You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/reference/ingest/ingest-node.asciidoc
+33-2
Original file line number
Diff line number
Diff line change
@@ -778,6 +778,7 @@ Accepts a single value or an array of values.
778
778
| Name | Required | Default | Description
779
779
| `field` | yes | - | The field to be appended to. Supports <<accessing-template-fields,template snippets>>.
780
780
| `value` | yes | - | The value to be appended. Supports <<accessing-template-fields,template snippets>>.
781
+
include::ingest-node-common-processor.asciidoc[]
781
782
|======
782
783
783
784
[source,js]
@@ -806,6 +807,7 @@ the field is not a supported format or resultant value exceeds 2^63.
806
807
| `field` | yes | - | The field to convert
807
808
| `target_field` | no | `field` | The field to assign the converted value to, by default `field` is updated in-place
808
809
| `ignore_missing` | no | `false` | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
810
+
include::ingest-node-common-processor.asciidoc[]
809
811
|======
810
812
811
813
[source,js]
@@ -844,6 +846,7 @@ still be updated with the unconverted field value.
844
846
| `target_field` | no | `field` | The field to assign the converted value to, by default `field` is updated in-place
845
847
| `type` | yes | - | The type to convert the existing value to
846
848
| `ignore_missing` | no | `false` | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
849
+
include::ingest-node-common-processor.asciidoc[]
847
850
|======
848
851
849
852
[source,js]
@@ -876,6 +879,7 @@ in the same order they were defined as part of the processor definition.
876
879
| `formats` | yes | - | An array of the expected date formats. Can be a Joda pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
877
880
| `timezone` | no | UTC | The timezone to use when parsing the date. Supports <<accessing-template-fields,template snippets>>.
878
881
| `locale` | no | ENGLISH | The locale to use when parsing the date, relevant when parsing month names or week days. Supports <<accessing-template-fields,template snippets>>.
882
+
include::ingest-node-common-processor.asciidoc[]
879
883
|======
880
884
881
885
Here is an example that adds the parsed date to the `timestamp` field based on the `initial_date` field:
@@ -1065,6 +1069,7 @@ understands this to mean `2016-04-01` as is explained in the <<date-math-index-n
1065
1069
| `timezone` | no | UTC | The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
1066
1070
| `locale` | no | ENGLISH | The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
1067
1071
| `index_name_format` | no | yyyy-MM-dd | The format to be used when printing the parsed date into the index name. An valid Joda pattern is expected here. Supports <<accessing-template-fields,template snippets>>.
1072
+
include::ingest-node-common-processor.asciidoc[]
1068
1073
|======
1069
1074
1070
1075
[[dissect-processor]]
@@ -1134,7 +1139,7 @@ See <<dissect-key-modifiers, below>> for more information.
1134
1139
| `pattern` | yes | - | The pattern to apply to the field
1135
1140
| `append_separator`| no | "" (empty string) | The character(s) that separate the appended fields.
1136
1141
| `ignore_missing` | no | false | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
1137
-
| `
1142
+
include::ingest-node-common-processor.asciidoc[]
1138
1143
|======
1139
1144
1140
1145
[source,js]
@@ -1162,7 +1167,6 @@ modifiers.
1162
1167
| `+` with `/n` | Append with order | left and right | `%{+keyname/2} %{+keyname/1}` | Appends two or more fields together in the order specified | <<dissect-modifier-append-key-with-order,link>>
1163
1168
| `?` | Named skip key | left | `%{?ignoreme}` | Skips the matched value in the output. Same behavior as `%{}`| <<dissect-modifier-named-skip-key,link>>
1164
1169
| `*` and `&` | Reference keys | left | `%{*r1} %{&r1}` | Sets the output key as value of `*` and output value of `&` | <<dissect-modifier-reference-keys,link>>
1165
-
| `
1166
1170
|======
1167
1171
1168
1172
[[dissect-modifier-skip-right-padding]]
@@ -1265,6 +1269,14 @@ Reference key modifier example
1265
1269
Drops the document without raising any errors. This is useful to prevent the document from
@@ -1289,6 +1301,7 @@ Otherwise these <<accessing-data-in-pipelines,fields>> can't be accessed by any
1289
1301
| Name | Required | Default | Description
1290
1302
| `field` | yes | - | The field to expand into an object field
1291
1303
| `path` | no | - | The field that contains the field to expand. Only required if the field to expand is part another object field, because the `field` option can only understand leaf fields.
1304
+
include::ingest-node-common-processor.asciidoc[]
1292
1305
|======
1293
1306
1294
1307
[source,js]
@@ -1406,6 +1419,7 @@ to the requester.
1406
1419
|======
1407
1420
| Name | Required | Default | Description
1408
1421
| `message` | yes | - | The error message thrown by the processor. Supports <<accessing-template-fields,template snippets>>.
1422
+
include::ingest-node-common-processor.asciidoc[]
1409
1423
|======
1410
1424
1411
1425
[source,js]
@@ -1452,6 +1466,7 @@ then it aborts the execution and leaves the array unmodified.
1452
1466
| `field` | yes | - | The array field
1453
1467
| `processor` | yes | - | The processor to execute against each field
1454
1468
| `ignore_missing` | no | false | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
1469
+
include::ingest-node-common-processor.asciidoc[]
1455
1470
|======
1456
1471
1457
1472
Assume the following document:
@@ -1645,6 +1660,7 @@ Grok expression.
1645
1660
| `pattern_definitions` | no | - | A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
1646
1661
| `trace_match` | no | false | when true, `_ingest._grok_match_index` will be inserted into your matched document's metadata with the index into the pattern found in `patterns` that matched.
1647
1662
| `ignore_missing` | no | false | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
1663
+
include::ingest-node-common-processor.asciidoc[]
1648
1664
|======
1649
1665
1650
1666
Here is an example of using the provided patterns to extract out and name structured fields from a string field in
@@ -1919,6 +1935,7 @@ If the field is not a string, the processor will throw an exception.
1919
1935
| `replacement` | yes | - | The string to replace the matching patterns with
1920
1936
| `target_field` | no | `field` | The field to assign the converted value to, by default `field` is updated in-place
1921
1937
| `ignore_missing` | no | `false` | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
1938
+
include::ingest-node-common-processor.asciidoc[]
1922
1939
|======
1923
1940
1924
1941
[source,js]
@@ -1946,6 +1963,7 @@ Throws an error when the field is not an array.
1946
1963
| `field` | yes | - | The field to be separated
1947
1964
| `separator` | yes | - | The separator character
1948
1965
| `target_field` | no | `field` | The field to assign the joined value to, by default `field` is updated in-place
1966
+
include::ingest-node-common-processor.asciidoc[]
1949
1967
|======
1950
1968
1951
1969
[source,js]
@@ -1971,6 +1989,7 @@ Converts a JSON string into a structured JSON object.
1971
1989
| `field` | yes | - | The field to be parsed
1972
1990
| `target_field` | no | `field` | The field to insert the converted structured object into
1973
1991
| `add_to_root` | no | false | Flag that forces the serialized json to be injected into the top level of the document. `target_field` must not be set when this option is chosen.
1992
+
include::ingest-node-common-processor.asciidoc[]
1974
1993
|======
1975
1994
1976
1995
All JSON-supported types will be parsed (null, boolean, number, array, object, string).
@@ -2082,6 +2101,7 @@ For example, if you have a log message which contains `ip=1.2.3.4 error=REFUSED`
2082
2101
| `trim_key` | no | `null` | String of characters to trim from extracted keys
2083
2102
| `trim_value` | no | `null` | String of characters to trim from extracted values
2084
2103
| `strip_brackets` | no | `false` | If `true` strip brackets `()`, `<>`, `[]` as well as quotes `'` and `"` from extracted values
2104
+
include::ingest-node-common-processor.asciidoc[]
2085
2105
|======
2086
2106
2087
2107
@@ -2097,6 +2117,7 @@ Converts a string to its lowercase equivalent.
2097
2117
| `field` | yes | - | The field to make lowercase
2098
2118
| `target_field` | no | `field` | The field to assign the converted value to, by default `field` is updated in-place
2099
2119
| `ignore_missing` | no | `false` | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
2120
+
include::ingest-node-common-processor.asciidoc[]
2100
2121
|======
2101
2122
2102
2123
[source,js]
@@ -2119,6 +2140,7 @@ Executes another pipeline.
2119
2140
|======
2120
2141
| Name | Required | Default | Description
2121
2142
| `name` | yes | - | The name of the pipeline to execute
2143
+
include::ingest-node-common-processor.asciidoc[]
2122
2144
|======
2123
2145
2124
2146
[source,js]
@@ -2234,6 +2256,7 @@ Removes existing fields. If one field doesn't exist, an exception will be thrown
2234
2256
| Name | Required | Default | Description
2235
2257
| `field` | yes | - | Fields to be removed. Supports <<accessing-template-fields,template snippets>>.
2236
2258
| `ignore_missing` | no | `false` | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
2259
+
include::ingest-node-common-processor.asciidoc[]
2237
2260
|======
2238
2261
2239
2262
Here is an example to remove a single field:
@@ -2272,6 +2295,7 @@ Renames an existing field. If the field doesn't exist or the new name is already
2272
2295
| `field` | yes | - | The field to be renamed. Supports <<accessing-template-fields,template snippets>>.
2273
2296
| `target_field` | yes | - | The new name of the field. Supports <<accessing-template-fields,template snippets>>.
2274
2297
| `ignore_missing` | no | `false` | If `true` and `field` does not exist, the processor quietly exits without modifying the document
2298
+
include::ingest-node-common-processor.asciidoc[]
2275
2299
|======
2276
2300
2277
2301
[source,js]
@@ -2305,6 +2329,7 @@ caching see <<modules-scripting-using-caching, Script Caching>>.
2305
2329
| `id` | no | - | The stored script id to refer to
2306
2330
| `source` | no | - | An inline script to be executed
2307
2331
| `params` | no | - | Script Parameters
2332
+
include::ingest-node-common-processor.asciidoc[]
2308
2333
|======
2309
2334
2310
2335
One of `id` or `source` options must be provided in order to properly reference a script to execute.
@@ -2401,6 +2426,7 @@ its value will be replaced with the provided one.
2401
2426
| `field` | yes | - | The field to insert, upsert, or update. Supports <<accessing-template-fields,template snippets>>.
2402
2427
| `value` | yes | - | The value to be set for the field. Supports <<accessing-template-fields,template snippets>>.
2403
2428
| `override` | no | true | If processor will update fields with pre-existing non-null-valued field. When set to `false`, such fields will not be touched.
2429
+
include::ingest-node-common-processor.asciidoc[]
2404
2430
|======
2405
2431
2406
2432
[source,js]
@@ -2427,6 +2453,7 @@ Splits a field into an array using a separator character. Only works on string f
2427
2453
| `separator` | yes | - | A regex which matches the separator, eg `,` or `\s+`
2428
2454
| `target_field` | no | `field` | The field to assign the split value to, by default `field` is updated in-place
2429
2455
| `ignore_missing` | no | `false` | If `true` and `field` does not exist, the processor quietly exits without modifying the document
2456
+
include::ingest-node-common-processor.asciidoc[]
2430
2457
|======
2431
2458
2432
2459
[source,js]
@@ -2455,6 +2482,7 @@ Throws an error when the field is not an array.
2455
2482
| `field` | yes | - | The field to be sorted
2456
2483
| `order` | no | `"asc"` | The sort order to use. Accepts `"asc"` or `"desc"`.
2457
2484
| `target_field` | no | `field` | The field to assign the sorted value to, by default `field` is updated in-place
2485
+
include::ingest-node-common-processor.asciidoc[]
2458
2486
|======
2459
2487
2460
2488
[source,js]
@@ -2482,6 +2510,7 @@ NOTE: This only works on leading and trailing whitespace.
2482
2510
| `field` | yes | - | The string-valued field to trim whitespace from
2483
2511
| `target_field` | no | `field` | The field to assign the trimmed value to, by default `field` is updated in-place
2484
2512
| `ignore_missing` | no | `false` | If `true` and `field` does not exist, the processor quietly exits without modifying the document
2513
+
include::ingest-node-common-processor.asciidoc[]
2485
2514
|======
2486
2515
2487
2516
[source,js]
@@ -2506,6 +2535,7 @@ Converts a string to its uppercase equivalent.
2506
2535
| `field` | yes | - | The field to make uppercase
2507
2536
| `target_field` | no | `field` | The field to assign the converted value to, by default `field` is updated in-place
2508
2537
| `ignore_missing` | no | `false` | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
2538
+
include::ingest-node-common-processor.asciidoc[]
2509
2539
|======
2510
2540
2511
2541
[source,js]
@@ -2530,6 +2560,7 @@ URL-decodes a string
2530
2560
| `field` | yes | - | The field to decode
2531
2561
| `target_field` | no | `field` | The field to assign the converted value to, by default `field` is updated in-place
2532
2562
| `ignore_missing` | no | `false` | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document
0 commit comments