摄取处理器参考

{
  "append": {
    "field": "tags",
    "value": ["production", "{{{app}}}", "{{{owner}}}"]
  }
}

{
  "bytes": {
    "field": "file.size"
  }
}

PUT _ingest/pipeline/my-pipeline-id
{
  "description": "converts the content of the id field to an integer",
  "processors" : [
    {
      "convert" : {
        "field" : "id",
        "type": "integer"
      }
    }
  ]
}

{
  "csv": {
    "field": "my_field",
    "target_fields": ["field1", "field2"]
  }
}

{
  "description" : "...",
  "processors" : [
    {
      "date" : {
        "field" : "initial_date",
        "target_field" : "timestamp",
        "formats" : ["dd/MM/yyyy HH:mm:ss"],
        "timezone" : "Europe/Amsterdam"
      }
    }
  ]
}

{
  "description" : "...",
  "processors" : [
    {
      "date" : {
        "field" : "initial_date",
        "target_field" : "timestamp",
        "formats" : ["ISO8601"],
        "timezone" : "{{{my_timezone}}}",
        "locale" : "{{{my_locale}}}"
      }
    }
  ]
}

"doc": {
  "_index": "_index",
  "_type": "_type",
  "_id": "_id",
  "_source": {
    "request": "/english/venues/cities/images/montpellier/18.gif",
    "auth": "-",
    "ident": "-",
    "verb": "GET",
    "@timestamp": "30/Apr/1998:22:00:52 +0000",
    "size": "3171",
    "clientip": "1.2.3.4",
    "httpversion": "1.0",
    "status": "200"
  }
}

{
  "dissect": {
    "field": "message",
    "pattern" : "%{clientip} %{ident} %{auth} [%{@timestamp}] \"%{verb} %{request} HTTP/%{httpversion}\" %{status} %{size}"
   }
}

{
  "dot_expander": {
    "field": "foo.bar"
  }
}

{
  "foo.bar" : "value"
}

{
  "foo" : {
    "bar" : "value"
  }
}

{
  "foo.bar" : "value2",
  "foo" : {
    "bar" : "value1"
  }
}

{
  "foo" : {
    "bar" : ["value1", "value2"]
  }
}

{
  "dot_expander": {
    "field": "foo.bar",
    "override": true
  }
}

{
  "foo" : {
    "bar" : "value2"
  }
}

{
  "dot_expander": {
    "field": "*"
  }
}

{
  "foo.bar" : "value",
  "baz.qux" : "value"
}

{
  "foo" : {
    "bar" : "value"
  },
  "baz" : {
    "qux" : "value"
  }
}

{
  "dot_expander": {
    "path": "foo"
    "field": "*"
  }
}

{
  "foo" : {
    "bar.one" : "value",
    "bar.two" : "value"
  }
}

{
  "foo" : {
    "bar" : {
      "one" : "value",
      "two" : "value"
    }
  }
}

{
  "foo": "value1",
  "foo.bar": "value2"
}

{
  "processors" : [
    {
      "rename" : {
        "field" : "foo",
        "target_field" : "foo.bar"
      }
    },
    {
      "dot_expander": {
        "field": "foo.bar"
      }
    }
  ]
}

{
  "drop": {
    "if" : "ctx.network_name == 'Guest'"
  }
}

{
  "fail": {
    "if" : "ctx.tags.contains('production') != true",
    "message": "The production tag is not present, found tags: {{{tags}}}"
  }
}

{
  "values" : ["foo", "bar", "baz"]
}

{
  "foreach" : {
    "field" : "values",
    "processor" : {
      "uppercase" : {
        "field" : "_ingest._value"
      }
    }
  }
}

{
  "values" : ["FOO", "BAR", "BAZ"]
}

{
  "persons" : [
    {
      "id" : "1",
      "name" : "John Doe"
    },
    {
      "id" : "2",
      "name" : "Jane Doe"
    }
  ]
}

{
  "foreach" : {
    "field" : "persons",
    "processor" : {
      "remove" : {
        "field" : "_ingest._value.id"
      }
    }
  }
}

{
  "persons" : [
    {
      "name" : "John Doe"
    },
    {
      "name" : "Jane Doe"
    }
  ]
}

{
  "products" : {
    "widgets" : {
      "total_sales" : 50,
      "unit_price": 1.99,
      "display_name": ""
    },
    "sprockets" : {
      "total_sales" : 100,
      "unit_price": 9.99,
      "display_name": "Super Sprockets"
    },
    "whizbangs" : {
      "total_sales" : 200,
      "unit_price": 19.99,
      "display_name": "Wonderful Whizbangs"
    }
  }
}

{
  "foreach": {
    "field": "products",
    "processor": {
      "uppercase": {
        "field": "_ingest._value.display_name"
      }
    }
  }
}

{
  "products" : {
    "widgets" : {
      "total_sales" : 50,
      "unit_price" : 1.99,
      "display_name" : ""
    },
    "sprockets" : {
      "total_sales" : 100,
      "unit_price" : 9.99,
      "display_name" : "SUPER SPROCKETS"
    },
    "whizbangs" : {
      "total_sales" : 200,
      "unit_price" : 19.99,
      "display_name" : "WONDERFUL WHIZBANGS"
    }
  }
}

{
  "foreach": {
    "field": "products",
    "processor": {
      "set": {
        "field": "_ingest._key",
        "value": "{{_ingest._value.display_name}}"
      }
    }
  }
}

{
  "products" : {
    "Wonderful Whizbangs" : {
      "total_sales" : 200,
      "unit_price" : 19.99,
      "display_name" : "Wonderful Whizbangs"
    },
    "Super Sprockets" : {
      "total_sales" : 100,
      "unit_price" : 9.99,
      "display_name" : "Super Sprockets"
    }
  }
}

{
  "foreach" : {
    "field" : "persons",
    "processor" : {
      "remove" : {
        "field" : "_value.id",
        "on_failure" : [
          {
            "set" : {
              "field": "_index",
              "value": "failure_index"
            }
          }
        ]
      }
    }
  }
}

{
  "gsub": {
    "field": "field1",
    "pattern": "\\.",
    "replacement": "-"
  }
}

{
  "html_strip": {
    "field": "foo"
  }
}

{
  "join": {
    "field": "joined_array_field",
    "separator": "-"
  }
}

{
  "json" : {
    "field" : "string_source",
    "target_field" : "json_target"
  }
}

{
  "string_source": "{\"foo\": 2000}"
}

{
  "string_source": "{\"foo\": 2000}",
  "json_target": {
    "foo": 2000
  }
}

{
  "json" : {
    "field" : "source_and_target"
  }
}

{
  "source_and_target": "{\"foo\": 2000}"
}

{
  "source_and_target": {
    "foo": 2000
  }
}

{
  "kv": {
    "field": "message",
    "field_split": " ",
    "value_split": "="
  }
}

{
  "lowercase": {
    "field": "foo"
  }
}

{
  "pipeline": {
    "name": "inner-pipeline"
  }
}

{
  "field": "value",
  "inner_pipeline_set": "inner",
  "outer_pipeline_set": "outer"
}

{
  "remove": {
    "field": "user_agent"
  }
}

{
  "remove": {
    "field": ["user_agent", "url"]
  }
}

{
  "remove": {
    "keep": ["url"]
  }
}