Using ingest processors in Painless

Some ingest processors expose behavior through Painless methods that can be called in Painless scripts that execute in ingest pipelines.

All ingest methods available in Painless are scoped to the Processors namespace. For example:

 POST /_ingest/pipeline/_simulate?verbose {
  "pipeline": {
    "processors": [
      {
        "script": {
          "lang": "painless",
          "source": """
            long bytes = Processors.bytes(ctx.size);
            ctx.size_in_bytes = bytes;
          """
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "size": "1kb"
      }
    }
  ]
}

Use the bytes processor to return the number of bytes in the human-readable byte value supplied in the value parameter.

long bytes(String value);

Use the lowercase processor to convert the supplied string in the value parameter to its lowercase equivalent.

String lowercase(String value);

Use the uppercase processor to convert the supplied string in the value parameter to its uppercase equivalent.

String uppercase(String value);

Use the JSON processor to convert JSON strings to structured JSON objects. The first json method accepts a map and a key. The processor converts the JSON string in the map as specified by the key parameter to structured JSON content. That content is added directly to the map object.

The second json method accepts a JSON string in the value parameter and returns a structured JSON object.

void json(Map<String, Object> map, String key);
Object json(Object value);

You can then add this object to the document through the context object:

Object json = Processors.json(ctx.inputJsonString);
ctx.structuredJson = json;

Use the URL decode processor to URL-decode the string supplied in the value parameter.

String urlDecode(String value);

Use the URI parts processor to decompose the URI string supplied in the value parameter. Returns a map of key-value pairs in which the key is the name of the URI component such as domain or path and the value is the corresponding value for that component.

String uriParts(String value);

Use the community ID processor to compute the network community ID for network flow data.

String communityId(String sourceIpAddrString, String destIpAddrString, Object ianaNumber, Object transport, Object sourcePort, Object destinationPort, Object icmpType, Object icmpCode, int seed)
String communityId(String sourceIpAddrString, String destIpAddrString, Object ianaNumber, Object transport, Object sourcePort, Object destinationPort, Object icmpType, Object icmpCode)