Detect mime typeedit

The detect_mime_type processor attempts to detect a mime type for a field that contains a given stream of bytes.

Exampleedit

In this example, http.request.body.content is used as the source, and http.request.mime_type is set to the detected mime type.

  - detect_mime_type:
      field: http.request.body.content
      target: http.request.mime_type

Configuration settingsedit

Elastic Agent processors execute before ingest pipelines, which means that your processor configurations cannot refer to fields that are created by ingest pipelines or Logstash. For more limitations, refer to What are some limitations of using processors?

Name Required Default Description

field

Yes

Field used as the data source.

target

Yes

Field to populate with the detected type. You can use the @metadata. prefix to set the value in the event metadata instead of fields.

See Conditions for a list of supported conditions.