All methods and paths for this operation:
Run ingest pipelines against a set of provided documents, optionally with substitute pipeline definitions, to simulate ingesting data into an index.
This API is meant to be used for troubleshooting or pipeline development, as it does not actually index any data into Elasticsearch.
The API runs the default and final pipeline for that index against a set of documents provided in the body of the request. If a pipeline contains a reroute processor, it follows that reroute processor to the new index, running that index's pipelines as well the same way that a non-simulated ingest would. No data is indexed into Elasticsearch. Instead, the transformed document is returned, along with the list of pipelines that have been run and the name of the index where the document would have been indexed if this were not a simulation. The transformed document is validated against the mappings that would apply to this index, and any validation error is reported in the result.
This API differs from the simulate pipeline API in that you specify a single pipeline for that API, and it runs only that one pipeline. The simulate pipeline API is more useful for developing a single pipeline, while the simulate ingest API is more useful for troubleshooting the interaction of the various pipelines that get applied when ingesting into an index.
By default, the pipeline definitions that are currently in the system are used. However, you can supply substitute pipeline definitions in the body of the request. These will be used in place of the pipeline definitions that are already in the system. This can be used to replace existing pipeline definitions or to create new ones. The pipeline substitutions are used only within this request.
indexThe index to simulate ingesting into. This value can be overridden by specifying an index on each document. If you specify this parameter in the request path, it is used for any documents that do not explicitly specify an index argument.
The pipeline to use as the default pipeline. This value can be used to override the default pipeline of the index.
Sample documents to test in the pipeline.
A map of component template names to substitute component template definition objects.
Values are strict, runtime, true, or false.
For type composite
For type lookup
A custom format for date type runtime fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Values are boolean, composite, date, double, geo_point, geo_shape, ip, keyword, long, or lookup.
Values are true or false.
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
Value used to route indexing operations to a specific shard.
If specified, this overwrites the routing value for indexing operations.
If true, the index is the write index for the alias.
Default value is false.
Value used to route indexing and search operations to a specific shard.
Value used to route search operations to a specific shard.
If specified, this overwrites the routing value for search operations.
If true, the alias is hidden.
All indices for the alias must have the same is_hidden value.
Default value is false.
Data stream lifecycle with rollover can be used to display the configuration including the default rollover conditions, if asked.
A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and
d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
If defined, it turns data stream lifecycle on/off (true/false) for this data stream. A data stream lifecycle
that's disabled (enabled: false) will have no effect on the data stream.
Default value is true.
A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and
d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
A map of index template names to substitute index template definition objects.
An ordered list of component template names. Component templates are merged in the order specified, meaning that the last component template specified has the highest precedence.
Aliases to add.
If the index template includes a data_stream object, these are data stream aliases.
Otherwise, these are index aliases.
Data stream aliases ignore the index_routing, routing, and search_routing options.
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
If true, the alias is hidden.
All indices for the alias must have the same is_hidden value.
Default value is false.
If true, the index is the write index for the alias.
Default value is false.
Values are strict, runtime, true, or false.
For type composite
For type lookup
A custom format for date type runtime fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Values are boolean, composite, date, double, geo_point, geo_shape, ip, keyword, long, or lookup.
Values are true or false.
Data stream lifecycle with rollover can be used to display the configuration including the default rollover conditions, if asked.
A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and
d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
If defined, it turns data stream lifecycle on/off (true/false) for this data stream. A data stream lifecycle
that's disabled (enabled: false) will have no effect on the data stream.
Default value is true.
A duration. Units can be nanos, micros, ms (milliseconds), s (seconds), m (minutes), h (hours) and
d (days). Also accepts "0" without a unit and "-1" to indicate an unspecified value.
Priority to determine index template precedence when a new data stream or index is created. The index template with the highest priority is chosen. If no priority is specified the template is treated as though it is of priority 0 (lowest priority). This number is not automatically generated by Elasticsearch.
Marks this index template as deprecated. When creating or updating a non-deprecated index template that uses deprecated components, Elasticsearch will emit a deprecation warning.
Values are strict, runtime, true, or false.
For type composite
For type lookup
A custom format for date type runtime fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Defines the aggregations that are run as part of the search request.
If true, the request returns detailed information about score computation as part of a hit.
Default value is false.
Configuration of search extensions defined by Elasticsearch plugins.
The starting document offset, which must be non-negative.
By default, you cannot page through more than 10,000 hits using the from and size parameters.
To page through more hits, use the search_after parameter.
Default value is 0.
Number of hits matching the query to count accurately. If true, the exact number of hits is returned at the cost of some performance. If false, the response does not include the total number of hits matching the query. Defaults to 10,000 hits.
Boost the _score of documents from specified indices.
The boost value is the factor by which scores are multiplied.
A boost value greater than 1.0 increases the score.
A boost value between 0 and 1.0 decreases the score.
An array of wildcard (*) field patterns.
The request returns doc values for field names matching these patterns in the hits.fields property of the response.
The minimum _score for matching documents.
Documents with a lower _score are not included in search results or results collected by aggregations.
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
Set to true to return detailed timing information about the execution of individual components in a search request.
NOTE: This is a debugging tool and adds significant overhead to search execution.
Default value is false.
An Elasticsearch Query DSL (Domain Specific Language) object that defines a query.
Retrieve a script evaluation (based on different fields) for each hit.
A field value.
The number of hits to return, which must not be negative.
By default, you cannot page through more than 10,000 hits using the from and size parameters.
To page through more hits, use the search_after property.
Default value is 10.
An array of wildcard (*) field patterns.
The request returns values for field names matching these patterns in the hits.fields property of the response.
The maximum number of documents to collect for each shard. If a query reaches this limit, Elasticsearch terminates the query early. Elasticsearch collects documents before sorting.
IMPORTANT: Use with caution. Elasticsearch applies this property to each shard handling the request. When possible, let Elasticsearch perform early termination automatically. Avoid specifying this property for requests that target data streams with backing indices across multiple data tiers.
If set to 0 (default), the query does not terminate early.
Default value is 0.
The period of time to wait for a response from each shard. If no response is received before the timeout expires, the request fails and returns an error. Defaults to no timeout.
If true, calculate and return document scores, even if the scores are not used for sorting.
Default value is false.
If true, the request returns the document version as part of a hit.
Default value is false.
If true, the request returns sequence number and primary term of the last modification of each hit.
The stats groups to associate with the search. Each group maintains a statistics aggregation for its associated searches. You can retrieve these stats using the indices stats API.
Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
Values are boolean, composite, date, double, geo_point, geo_shape, ip, keyword, long, or lookup.
Values are true or false.
Pipelines to test.
If you don’t specify the pipeline request path parameter, this parameter is required.
If you specify both this and the request path parameter, the API only uses the request path parameter.
Description of the ingest pipeline.
Processors to run immediately after a processor failure.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If false, the processor does not append values already present in the field.
Default value is true.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
The number of chars being used for extraction to prevent huge fields.
Use -1 for no limit.
Default value is 100000.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Array of properties to select to be stored.
Can be content, title, name, author, keywords, date, content_type, content_length, language.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true, the binary field will be removed from the document
Default value is false.
Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for geo_shape, unit-less for shape).
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Values are geo_shape or shape.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
Default value is 0.
If true and any required fields are missing, the processor quietly exits without modifying the document.
Default value is true.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Values are integer, long, double, float, boolean, ip, string, or auto.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Value used to fill empty fields.
Empty fields are skipped if this is not provided.
An empty field is one with no value (2 consecutive separators) or empty quotes ("").
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Quote used in CSV, has to be single character string.
Default value is ".
Separator used in CSV, has to be single character string.
Default value is ,.
Trim whitespaces in unquoted fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
Default value is ENGLISH.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
The timezone to use when parsing the date. Supports template snippets.
Default value is UTC.
The format to use when writing the date to target_field. Must be a valid java time pattern.
Default value is yyyy-MM-dd'T'HH:mm:ss.SSSXXX.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
How to round the date when formatting the date into the index name. Valid values are:
y (year), M (month), w (week), d (day), h (hour), m (minute) and s (second).
Supports template snippets.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
Default value is yyyy-MM-dd.
A prefix of the index name to be prepended before the printed date. Supports template snippets.
The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
Default value is ENGLISH.
The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
Default value is UTC.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The character(s) that separate the appended fields.
Default value is "".
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
The pattern to apply to the field.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Controls the behavior when there is already an existing nested object that conflicts with the expanded field.
When false, the processor will merge conflicts by combining the old and the new values into an array.
When true, the value from the expanded field will overwrite the existing value.
Default value is false.
The field that contains the field to expand.
Only required if the field to expand is part another object field, because the field option can only understand leaf fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
The maximum number of matched documents to include under the configured target field.
The target_field will be turned into a json array if max_matches is higher than 1, otherwise target_field will become a json object.
In order to avoid documents getting too large, the maximum allowed value is 128.
Default value is 1.
If processor will update fields with pre-existing non-null-valued field.
When set to false, such fields will not be touched.
Default value is true.
The name of the enrich policy to use.
Values are intersects, disjoint, within, or contains.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The error message thrown by the processor. Supports template snippets.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Salt value for the hash function.
Values are MD5, SHA-1, SHA-256, SHA-512, or MurmurHash3.
If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true, the processor silently exits without changing the document if the field is null or missing.
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
Default value is GeoLite2-City.mmdb.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true, only the first found IP location data will be returned, even if the field contains an array.
Default value is true.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Controls what properties are added to the target_field based on the IP location lookup.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created.
Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The field to interpret as a geo-tile.=
The field format is determined by the tile_type.
Values are geotile, geohex, or geohash.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Values are geojson or wkt.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
Default value is GeoLite2-City.mmdb.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true, only the first found geoip data will be returned, even if the field contains an array.
Default value is true.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Controls what properties are added to the target_field based on the geoip lookup.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created.
Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
Default value is disabled.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
When true, _ingest._grok_match_index will be inserted into your matched document’s metadata with the index into the pattern found in patterns that matched.
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
The pattern to be replaced.
The string to replace the matching patterns with.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document,
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
If true and any of the input fields defined in input_ouput are missing then those missing fields are quietly ignored, otherwise a missing field causes a failure. Only applies when using input_output configurations to explicitly list the input fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
The separator character.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Flag that forces the parsed JSON to be added at the top level of the document.
target_field must not be set when this option is chosen.
Default value is false.
Values are replace or merge.
When set to true, the JSON parser will not fail if the JSON contains duplicate keys.
Instead, the last encountered value for any duplicate key wins.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
List of keys to exclude from document.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Regex pattern to use for splitting key-value pairs.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
List of keys to filter and insert into document. Defaults to including all keys.
Prefix to be added to extracted keys.
Default value is null.
If true. strip brackets (), <>, [] as well as quotes ' and " from extracted values.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
String of characters to trim from extracted keys.
String of characters to trim from extracted values.
Regex pattern to use for splitting the key from the value within a key-value pair.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and any required fields are missing, the processor quietly exits without modifying the document.
Default value is true.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Whether to ignore missing pipelines instead of failing.
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
A list of grok expressions to match and redact named captures with
Start a redacted section with this token
Default value is <.
End a redacted section with this token
Default value is >.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
If true and the current license does not support running redact processors, then the processor quietly exits without modifying the document
Default value is false.
If true then ingest metadata _ingest._redact._is_redacted is set to true if the document has been redacted
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and any required fields are missing, the processor quietly exits without modifying the document.
Default value is true.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
A static value for the target. Can’t be set when the dataset or namespace option is set.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Object containing parameters for the script.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and value is a template snippet that evaluates to null or the empty string, the processor quietly exits without modifying the document.
Default value is false.
The media type for encoding value.
Applies only when value is a template snippet.
Must be one of application/json, text/plain, or application/x-www-form-urlencoded.
If true processor will update fields with pre-existing non-null-valued field.
When set to false, such fields will not be touched.
Default value is true.
The value to be set for the field.
Supports template snippets.
May specify only one of value or copy_from.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Controls what user related properties are added to the field.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Values are asc or desc.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Preserves empty trailing fields, if any.
Default value is false.
A regex which matches the separator, for example, , or \s+.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
If true, the processor copies the unparsed URI to <target_field>.original.
Default value is true.
If true, the processor removes the field after parsing the URI string.
If parsing fails, the processor does not remove the field.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
The name of the file in the config/ingest-user-agent directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the regexes.yaml from uap-core it ships with.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Controls what properties are added to target_field.
Values are name, os, device, original, or version. Default value is ["name", "major", "minor", "patch", "build", "os", "os_name", "os_major", "os_minor", "device"].
Extracts device type from the user agent string on a best-effort basis.
Default value is false.
Processors used to perform transformations on documents before indexing. Processors run sequentially in the order specified.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If false, the processor does not append values already present in the field.
Default value is true.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
The number of chars being used for extraction to prevent huge fields.
Use -1 for no limit.
Default value is 100000.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Array of properties to select to be stored.
Can be content, title, name, author, keywords, date, content_type, content_length, language.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true, the binary field will be removed from the document
Default value is false.
Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for geo_shape, unit-less for shape).
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Values are geo_shape or shape.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
Default value is 0.
If true and any required fields are missing, the processor quietly exits without modifying the document.
Default value is true.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Values are integer, long, double, float, boolean, ip, string, or auto.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Value used to fill empty fields.
Empty fields are skipped if this is not provided.
An empty field is one with no value (2 consecutive separators) or empty quotes ("").
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Quote used in CSV, has to be single character string.
Default value is ".
Separator used in CSV, has to be single character string.
Default value is ,.
Trim whitespaces in unquoted fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
Default value is ENGLISH.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
The timezone to use when parsing the date. Supports template snippets.
Default value is UTC.
The format to use when writing the date to target_field. Must be a valid java time pattern.
Default value is yyyy-MM-dd'T'HH:mm:ss.SSSXXX.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
How to round the date when formatting the date into the index name. Valid values are:
y (year), M (month), w (week), d (day), h (hour), m (minute) and s (second).
Supports template snippets.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
Default value is yyyy-MM-dd.
A prefix of the index name to be prepended before the printed date. Supports template snippets.
The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
Default value is ENGLISH.
The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
Default value is UTC.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The character(s) that separate the appended fields.
Default value is "".
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
The pattern to apply to the field.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Controls the behavior when there is already an existing nested object that conflicts with the expanded field.
When false, the processor will merge conflicts by combining the old and the new values into an array.
When true, the value from the expanded field will overwrite the existing value.
Default value is false.
The field that contains the field to expand.
Only required if the field to expand is part another object field, because the field option can only understand leaf fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
The maximum number of matched documents to include under the configured target field.
The target_field will be turned into a json array if max_matches is higher than 1, otherwise target_field will become a json object.
In order to avoid documents getting too large, the maximum allowed value is 128.
Default value is 1.
If processor will update fields with pre-existing non-null-valued field.
When set to false, such fields will not be touched.
Default value is true.
The name of the enrich policy to use.
Values are intersects, disjoint, within, or contains.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The error message thrown by the processor. Supports template snippets.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Salt value for the hash function.
Values are MD5, SHA-1, SHA-256, SHA-512, or MurmurHash3.
If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true, the processor silently exits without changing the document if the field is null or missing.
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
Default value is GeoLite2-City.mmdb.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true, only the first found IP location data will be returned, even if the field contains an array.
Default value is true.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Controls what properties are added to the target_field based on the IP location lookup.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created.
Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The field to interpret as a geo-tile.=
The field format is determined by the tile_type.
Values are geotile, geohex, or geohash.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Values are geojson or wkt.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
Default value is GeoLite2-City.mmdb.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true, only the first found geoip data will be returned, even if the field contains an array.
Default value is true.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Controls what properties are added to the target_field based on the geoip lookup.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created.
Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
Default value is disabled.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
When true, _ingest._grok_match_index will be inserted into your matched document’s metadata with the index into the pattern found in patterns that matched.
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
The pattern to be replaced.
The string to replace the matching patterns with.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document,
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
If true and any of the input fields defined in input_ouput are missing then those missing fields are quietly ignored, otherwise a missing field causes a failure. Only applies when using input_output configurations to explicitly list the input fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
The separator character.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Flag that forces the parsed JSON to be added at the top level of the document.
target_field must not be set when this option is chosen.
Default value is false.
Values are replace or merge.
When set to true, the JSON parser will not fail if the JSON contains duplicate keys.
Instead, the last encountered value for any duplicate key wins.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
List of keys to exclude from document.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Regex pattern to use for splitting key-value pairs.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
List of keys to filter and insert into document. Defaults to including all keys.
Prefix to be added to extracted keys.
Default value is null.
If true. strip brackets (), <>, [] as well as quotes ' and " from extracted values.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
String of characters to trim from extracted keys.
String of characters to trim from extracted values.
Regex pattern to use for splitting the key from the value within a key-value pair.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and any required fields are missing, the processor quietly exits without modifying the document.
Default value is true.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Whether to ignore missing pipelines instead of failing.
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
A list of grok expressions to match and redact named captures with
Start a redacted section with this token
Default value is <.
End a redacted section with this token
Default value is >.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
If true and the current license does not support running redact processors, then the processor quietly exits without modifying the document
Default value is false.
If true then ingest metadata _ingest._redact._is_redacted is set to true if the document has been redacted
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and any required fields are missing, the processor quietly exits without modifying the document.
Default value is true.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
A static value for the target. Can’t be set when the dataset or namespace option is set.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Object containing parameters for the script.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and value is a template snippet that evaluates to null or the empty string, the processor quietly exits without modifying the document.
Default value is false.
The media type for encoding value.
Applies only when value is a template snippet.
Must be one of application/json, text/plain, or application/x-www-form-urlencoded.
If true processor will update fields with pre-existing non-null-valued field.
When set to false, such fields will not be touched.
Default value is true.
The value to be set for the field.
Supports template snippets.
May specify only one of value or copy_from.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Controls what user related properties are added to the field.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Values are asc or desc.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Preserves empty trailing fields, if any.
Default value is false.
A regex which matches the separator, for example, , or \s+.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist or is null, the processor quietly exits without modifying the document.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
If true, the processor copies the unparsed URI to <target_field>.original.
Default value is true.
If true, the processor removes the field after parsing the URI string.
If parsing fails, the processor does not remove the field.
Default value is false.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Description of the processor. Useful for describing the purpose of the processor or its configuration.
Ignore failures for the processor.
Handle failures for the processor.
Identifier for the processor. Useful for debugging and metrics.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
If true and field does not exist, the processor quietly exits without modifying the document.
Default value is false.
The name of the file in the config/ingest-user-agent directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the regexes.yaml from uap-core it ships with.
Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
Controls what properties are added to target_field.
Values are name, os, device, original, or version. Default value is ["name", "major", "minor", "patch", "build", "os", "os_name", "os_major", "os_minor", "device"].
Extracts device type from the user agent string on a best-effort basis.
Default value is false.
Marks this ingest pipeline as deprecated. When a deprecated ingest pipeline is referenced as the default or final pipeline when creating or updating a non-deprecated index template, Elasticsearch will emit a deprecation warning.
Default value is false.
The results of ingest simulation on a single document. The _source of the document contains the results after running all pipelines listed in executed_pipelines on the document. The list of executed pipelines is derived from the pipelines that would be executed if this document had been ingested into _index.
JSON body for the document.
Some APIs will return values such as numbers also as a string (notably epoch timestamps). This behavior is used to capture this behavior while keeping the semantics of the field type.
Depending on the target language, code generators can keep the union or remove it and leniently parse strings to the target type.
A list of the names of the pipelines executed on this document.
A list of the fields that would be ignored at the indexing step. For example, a field whose value is larger than the allowed limit would make it through all of the pipelines, but would not be indexed into Elasticsearch.
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
The type of error
The server stack trace. Present only if the error_trace=true parameter was sent with the request.
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
Cause and details about a request failure. This class defines the properties common to all error types. Additional details are also provided, that depend on the error type.
POST /_ingest/_simulate
{
"docs": [
{
"_id": 123,
"_index": "my-index",
"_source": {
"foo": "bar"
}
},
{
"_id": 456,
"_index": "my-index",
"_source": {
"foo": "rab"
}
}
]
}resp = client.simulate.ingest(
docs=[
{
"_id": 123,
"_index": "my-index",
"_source": {
"foo": "bar"
}
},
{
"_id": 456,
"_index": "my-index",
"_source": {
"foo": "rab"
}
}
],
)const response = await client.simulate.ingest({
docs: [
{
_id: 123,
_index: "my-index",
_source: {
foo: "bar",
},
},
{
_id: 456,
_index: "my-index",
_source: {
foo: "rab",
},
},
],
});response = client.simulate.ingest(
body: {
"docs": [
{
"_id": 123,
"_index": "my-index",
"_source": {
"foo": "bar"
}
},
{
"_id": 456,
"_index": "my-index",
"_source": {
"foo": "rab"
}
}
]
}
)$resp = $client->simulate()->ingest([
"body" => [
"docs" => array(
[
"_id" => 123,
"_index" => "my-index",
"_source" => [
"foo" => "bar",
],
],
[
"_id" => 456,
"_index" => "my-index",
"_source" => [
"foo" => "rab",
],
],
),
],
]);curl -X POST -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d '{"docs":[{"_id":123,"_index":"my-index","_source":{"foo":"bar"}},{"_id":456,"_index":"my-index","_source":{"foo":"rab"}}]}' "$ELASTICSEARCH_URL/_ingest/_simulate"client.simulate().ingest(i -> i
.docs(List.of(Document.of(d -> d
.id("123")
.index("my-index")
.source(JsonData.fromJson("{\"foo\":\"bar\"}"))),Document.of(d -> d
.id("456")
.index("my-index")
.source(JsonData.fromJson("{\"foo\":\"rab\"}")))))
);
{
"docs": [
{
"_id": 123,
"_index": "my-index",
"_source": {
"foo": "bar"
}
},
{
"_id": 456,
"_index": "my-index",
"_source": {
"foo": "rab"
}
}
]
}{
"docs": [
{
"_index": "my-index",
"_id": 123,
"_source": {
"foo": "bar"
}
},
{
"_index": "my-index",
"_id": 456,
"_source": {
"foo": "rab"
}
}
],
"pipeline_substitutions": {
"my-pipeline": {
"processors": [
{
"uppercase": {
"field": "foo"
}
}
]
}
}
}{
"docs": [
{
"_index": "my-index",
"_id": "123",
"_source": {
"foo": "foo"
}
},
{
"_index": "my-index",
"_id": "456",
"_source": {
"bar": "rab"
}
}
],
"component_template_substitutions": {
"my-mappings_template": {
"template": {
"mappings": {
"dynamic": "strict",
"properties": {
"foo": {
"type": "keyword"
},
"bar": {
"type": "keyword"
}
}
}
}
}
}
}{
"docs": [
{
"_id": "id",
"_index": "my-index",
"_source": {
"foo": "bar"
}
},
{
"_id": "id",
"_index": "my-index",
"_source": {
"foo": "rab"
}
}
],
"pipeline_substitutions": {
"my-pipeline": {
"processors": [
{
"set": {
"field": "field3",
"value": "value3"
}
}
]
}
},
"component_template_substitutions": {
"my-component-template": {
"template": {
"mappings": {
"dynamic": true,
"properties": {
"field3": {
"type": "keyword"
}
}
},
"settings": {
"index": {
"default_pipeline": "my-pipeline"
}
}
}
}
},
"index_template_substitutions": {
"my-index-template": {
"index_patterns": [
"my-index-*"
],
"composed_of": [
"component_template_1",
"component_template_2"
]
}
},
"mapping_addition": {
"dynamic": "strict",
"properties": {
"foo": {
"type": "keyword"
}
}
}
}{
"docs": [
{
"doc": null,
"_id": 123,
"_index": "my-index",
"_version": -3,
"_source": {
"field1": "value1",
"field2": "value2",
"foo": "bar"
},
"executed_pipelines": [
"my-pipeline",
"my-final-pipeline"
]
},
{
"doc": null,
"_id": 456,
"_index": "my-index",
"_version": "-3,",
"_source": {
"field1": "value1",
"field2": "value2",
"foo": "rab"
},
"executed_pipelines": [
"my-pipeline",
"my-final-pipeline"
]
}
]
}{
"docs": [
{
"doc": null,
"_id": 123,
"_index": "my-index",
"_version": -3,
"_source": {
"field2": "value2",
"foo": "BAR"
},
"executed_pipelines": [
"my-pipeline",
"my-final-pipeline"
]
},
{
"doc": null,
"_id": 456,
"_index": "my-index",
"_version": -3,
"_source": {
"field2": "value2",
"foo": "RAB"
},
"executed_pipelines": [
"my-pipeline",
"my-final-pipeline"
]
}
]
}{
"docs": [
{
"doc": {
"_id": "123",
"_index": "my-index",
"_version": -3,
"_source": {
"foo": "foo"
},
"executed_pipelines": []
}
},
{
"doc": {
"_id": "456",
"_index": "my-index",
"_version": -3,
"_source": {
"bar": "rab"
},
"executed_pipelines": []
}
}
]
}