1496 lines
60 KiB
Plaintext
1496 lines
60 KiB
Plaintext
[[reference-shared-types-ingest]]
|
||
|
||
////////
|
||
===========================================================================================================================
|
||
|| ||
|
||
|| ||
|
||
|| ||
|
||
|| ██████╗ ███████╗ █████╗ ██████╗ ███╗ ███╗███████╗ ||
|
||
|| ██╔══██╗██╔════╝██╔══██╗██╔══██╗████╗ ████║██╔════╝ ||
|
||
|| ██████╔╝█████╗ ███████║██║ ██║██╔████╔██║█████╗ ||
|
||
|| ██╔══██╗██╔══╝ ██╔══██║██║ ██║██║╚██╔╝██║██╔══╝ ||
|
||
|| ██║ ██║███████╗██║ ██║██████╔╝██║ ╚═╝ ██║███████╗ ||
|
||
|| ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═╝╚══════╝ ||
|
||
|| ||
|
||
|| ||
|
||
|| This file is autogenerated, DO NOT send pull requests that changes this file directly. ||
|
||
|| You should update the script that does the generation, which can be found in: ||
|
||
|| https://github.com/elastic/elastic-client-generator-js ||
|
||
|| ||
|
||
|| You can run the script with the following command: ||
|
||
|| npm run elasticsearch -- --version <version> ||
|
||
|| ||
|
||
|| ||
|
||
|| ||
|
||
===========================================================================================================================
|
||
////////
|
||
|
||
|
||
|
||
== Shared Ingest types
|
||
|
||
|
||
[discrete]
|
||
[[IngestAppendProcessor]]
|
||
=== IngestAppendProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestAppendProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to be appended to. Supports template snippets. */
|
||
field: <<Field>>
|
||
pass:[/**] @property value The value to be appended. Supports template snippets. */
|
||
value: any | any[]
|
||
pass:[/**] @property allow_duplicates If `false`, the processor does not append values already present in the field. */
|
||
allow_duplicates?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestAttachmentProcessor]]
|
||
=== IngestAttachmentProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestAttachmentProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to get the base64 encoded field from. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and field does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property indexed_chars The number of chars being used for extraction to prevent huge fields. Use `-1` for no limit. */
|
||
indexed_chars?: <<long>>
|
||
pass:[/**] @property indexed_chars_field <<Field>> name from which you can overwrite the number of chars being used for extraction. */
|
||
indexed_chars_field?: <<Field>>
|
||
pass:[/**] @property properties Array of properties to select to be stored. Can be `content`, `title`, `name`, `author`, `keywords`, `date`, `content_type`, `content_length`, `language`. */
|
||
properties?: string[]
|
||
pass:[/**] @property target_field The field that will hold the attachment information. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property remove_binary If true, the binary field will be removed from the document */
|
||
remove_binary?: boolean
|
||
pass:[/**] @property resource_name <<Field>> containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource <<Name>> Based Detection. */
|
||
resource_name?: string
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestBytesProcessor]]
|
||
=== IngestBytesProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestBytesProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to convert. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property target_field The field to assign the converted value to. By default, the field is updated in-place. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestCircleProcessor]]
|
||
=== IngestCircleProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestCircleProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property error_distance The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for `geo_shape`, unit-less for `shape`). */
|
||
error_distance: <<double>>
|
||
pass:[/**] @property field The field to interpret as a circle. Either a string in WKT format or a map for GeoJSON. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property shape_type Which field mapping type is to be used when processing the circle: `geo_shape` or `shape`. */
|
||
shape_type: <<IngestShapeType>>
|
||
pass:[/**] @property target_field The field to assign the polygon shape to By default, the field is updated in-place. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestCommunityIDProcessor]]
|
||
=== IngestCommunityIDProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestCommunityIDProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property source_ip <<Field>> containing the source IP address. */
|
||
source_ip?: <<Field>>
|
||
pass:[/**] @property source_port <<Field>> containing the source port. */
|
||
source_port?: <<Field>>
|
||
pass:[/**] @property destination_ip <<Field>> containing the destination IP address. */
|
||
destination_ip?: <<Field>>
|
||
pass:[/**] @property destination_port <<Field>> containing the destination port. */
|
||
destination_port?: <<Field>>
|
||
pass:[/**] @property iana_number <<Field>> containing the IANA number. */
|
||
iana_number?: <<Field>>
|
||
pass:[/**] @property icmp_type <<Field>> containing the ICMP type. */
|
||
icmp_type?: <<Field>>
|
||
pass:[/**] @property icmp_code <<Field>> containing the ICMP code. */
|
||
icmp_code?: <<Field>>
|
||
pass:[/**] @property transport <<Field>> containing the transport protocol name or number. Used only when the iana_number field is not present. The following protocol names are currently supported: eigrp, gre, icmp, icmpv6, igmp, ipv6-icmp, ospf, pim, sctp, tcp, udp */
|
||
transport?: <<Field>>
|
||
pass:[/**] @property target_field Output field for the community ID. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property seed Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme. */
|
||
seed?: <<integer>>
|
||
pass:[/**] @property ignore_missing If true and any required fields are missing, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestConvertProcessor]]
|
||
=== IngestConvertProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestConvertProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field whose value is to be converted. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property target_field The field to assign the converted value to. By default, the `field` is updated in-place. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property type The type to convert the existing value to. */
|
||
type: <<IngestConvertType>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestConvertType]]
|
||
=== IngestConvertType
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
type IngestConvertType = '<<integer>>' | '<<long>>' | '<<double>>' | '<<float>>' | 'boolean' | 'ip' | 'string' | 'auto'
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestCsvProcessor]]
|
||
=== IngestCsvProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestCsvProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property empty_value Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes (`""`). */
|
||
empty_value?: any
|
||
pass:[/**] @property field The field to extract data from. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property quote Quote used in CSV, has to be single character string. */
|
||
quote?: string
|
||
pass:[/**] @property separator Separator used in CSV, has to be single character string. */
|
||
separator?: string
|
||
pass:[/**] @property target_fields The array of fields to assign extracted values to. */
|
||
target_fields: <<Fields>>
|
||
pass:[/**] @property trim Trim whitespaces in unquoted fields. */
|
||
trim?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestDatabaseConfiguration]]
|
||
=== IngestDatabaseConfiguration
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestDatabaseConfiguration {
|
||
pass:[/**] @property name The provider-assigned name of the IP geolocation database to download. */
|
||
name: <<Name>>
|
||
pass:[/**] @property maxmind The configuration necessary to identify which IP geolocation provider to use to download the database, as well as any provider-specific configuration necessary for such downloading. At present, the only supported provider is maxmind, and the maxmind provider requires that an account_id (string) is configured. */
|
||
maxmind: <<IngestMaxmind>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestDateIndexNameProcessor]]
|
||
=== IngestDateIndexNameProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestDateIndexNameProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property date_formats An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N. */
|
||
date_formats: string[]
|
||
pass:[/**] @property date_rounding How to round the date when formatting the date into the index name. Valid values are: `y` (year), `M` (month), `w` (week), `d` (day), `h` (hour), `m` (minute) and `s` (second). Supports template snippets. */
|
||
date_rounding: string
|
||
pass:[/**] @property field The field to get the date or timestamp from. */
|
||
field: <<Field>>
|
||
pass:[/**] @property index_name_format The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets. */
|
||
index_name_format?: string
|
||
pass:[/**] @property index_name_prefix A prefix of the index name to be prepended before the printed date. Supports template snippets. */
|
||
index_name_prefix?: string
|
||
pass:[/**] @property locale The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days. */
|
||
locale?: string
|
||
pass:[/**] @property timezone The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names. */
|
||
timezone?: string
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestDateProcessor]]
|
||
=== IngestDateProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestDateProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to get the date from. */
|
||
field: <<Field>>
|
||
pass:[/**] @property formats An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N. */
|
||
formats: string[]
|
||
pass:[/**] @property locale The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets. */
|
||
locale?: string
|
||
pass:[/**] @property target_field The field that will hold the parsed date. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property timezone The timezone to use when parsing the date. Supports template snippets. */
|
||
timezone?: string
|
||
pass:[/**] @property output_format The format to use when writing the date to target_field. Must be a valid java time pattern. */
|
||
output_format?: string
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestDissectProcessor]]
|
||
=== IngestDissectProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestDissectProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property append_separator The character(s) that separate the appended fields. */
|
||
append_separator?: string
|
||
pass:[/**] @property field The field to dissect. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property pattern The pattern to apply to the field. */
|
||
pattern: string
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestDotExpanderProcessor]]
|
||
=== IngestDotExpanderProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestDotExpanderProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to expand into an object field. If set to `*`, all top-level fields will be expanded. */
|
||
field: <<Field>>
|
||
pass:[/**] @property override Controls the behavior when there is already an existing nested object that conflicts with the expanded field. When `false`, the processor will merge conflicts by combining the old and the new values into an array. When `true`, the value from the expanded field will overwrite the existing value. */
|
||
override?: boolean
|
||
pass:[/**] @property path The field that contains the field to expand. Only required if the field to expand is part another object field, because the `field` option can only understand leaf fields. */
|
||
path?: string
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestDropProcessor]]
|
||
=== IngestDropProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestDropProcessor extends <<IngestProcessorBase>> {
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestEnrichProcessor]]
|
||
=== IngestEnrichProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestEnrichProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field in the input document that matches the policies match_field used to retrieve the enrichment data. Supports template snippets. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property max_matches The maximum number of matched documents to include under the configured target field. The `target_field` will be turned into a json array if `max_matches` is higher than 1, otherwise `target_field` will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128. */
|
||
max_matches?: <<integer>>
|
||
pass:[/**] @property override If processor will update fields with pre-existing non-null-valued field. When set to `false`, such fields will not be touched. */
|
||
override?: boolean
|
||
pass:[/**] @property policy_name The name of the enrich policy to use. */
|
||
policy_name: string
|
||
pass:[/**] @property shape_relation A spatial relation operator used to match the geoshape of incoming documents to documents in the enrich index. This option is only used for `geo_match` enrich policy types. */
|
||
shape_relation?: <<GeoShapeRelation>>
|
||
pass:[/**] @property target_field <<Field>> added to incoming documents to contain enrich data. This field contains both the `match_field` and `enrich_fields` specified in the enrich policy. Supports template snippets. */
|
||
target_field: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestFailProcessor]]
|
||
=== IngestFailProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestFailProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property message The error message thrown by the processor. Supports template snippets. */
|
||
message: string
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestFingerprintDigest]]
|
||
=== IngestFingerprintDigest
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
type IngestFingerprintDigest = 'MD5' | 'SHA-1' | 'SHA-256' | 'SHA-512' | 'MurmurHash3'
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestFingerprintProcessor]]
|
||
=== IngestFingerprintProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestFingerprintProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property fields Array of fields to include in the fingerprint. For objects, the processor hashes both the field key and value. For other fields, the processor hashes only the field value. */
|
||
fields: <<Fields>>
|
||
pass:[/**] @property target_field Output field for the fingerprint. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property salt Salt value for the hash function. */
|
||
salt?: string
|
||
pass:[/**] @property method The hash method used to compute the fingerprint. Must be one of MD5, SHA-1, SHA-256, SHA-512, or MurmurHash3. */
|
||
method?: <<IngestFingerprintDigest>>
|
||
pass:[/**] @property ignore_missing If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestForeachProcessor]]
|
||
=== IngestForeachProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestForeachProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field <<Field>> containing array or object values. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true`, the processor silently exits without changing the document if the `field` is `null` or missing. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property processor <<Ingest>> processor to run on each element. */
|
||
processor: <<IngestProcessorContainer>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestGeoGridProcessor]]
|
||
=== IngestGeoGridProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestGeoGridProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to interpret as a geo-tile.= The field format is determined by the `tile_type`. */
|
||
field: string
|
||
pass:[/**] @property tile_type Three tile formats are understood: geohash, geotile and geohex. */
|
||
tile_type: <<IngestGeoGridTileType>>
|
||
pass:[/**] @property target_field The field to assign the polygon shape to, by default, the `field` is updated in-place. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property parent_field If specified and a parent tile exists, save that tile address to this field. */
|
||
parent_field?: <<Field>>
|
||
pass:[/**] @property children_field If specified and children tiles exist, save those tile addresses to this field as an array of strings. */
|
||
children_field?: <<Field>>
|
||
pass:[/**] @property non_children_field If specified and intersecting non-child tiles exist, save their addresses to this field as an array of strings. */
|
||
non_children_field?: <<Field>>
|
||
pass:[/**] @property precision_field If specified, save the tile precision (zoom) as an <<integer>> to this field. */
|
||
precision_field?: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property target_format Which format to save the generated polygon in. */
|
||
target_format?: <<IngestGeoGridTargetFormat>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestGeoGridTargetFormat]]
|
||
=== IngestGeoGridTargetFormat
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
type IngestGeoGridTargetFormat = 'geojson' | 'wkt'
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestGeoGridTileType]]
|
||
=== IngestGeoGridTileType
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
type IngestGeoGridTileType = 'geotile' | 'geohex' | 'geohash'
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestGeoIpProcessor]]
|
||
=== IngestGeoIpProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestGeoIpProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property database_file The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory. */
|
||
database_file?: string
|
||
pass:[/**] @property field The field to get the ip address from for the geographical lookup. */
|
||
field: <<Field>>
|
||
pass:[/**] @property first_only If `true`, only the first found geoip data will be returned, even if the field contains an array. */
|
||
first_only?: boolean
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property properties Controls what properties are added to the `target_field` based on the geoip lookup. */
|
||
properties?: string[]
|
||
pass:[/**] @property target_field The field that will hold the geographical information looked up from the MaxMind database. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property download_database_on_pipeline_creation If `true` (and if `ingest.geoip.downloader.eager.download` is `false`), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the `default_pipeline` or `final_pipeline` in an index. */
|
||
download_database_on_pipeline_creation?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestGrokProcessor]]
|
||
=== IngestGrokProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestGrokProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property ecs_compatibility Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names. */
|
||
ecs_compatibility?: string
|
||
pass:[/**] @property field The field to use for grok expression parsing. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property pattern_definitions A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition. */
|
||
pattern_definitions?: Record<string, string>
|
||
pass:[/**] @property patterns An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches. */
|
||
patterns: <<GrokPattern>>[]
|
||
pass:[/**] @property trace_match When `true`, `_ingest._grok_match_index` will be inserted into your matched document’s metadata with the index into the pattern found in `patterns` that matched. */
|
||
trace_match?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestGsubProcessor]]
|
||
=== IngestGsubProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestGsubProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to apply the replacement to. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property pattern The pattern to be replaced. */
|
||
pattern: string
|
||
pass:[/**] @property replacement The string to replace the matching patterns with. */
|
||
replacement: string
|
||
pass:[/**] @property target_field The field to assign the converted value to By default, the `field` is updated in-place. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestHtmlStripProcessor]]
|
||
=== IngestHtmlStripProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestHtmlStripProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The string-valued field to remove HTML tags from. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document, */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property target_field The field to assign the converted value to By default, the `field` is updated in-place. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestInferenceConfig]]
|
||
=== IngestInferenceConfig
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestInferenceConfig {
|
||
pass:[/**] @property regression Regression configuration for inference. */
|
||
regression?: <<IngestInferenceConfigRegression>>
|
||
pass:[/**] @property classification Classification configuration for inference. */
|
||
classification?: <<IngestInferenceConfigClassification>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestInferenceConfigClassification]]
|
||
=== IngestInferenceConfigClassification
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestInferenceConfigClassification {
|
||
pass:[/**] @property num_top_classes Specifies the number of top class predictions to return. */
|
||
num_top_classes?: <<integer>>
|
||
pass:[/**] @property num_top_feature_importance_values Specifies the maximum number of feature importance values per document. */
|
||
num_top_feature_importance_values?: <<integer>>
|
||
pass:[/**] @property results_field The field that is added to incoming documents to contain the inference prediction. */
|
||
results_field?: <<Field>>
|
||
pass:[/**] @property top_classes_results_field Specifies the field to which the top classes are written. */
|
||
top_classes_results_field?: <<Field>>
|
||
pass:[/**] @property prediction_field_type Specifies the type of the predicted field to write. Valid values are: `string`, `number`, `boolean`. */
|
||
prediction_field_type?: string
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestInferenceConfigRegression]]
|
||
=== IngestInferenceConfigRegression
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestInferenceConfigRegression {
|
||
pass:[/**] @property results_field The field that is added to incoming documents to contain the inference prediction. */
|
||
results_field?: <<Field>>
|
||
pass:[/**] @property num_top_feature_importance_values Specifies the maximum number of feature importance values per document. */
|
||
num_top_feature_importance_values?: <<integer>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestInferenceProcessor]]
|
||
=== IngestInferenceProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestInferenceProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property model_id The ID or alias for the trained model, or the ID of the deployment. */
|
||
model_id: <<Id>>
|
||
pass:[/**] @property target_field <<Field>> added to incoming documents to contain results objects. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property field_map Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration. */
|
||
field_map?: Record<<<Field>>, any>
|
||
pass:[/**] @property inference_config Contains the inference type and its options. */
|
||
inference_config?: <<IngestInferenceConfig>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestIpLocationProcessor]]
|
||
=== IngestIpLocationProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestIpLocationProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property database_file The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory. */
|
||
database_file?: string
|
||
pass:[/**] @property field The field to get the ip address from for the geographical lookup. */
|
||
field: <<Field>>
|
||
pass:[/**] @property first_only If `true`, only the first found IP location data will be returned, even if the field contains an array. */
|
||
first_only?: boolean
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property properties Controls what properties are added to the `target_field` based on the IP location lookup. */
|
||
properties?: string[]
|
||
pass:[/**] @property target_field The field that will hold the geographical information looked up from the MaxMind database. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property download_database_on_pipeline_creation If `true` (and if `ingest.geoip.downloader.eager.download` is `false`), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the `default_pipeline` or `final_pipeline` in an index. */
|
||
download_database_on_pipeline_creation?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestJoinProcessor]]
|
||
=== IngestJoinProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestJoinProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field <<Field>> containing array values to join. */
|
||
field: <<Field>>
|
||
pass:[/**] @property separator The separator character. */
|
||
separator: string
|
||
pass:[/**] @property target_field The field to assign the joined value to. By default, the field is updated in-place. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestJsonProcessor]]
|
||
=== IngestJsonProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestJsonProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property add_to_root Flag that forces the parsed JSON to be added at the top level of the document. `target_field` must not be set when this option is chosen. */
|
||
add_to_root?: boolean
|
||
pass:[/**] @property add_to_root_conflict_strategy When set to `replace`, root fields that conflict with fields from the parsed JSON will be overridden. When set to `merge`, conflicting fields will be merged. Only applicable `if add_to_root` is set to true. */
|
||
add_to_root_conflict_strategy?: <<IngestJsonProcessorConflictStrategy>>
|
||
pass:[/**] @property allow_duplicate_keys When set to `true`, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins. */
|
||
allow_duplicate_keys?: boolean
|
||
pass:[/**] @property field The field to be parsed. */
|
||
field: <<Field>>
|
||
pass:[/**] @property target_field The field that the converted structured object will be written into. Any existing content in this field will be overwritten. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestJsonProcessorConflictStrategy]]
|
||
=== IngestJsonProcessorConflictStrategy
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
type IngestJsonProcessorConflictStrategy = 'replace' | 'merge'
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestKeyValueProcessor]]
|
||
=== IngestKeyValueProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestKeyValueProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property exclude_keys List of keys to exclude from document. */
|
||
exclude_keys?: string[]
|
||
pass:[/**] @property field The field to be parsed. Supports template snippets. */
|
||
field: <<Field>>
|
||
pass:[/**] @property field_split Regex pattern to use for splitting key-value pairs. */
|
||
field_split: string
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property include_keys List of keys to filter and insert into document. Defaults to including all keys. */
|
||
include_keys?: string[]
|
||
pass:[/**] @property prefix Prefix to be added to extracted keys. */
|
||
prefix?: string
|
||
pass:[/**] @property strip_brackets If `true`. strip brackets `()`, `<>`, `[]` as well as quotes `'` and `"` from extracted values. */
|
||
strip_brackets?: boolean
|
||
pass:[/**] @property target_field The field to insert the extracted keys into. Defaults to the root of the document. Supports template snippets. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property trim_key String of characters to trim from extracted keys. */
|
||
trim_key?: string
|
||
pass:[/**] @property trim_value String of characters to trim from extracted values. */
|
||
trim_value?: string
|
||
pass:[/**] @property value_split Regex pattern to use for splitting the key from the value within a key-value pair. */
|
||
value_split: string
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestLowercaseProcessor]]
|
||
=== IngestLowercaseProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestLowercaseProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to make lowercase. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property target_field The field to assign the converted value to. By default, the field is updated in-place. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestMaxmind]]
|
||
=== IngestMaxmind
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestMaxmind {
|
||
account_id: <<Id>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestNetworkDirectionProcessor]]
|
||
=== IngestNetworkDirectionProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestNetworkDirectionProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property source_ip <<Field>> containing the source IP address. */
|
||
source_ip?: <<Field>>
|
||
pass:[/**] @property destination_ip <<Field>> containing the destination IP address. */
|
||
destination_ip?: <<Field>>
|
||
pass:[/**] @property target_field Output field for the network direction. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property internal_networks List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field. */
|
||
internal_networks?: string[]
|
||
pass:[/**] @property internal_networks_field A field on the given document to read the internal_networks configuration from. */
|
||
internal_networks_field?: <<Field>>
|
||
pass:[/**] @property ignore_missing If true and any required fields are missing, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestPipeline]]
|
||
=== IngestPipeline
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestPipeline {
|
||
pass:[/**] @property description Description of the ingest pipeline. */
|
||
description?: string
|
||
pass:[/**] @property on_failure Processors to run immediately after a processor failure. */
|
||
on_failure?: <<IngestProcessorContainer>>[]
|
||
pass:[/**] @property processors Processors used to perform transformations on documents before indexing. Processors run sequentially in the order specified. */
|
||
processors?: <<IngestProcessorContainer>>[]
|
||
pass:[/**] @property version Version number used by external systems to track ingest pipelines. */
|
||
version?: <<VersionNumber>>
|
||
pass:[/**] @property deprecated Marks this ingest pipeline as deprecated. When a deprecated ingest pipeline is referenced as the default or final pipeline when creating or updating a non-deprecated index template, Elasticsearch will emit a deprecation warning. */
|
||
deprecated?: boolean
|
||
pass:[/**] @property _meta Arbitrary metadata about the ingest pipeline. This map is not automatically generated by Elasticsearch. */
|
||
_meta?: <<Metadata>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestPipelineConfig]]
|
||
=== IngestPipelineConfig
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestPipelineConfig {
|
||
pass:[/**] @property description Description of the ingest pipeline. */
|
||
description?: string
|
||
pass:[/**] @property version Version number used by external systems to track ingest pipelines. */
|
||
version?: <<VersionNumber>>
|
||
pass:[/**] @property processors Processors used to perform transformations on documents before indexing. Processors run sequentially in the order specified. */
|
||
processors: <<IngestProcessorContainer>>[]
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestPipelineProcessor]]
|
||
=== IngestPipelineProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestPipelineProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property name The name of the pipeline to execute. Supports template snippets. */
|
||
name: <<Name>>
|
||
pass:[/**] @property ignore_missing_pipeline Whether to ignore missing pipelines instead of failing. */
|
||
ignore_missing_pipeline?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestProcessorBase]]
|
||
=== IngestProcessorBase
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestProcessorBase {
|
||
pass:[/**] @property description Description of the processor. Useful for describing the purpose of the processor or its configuration. */
|
||
description?: string
|
||
pass:[/**] @property if Conditionally execute the processor. */
|
||
if?: string
|
||
pass:[/**] @property ignore_failure Ignore failures for the processor. */
|
||
ignore_failure?: boolean
|
||
pass:[/**] @property on_failure Handle failures for the processor. */
|
||
on_failure?: <<IngestProcessorContainer>>[]
|
||
pass:[/**] @property tag Identifier for the processor. Useful for debugging and metrics. */
|
||
tag?: string
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestProcessorContainer]]
|
||
=== IngestProcessorContainer
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestProcessorContainer {
|
||
pass:[/**] @property append Appends one or more values to an existing array if the field already exists and it is an array. Converts a scalar to an array and appends one or more values to it if the field exists and it is a scalar. Creates an array containing the provided values if the field doesn’t exist. Accepts a single value or an array of values. */
|
||
append?: <<IngestAppendProcessor>>
|
||
pass:[/**] @property attachment The attachment processor lets Elasticsearch extract file attachments in common formats (such as PPT, XLS, and PDF) by using the Apache text extraction library Tika. */
|
||
attachment?: <<IngestAttachmentProcessor>>
|
||
pass:[/**] @property bytes Converts a human readable <<byte>> value (for example `1kb`) to its value in bytes (for example `1024`). If the field is an array of strings, all members of the array will be converted. Supported human readable units are "b", "kb", "mb", "gb", "tb", "pb" case insensitive. An error will occur if the field is not a supported format or resultant value exceeds 2^63. */
|
||
bytes?: <<IngestBytesProcessor>>
|
||
pass:[/**] @property circle Converts circle definitions of shapes to regular polygons which approximate them. */
|
||
circle?: <<IngestCircleProcessor>>
|
||
pass:[/**] @property community_id Computes the Community ID for network flow data as defined in the Community ID Specification. You can use a community ID to correlate network events related to a single flow. */
|
||
community_id?: <<IngestCommunityIDProcessor>>
|
||
pass:[/**] @property convert Converts a field in the currently ingested document to a different type, such as converting a string to an <<integer>>. If the field value is an array, all members will be converted. */
|
||
convert?: <<IngestConvertProcessor>>
|
||
pass:[/**] @property csv Extracts fields from CSV line out of a single text field within a document. Any empty field in CSV will be skipped. */
|
||
csv?: <<IngestCsvProcessor>>
|
||
pass:[/**] @property date Parses dates from fields, and then uses the date or timestamp as the timestamp for the document. */
|
||
date?: <<IngestDateProcessor>>
|
||
pass:[/**] @property date_index_name The purpose of this processor is to point documents to the right time based index based on a date or timestamp field in a document by using the date math index name support. */
|
||
date_index_name?: <<IngestDateIndexNameProcessor>>
|
||
pass:[/**] @property dissect Extracts structured fields out of a single text field by matching the text field against a delimiter-based pattern. */
|
||
dissect?: <<IngestDissectProcessor>>
|
||
pass:[/**] @property dot_expander Expands a field with dots into an object field. This processor allows fields with dots in the name to be accessible by other processors in the pipeline. Otherwise these fields can’t be accessed by any processor. */
|
||
dot_expander?: <<IngestDotExpanderProcessor>>
|
||
pass:[/**] @property drop Drops the document without raising any errors. This is useful to prevent the document from getting indexed based on some condition. */
|
||
drop?: <<IngestDropProcessor>>
|
||
pass:[/**] @property enrich The `enrich` processor can enrich documents with data from another index. */
|
||
enrich?: <<IngestEnrichProcessor>>
|
||
pass:[/**] @property fail Raises an exception. This is useful for when you expect a pipeline to fail and want to relay a specific message to the requester. */
|
||
fail?: <<IngestFailProcessor>>
|
||
pass:[/**] @property fingerprint Computes a hash of the document’s content. You can use this hash for content fingerprinting. */
|
||
fingerprint?: <<IngestFingerprintProcessor>>
|
||
pass:[/**] @property foreach Runs an ingest processor on each element of an array or object. */
|
||
foreach?: <<IngestForeachProcessor>>
|
||
pass:[/**] @property ip_location Currently an undocumented alias for GeoIP <<Processor>>. */
|
||
ip_location?: <<IngestIpLocationProcessor>>
|
||
pass:[/**] @property geo_grid Converts geo-grid definitions of grid tiles or cells to regular bounding boxes or polygons which describe their shape. This is useful if there is a need to interact with the tile shapes as spatially indexable fields. */
|
||
geo_grid?: <<IngestGeoGridProcessor>>
|
||
pass:[/**] @property geoip The `geoip` processor adds information about the geographical location of an IPv4 or IPv6 address. */
|
||
geoip?: <<IngestGeoIpProcessor>>
|
||
pass:[/**] @property grok Extracts structured fields out of a single text field within a document. You choose which field to extract matched fields from, as well as the grok pattern you expect will match. A grok pattern is like a regular expression that supports aliased expressions that can be reused. */
|
||
grok?: <<IngestGrokProcessor>>
|
||
pass:[/**] @property gsub Converts a string field by applying a regular expression and a replacement. If the field is an array of string, all members of the array will be converted. If any non-string values are encountered, the processor will throw an exception. */
|
||
gsub?: <<IngestGsubProcessor>>
|
||
pass:[/**] @property html_strip Removes HTML tags from the field. If the field is an array of strings, HTML tags will be removed from all members of the array. */
|
||
html_strip?: <<IngestHtmlStripProcessor>>
|
||
pass:[/**] @property inference Uses a pre-trained data frame analytics model or a model deployed for natural language processing tasks to infer against the data that is being ingested in the pipeline. */
|
||
inference?: <<IngestInferenceProcessor>>
|
||
pass:[/**] @property join Joins each element of an array into a single string using a separator character between each element. Throws an error when the field is not an array. */
|
||
join?: <<IngestJoinProcessor>>
|
||
pass:[/**] @property json Converts a JSON string into a structured JSON object. */
|
||
json?: <<IngestJsonProcessor>>
|
||
pass:[/**] @property kv This processor helps automatically parse messages (or specific event fields) which are of the `foo=bar` variety. */
|
||
kv?: <<IngestKeyValueProcessor>>
|
||
pass:[/**] @property lowercase Converts a string to its lowercase equivalent. If the field is an array of strings, all members of the array will be converted. */
|
||
lowercase?: <<IngestLowercaseProcessor>>
|
||
pass:[/**] @property network_direction Calculates the network direction given a source IP address, destination IP address, and a list of internal networks. */
|
||
network_direction?: <<IngestNetworkDirectionProcessor>>
|
||
pass:[/**] @property pipeline Executes another pipeline. */
|
||
pipeline?: <<IngestPipelineProcessor>>
|
||
pass:[/**] @property redact The Redact processor uses the Grok rules engine to obscure text in the input document matching the given Grok patterns. The processor can be used to obscure Personal Identifying Information (PII) by configuring it to detect known patterns such as email or IP addresses. Text that matches a Grok pattern is replaced with a configurable string such as `<EMAIL>` where an email address is matched or simply replace all matches with the text `<REDACTED>` if preferred. */
|
||
redact?: <<IngestRedactProcessor>>
|
||
pass:[/**] @property registered_domain Extracts the registered domain (also known as the effective top-level domain or eTLD), sub-domain, and top-level domain from a fully qualified domain name (FQDN). Uses the registered domains defined in the Mozilla Public Suffix List. */
|
||
registered_domain?: <<IngestRegisteredDomainProcessor>>
|
||
pass:[/**] @property remove Removes existing fields. If one field doesn’t exist, an exception will be thrown. */
|
||
remove?: <<IngestRemoveProcessor>>
|
||
pass:[/**] @property rename Renames an existing field. If the field doesn’t exist or the new name is already used, an exception will be thrown. */
|
||
rename?: <<IngestRenameProcessor>>
|
||
pass:[/**] @property reroute Routes a document to another target index or data stream. When setting the `destination` option, the target is explicitly specified and the dataset and namespace options can’t be set. When the `destination` option is not set, this processor is in a data stream mode. Note that in this mode, the reroute processor can only be used on data streams that follow the data stream naming scheme. */
|
||
reroute?: <<IngestRerouteProcessor>>
|
||
pass:[/**] @property script Runs an inline or stored script on incoming documents. The script runs in the `ingest` context. */
|
||
script?: <<IngestScriptProcessor>>
|
||
pass:[/**] @property set Adds a field with the specified value. If the field already exists, its value will be replaced with the provided one. */
|
||
set?: <<IngestSetProcessor>>
|
||
pass:[/**] @property set_security_user Sets user-related details (such as `username`, `roles`, `email`, `full_name`, `metadata`, `api_key`, `realm` and `authentication_type`) from the current authenticated user to the current document by pre-processing the ingest. */
|
||
set_security_user?: <<IngestSetSecurityUserProcessor>>
|
||
pass:[/**] @property sort Sorts the elements of an array ascending or descending. Homogeneous arrays of numbers will be sorted numerically, while arrays of strings or heterogeneous arrays of strings + numbers will be sorted lexicographically. Throws an error when the field is not an array. */
|
||
sort?: <<IngestSortProcessor>>
|
||
pass:[/**] @property split Splits a field into an array using a separator character. Only works on string fields. */
|
||
split?: <<IngestSplitProcessor>>
|
||
pass:[/**] @property terminate Terminates the current ingest pipeline, causing no further processors to be run. This will normally be executed conditionally, using the `if` option. */
|
||
terminate?: <<IngestTerminateProcessor>>
|
||
pass:[/**] @property trim Trims whitespace from a field. If the field is an array of strings, all members of the array will be trimmed. This only works on leading and trailing whitespace. */
|
||
trim?: <<IngestTrimProcessor>>
|
||
pass:[/**] @property uppercase Converts a string to its uppercase equivalent. If the field is an array of strings, all members of the array will be converted. */
|
||
uppercase?: <<IngestUppercaseProcessor>>
|
||
pass:[/**] @property urldecode URL-decodes a string. If the field is an array of strings, all members of the array will be decoded. */
|
||
urldecode?: <<IngestUrlDecodeProcessor>>
|
||
pass:[/**] @property uri_parts Parses a Uniform Resource Identifier (URI) string and extracts its components as an object. This URI object includes properties for the URI’s domain, path, fragment, port, query, scheme, user info, username, and password. */
|
||
uri_parts?: <<IngestUriPartsProcessor>>
|
||
pass:[/**] @property user_agent The `user_agent` processor extracts details from the user agent string a browser sends with its web requests. This processor adds this information by default under the `user_agent` field. */
|
||
user_agent?: <<IngestUserAgentProcessor>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestRedactProcessor]]
|
||
=== IngestRedactProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestRedactProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to be redacted */
|
||
field: <<Field>>
|
||
pass:[/**] @property patterns A list of grok expressions to match and redact named captures with */
|
||
patterns: <<GrokPattern>>[]
|
||
pattern_definitions?: Record<string, string>
|
||
pass:[/**] @property prefix Start a redacted section with this token */
|
||
prefix?: string
|
||
pass:[/**] @property suffix End a redacted section with this token */
|
||
suffix?: string
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property skip_if_unlicensed If `true` and the current license does not support running redact processors, then the processor quietly exits without modifying the document */
|
||
skip_if_unlicensed?: boolean
|
||
pass:[/**] @property trace_redact If `true` then ingest metadata `_ingest._redact._is_redacted` is set to `true` if the document has been redacted */
|
||
trace_redact?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestRegisteredDomainProcessor]]
|
||
=== IngestRegisteredDomainProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestRegisteredDomainProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field <<Field>> containing the source FQDN. */
|
||
field: <<Field>>
|
||
pass:[/**] @property target_field Object field containing extracted domain components. If an empty string, the processor adds components to the document’s root. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property ignore_missing If true and any required fields are missing, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestRemoveProcessor]]
|
||
=== IngestRemoveProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestRemoveProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field <<Fields>> to be removed. Supports template snippets. */
|
||
field: <<Fields>>
|
||
pass:[/**] @property keep <<Fields>> to be kept. When set, all fields other than those specified are removed. */
|
||
keep?: <<Fields>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestRenameProcessor]]
|
||
=== IngestRenameProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestRenameProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to be renamed. Supports template snippets. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property target_field The new name of the field. Supports template snippets. */
|
||
target_field: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestRerouteProcessor]]
|
||
=== IngestRerouteProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestRerouteProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property destination A static value for the target. Can’t be set when the dataset or namespace option is set. */
|
||
destination?: string
|
||
pass:[/**] @property dataset <<Field>> references or a static value for the dataset part of the data stream name. In addition to the criteria for index names, cannot contain - and must be no longer than 100 characters. Example values are nginx.access and nginx.error. Supports field references with a mustache-like syntax (denoted as {{<<double>>}} or {{{triple}}} curly braces). When resolving field references, the processor replaces invalid characters with _. Uses the <dataset> part of the index name as a fallback if all field references resolve to a null, missing, or non-string value. default {{data_stream.dataset}} */
|
||
dataset?: string | string[]
|
||
pass:[/**] @property namespace <<Field>> references or a static value for the namespace part of the data stream name. See the criteria for index names for allowed characters. Must be no longer than 100 characters. Supports field references with a mustache-like syntax (denoted as {{<<double>>}} or {{{triple}}} curly braces). When resolving field references, the processor replaces invalid characters with _. Uses the <namespace> part of the index name as a fallback if all field references resolve to a null, missing, or non-string value. default {{data_stream.namespace}} */
|
||
namespace?: string | string[]
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestScriptProcessor]]
|
||
=== IngestScriptProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestScriptProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property id ID of a stored script. If no `source` is specified, this parameter is required. */
|
||
id?: <<Id>>
|
||
pass:[/**] @property lang <<Script>> language. */
|
||
lang?: string
|
||
pass:[/**] @property params Object containing parameters for the script. */
|
||
params?: Record<string, any>
|
||
pass:[/**] @property source Inline script. If no `id` is specified, this parameter is required. */
|
||
source?: string
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestSetProcessor]]
|
||
=== IngestSetProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestSetProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property copy_from The origin field which will be copied to `field`, cannot set `value` simultaneously. Supported data types are `boolean`, `number`, `array`, `object`, `string`, `date`, etc. */
|
||
copy_from?: <<Field>>
|
||
pass:[/**] @property field The field to insert, upsert, or update. Supports template snippets. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_empty_value If `true` and `value` is a template snippet that evaluates to `null` or the empty string, the processor quietly exits without modifying the document. */
|
||
ignore_empty_value?: boolean
|
||
pass:[/**] @property media_type The media type for encoding `value`. Applies only when value is a template snippet. Must be one of `application/json`, `text/plain`, or `application/x-www-form-urlencoded`. */
|
||
media_type?: string
|
||
pass:[/**] @property override If `true` processor will update fields with pre-existing non-null-valued field. When set to `false`, such fields will not be touched. */
|
||
override?: boolean
|
||
pass:[/**] @property value The value to be set for the field. Supports template snippets. May specify only one of `value` or `copy_from`. */
|
||
value?: any
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestSetSecurityUserProcessor]]
|
||
=== IngestSetSecurityUserProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestSetSecurityUserProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to store the user information into. */
|
||
field: <<Field>>
|
||
pass:[/**] @property properties Controls what user related properties are added to the field. */
|
||
properties?: string[]
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestShapeType]]
|
||
=== IngestShapeType
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
type IngestShapeType = 'geo_shape' | 'shape'
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestSortProcessor]]
|
||
=== IngestSortProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestSortProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to be sorted. */
|
||
field: <<Field>>
|
||
pass:[/**] @property order The sort order to use. Accepts `"asc"` or `"desc"`. */
|
||
order?: <<SortOrder>>
|
||
pass:[/**] @property target_field The field to assign the sorted value to. By default, the field is updated in-place. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestSplitProcessor]]
|
||
=== IngestSplitProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestSplitProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to split. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property preserve_trailing Preserves empty trailing fields, if any. */
|
||
preserve_trailing?: boolean
|
||
pass:[/**] @property separator A regex which matches the separator, for example, `,` or `\s+`. */
|
||
separator: string
|
||
pass:[/**] @property target_field The field to assign the split value to. By default, the field is updated in-place. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestTerminateProcessor]]
|
||
=== IngestTerminateProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestTerminateProcessor extends <<IngestProcessorBase>> {
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestTrimProcessor]]
|
||
=== IngestTrimProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestTrimProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The string-valued field to trim whitespace from. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property target_field The field to assign the trimmed value to. By default, the field is updated in-place. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestUppercaseProcessor]]
|
||
=== IngestUppercaseProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestUppercaseProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to make uppercase. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property target_field The field to assign the converted value to. By default, the field is updated in-place. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestUriPartsProcessor]]
|
||
=== IngestUriPartsProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestUriPartsProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field <<Field>> containing the URI string. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property keep_original If `true`, the processor copies the unparsed URI to `<target_field>.original`. */
|
||
keep_original?: boolean
|
||
pass:[/**] @property remove_if_successful If `true`, the processor removes the `field` after parsing the URI string. If parsing fails, the processor does not remove the `field`. */
|
||
remove_if_successful?: boolean
|
||
pass:[/**] @property target_field Output field for the URI object. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestUrlDecodeProcessor]]
|
||
=== IngestUrlDecodeProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestUrlDecodeProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field to decode. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property target_field The field to assign the converted value to. By default, the field is updated in-place. */
|
||
target_field?: <<Field>>
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestUserAgentProcessor]]
|
||
=== IngestUserAgentProcessor
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
interface IngestUserAgentProcessor extends <<IngestProcessorBase>> {
|
||
pass:[/**] @property field The field containing the user agent string. */
|
||
field: <<Field>>
|
||
pass:[/**] @property ignore_missing If `true` and `field` does not exist, the processor quietly exits without modifying the document. */
|
||
ignore_missing?: boolean
|
||
pass:[/**] @property regex_file The name of the file in the `config/ingest-user-agent` directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the `regexes.yaml` from uap-core it ships with. */
|
||
regex_file?: string
|
||
pass:[/**] @property target_field The field that will be filled with the user agent details. */
|
||
target_field?: <<Field>>
|
||
pass:[/**] @property properties Controls what properties are added to `target_field`. */
|
||
properties?: <<IngestUserAgentProperty>>[]
|
||
pass:[/**] @property extract_device_type Extracts device type from the user agent string on a best-effort basis. */
|
||
extract_device_type?: boolean
|
||
}
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|
||
|
||
[discrete]
|
||
[[IngestUserAgentProperty]]
|
||
=== IngestUserAgentProperty
|
||
|
||
[pass]
|
||
++++
|
||
<pre>
|
||
++++
|
||
type IngestUserAgentProperty = 'name' | 'os' | 'device' | 'original' | 'version'
|
||
[pass]
|
||
++++
|
||
</pre>
|
||
++++
|