator, for example, `,` or `\s+`.
  - `target_field` (string · default: field)
    The field to assign the split value to.
By default, the field is updated in-place.
- `terminate` (object)
  Terminates the current ingest pipeline, causing no further processors to be run.
This will normally be executed conditionally, using the `if` option.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
- `trim` (object)
  Trims whitespace from a field.
If the field is an array of strings, all members of the array will be trimmed.
This only works on leading and trailing whitespace.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The string-valued field to trim whitespace from.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist, the processor quietly exits without modifying the document.
  - `target_field` (string · default: field)
    The field to assign the trimmed value to.
By default, the field is updated in-place.
- `uppercase` (object)
  Converts a string to its uppercase equivalent.
If the field is an array of strings, all members of the array will be converted.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to make uppercase.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
  - `target_field` (string · default: field)
    The field to assign the converted value to.
By default, the field is updated in-place.
- `urldecode` (object)
  URL-decodes a string.
If the field is an array of strings, all members of the array will be decoded.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field to decode.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document.
  - `target_field` (string · default: field)
    The field to assign the converted value to.
By default, the field is updated in-place.
- `uri_parts` (object)
  Parses a Uniform Resource Identifier (URI) string and extracts its components as an object.
This URI object includes properties for the URI’s domain, path, fragment, port, query, scheme, user info, username, and password.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    Field containing the URI string.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist, the processor quietly exits without modifying the document.
  - `keep_original` (boolean · default: true)
    If `true`, the processor copies the unparsed URI to `<target_field>.original`.
  - `remove_if_successful` (boolean · default: false)
    If `true`, the processor removes the `field` after parsing the URI string.
If parsing fails, the processor does not remove the `field`.
  - `target_field` (string · default: url)
    Output field for the URI object.
- `user_agent` (object)
  The `user_agent` processor extracts details from the user agent string a browser sends with its web requests.
This processor adds this information by default under the `user_agent` field.
  - `description` (string)
    Description of the processor.
Useful for describing the purpose of the processor or its configuration.
  - `if` (string)
    Conditionally execute the processor.
  - `ignore_failure` (boolean)
    Ignore failures for the processor.
  - `on_failure` (Processor[]) — recursive
    Handle failures for the processor.
  - `tag` (string)
    Identifier for the processor.
Useful for debugging and metrics.
  - `field` (string)
    The field containing the user agent string.
  - `ignore_missing` (boolean · default: false)
    If `true` and `field` does not exist, the processor quietly exits without modifying the document.
  - `regex_file` (string)
    The name of the file in the `config/ingest-user-agent` directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the `regexes.yaml` from uap-core it ships with.
  - `target_field` (string · default: user_agent)
    The field that will be filled with the user agent details.
  - `properties` (enum[])
    Controls what properties are added to `target_field`.
    Values: `name`, `os`, `device`, `original`, `version`
    Default: `["name","os","device","original","version"]`
  - `extract_device_type` (boolean · default: false)
    Extracts device type from the user agent string on a best-effort basis.