Create or update a stream
https://{kibana_url}
- PUT /api/streams/{name}
- PUT /s/{space_id}/api/streams/{name}
Refer to Spaces for more information.
Creates or updates a stream definition. Classic streams can not be created through this API, only updated
[Required authorization] Route required privileges: manage_stream.
Path Parameters
-
namestring · max: 200required -
The name of the stream.
Request
-
dashboardsstringrequired -
rulesstringrequired -
streamobjectrequired -
descriptionstringrequired -
ingestobjectrequired -
failure_store -
lifecycle -
dslobjectrequired -
data_retentionstring · min: 1 -
A non-empty string.
-
downsampleobject -
afterstring · min: 1required -
A non-empty string.
-
fixed_intervalstring · min: 1required -
A non-empty string.
-
frozen_afterstring · min: 1 -
A non-empty string.
-
inheritobjectrequired -
processingobjectrequired -
steps -
action -
Values:
grok -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
Source field to parse with grok patterns
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip processing when source field is missing
-
pattern_definitionsmap string to string -
patternsstring · min: 1required -
Grok patterns applied in order to extract fields
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
dissect -
append_separatorstring · min: 1 -
Separator inserted when target fields are concatenated
-
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
Source field to parse with dissect pattern
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip processing when source field is missing
-
patternstring · min: 1required -
Dissect pattern describing field boundaries
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
uri_parts -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
Source field holding the URI string to parse
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip processing when source field is missing
-
keep_originalboolean -
If true (default), preserve the original URI string alongside the extracted parts
-
remove_if_successfulboolean -
If true, remove the source field after a successful parse. Source field is kept on failure.
-
tostring · min: 1 -
Target field / column prefix for the extracted URI components (defaults to "url"). May equal
from— the canonical ECS shape parses theurlfield in place. Note: combiningto === fromwithremove_if_successful: truenulls the parsed object after writing it. -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
date -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
formatsstringrequired -
Accepted input date formats, tried in order
-
fromstring · min: 1required -
Source field containing the date/time text
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
localestring · min: 1 -
Optional locale for date parsing
-
output_formatstring · min: 1 -
Optional output format for storing the parsed date as text
-
timezonestring · min: 1 -
Optional timezone for date parsing
-
tostring · min: 1 -
Target field for the parsed date (defaults to source)
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
drop_document -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
math -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
expressionstring · min: 1required -
A non-empty string.
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
tostring · min: 1required -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
rename -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
Existing source field to rename or move
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip when source field is missing
-
overrideboolean -
Allow overwriting the target field if it already exists
-
tostring · min: 1required -
New field name or destination path
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
set -
copy_fromstring · min: 1 -
Copy value from another field instead of providing a literal
-
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
overrideboolean -
Allow overwriting an existing target field
-
tostring · min: 1required -
Target field to set or create
-
valueobject -
Literal value to assign to the target field
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
append -
allow_duplicatesboolean -
If true, do not deduplicate appended values
-
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
tostring · min: 1required -
Array field to append values to
-
valueobject · min: 1required -
Values to append (must be literal, no templates)
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
remove_by_prefix -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
Field to remove along with all its nested fields
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
action -
Values:
remove -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
Field to remove from the document
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip processing when source field is missing
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
replace -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
patternstring · min: 1required -
replacementstringrequired -
tostring · min: 1 -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
redact -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
Source field to redact sensitive data from
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip processing when source field is missing (defaults to true)
-
pattern_definitionsmap string to string -
Custom pattern definitions to use in the patterns
-
patternsstring · min: 1required -
Grok patterns to match sensitive data (for example, "%{IP:client}", "%{EMAILADDRESS:email}")
-
prefixstring -
Prefix to prepend to the redacted pattern name (defaults to "<")
-
suffixstring -
Suffix to append to the redacted pattern name (defaults to ">")
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
uppercase -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
tostring · min: 1 -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
lowercase -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
tostring · min: 1 -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
trim -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
tostring · min: 1 -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
join -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
delimiterstringrequired -
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
tostring · min: 1required -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
split -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
Source field to split into an array
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip processing when source field is missing
-
preserve_trailingboolean -
Preserve empty trailing fields in the split result
-
separatorstring · min: 1required -
Regex separator used to split the field value into an array
-
tostring · min: 1 -
Target field for the split array (defaults to source)
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
sort -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
Array field to sort
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip processing when source field is missing
-
tostring · min: 1 -
Target field for the sorted array (defaults to source)
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
convert -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromstring · min: 1required -
Source field to convert to a different data type
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip processing when source field is missing
-
tostring · min: 1 -
Target field for the converted value (defaults to source)
-
type -
Target data type: integer, long, double, boolean, or string
-
Values:
integerlongdoublebooleanstring -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
concat -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
fromanyOf · min: 1required -
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
tostring · min: 1required -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
network_direction -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
destination_ipstring · min: 1required -
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
source_ipstring · min: 1required -
target_fieldstring · min: 1 -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
json_extract -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
extractionsobject · min: 1required -
List of extraction specifications
-
selectorstring · min: 1required -
JSONPath-like selector to extract value (e.g., "user.id", "$.metadata.client.ip", "items[0].name")
-
target_fieldstring · min: 1required -
Target field to store the extracted value
-
type -
Data type for the extracted value. Defaults to "keyword". Ensures consistent types across transpilers.
-
Values:
keywordintegerlongdoubleboolean -
fieldstring · min: 1required -
Source field containing the JSON string to parse
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip processing when source field is missing
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
enrich -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
overrideboolean -
policy_namestring · min: 1required -
A non-empty string.
-
tostring · min: 1required -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
user_agent -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
extract_device_typeboolean -
Extracts device type from the user agent string
-
fromstring · min: 1required -
The field containing the user agent string
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip processing when source field is missing
-
regex_filestring · min: 1 -
Custom regex file name containing the regular expressions for parsing the user agent string
-
tostring · min: 1 -
The field that will be filled with the user agent details
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Values:
registered_domain -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
expressionstring · min: 1required -
The string expression containing the FQDN to parse
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
ignore_missingboolean -
Skip processing when expression field is missing
-
prefixstring · min: 1required -
The prefix for the output columns. The extracted parts are available as prefix.part_name
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
action -
Manual ingest pipeline - executes raw Elasticsearch ingest processors
-
Values:
manual_ingest_pipeline -
customIdentifierstring · min: 1 -
Custom identifier to correlate this processor across outputs
-
descriptionstring -
Human-readable notes about this processor step
-
ignore_failureboolean -
Continue pipeline execution if this processor fails
-
on_failurestring to object -
Fallback processors to run when a processor fails
-
processorsstring to objectrequired -
List of raw Elasticsearch ingest processors to run
-
tagstring -
Optional ingest processor tag for Elasticsearch
-
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
condition -
steps -
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
steps -
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
steps -
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
customIdentifierstring -
settingsobjectrequired -
index.number_of_replicasobject -
valuenumberrequired -
index.number_of_shardsobject -
valuenumberrequired -
index.refresh_intervalobject -
valuestring | enumrequired -
Values:
-1 -
wiredobjectrequired -
draftboolean -
fieldsobjectrequired -
routingobjectrequired -
destinationstring · min: 1required -
A non-empty string.
-
draftboolean -
status -
Values:
enableddisabled -
where -
The root condition object. It can be a simple filter or a combination of other conditions.
-
and -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
or -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
not -
The root condition object. It can be a simple filter or a combination of other conditions.
-
neverobjectrequired -
An empty object. This condition never matches.
-
alwaysobjectrequired -
An empty object. This condition always matches.
-
query_streamsobject -
namestringrequired -
type -
Values:
wired
Grok processor - Extract fields from text using grok patterns
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
Dissect processor - Extract fields from text using a lightweight, delimiter-based parser
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
URI parts processor - Parse a URI into components (scheme, domain, port, path, query, fragment, ...)
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
Date processor - Parse dates from strings using one or more expected formats
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
Rename processor - Change a field name and optionally its location
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
Set processor - Assign a literal or copied value to a field (mutually exclusive inputs)
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
Append processor - Append one or more values to an existing or new array field
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
Remove by prefix processor - Remove a field and all nested fields matching the prefix
Remove processor - Delete one or more fields from the document
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
Redact processor - Mask sensitive data using Grok patterns
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
Split processor - Split a field value into an array using a separator
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
Convert processor - Change the data type of a field value (integer, long, double, boolean, or string)
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
JsonExtract processor - Extract values from JSON strings using JSONPath-like selectors
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
User agent processor - Extract browser, OS, and device details from a user agent string
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
Registered domain processor - extracts domain, registered_domain, top_level_domain, subdomain from a FQDN
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
Manual ingest pipeline wrapper around native Elasticsearch processors
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A logical AND that groups multiple conditions.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A logical OR that groups multiple conditions.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A logical NOT that negates a condition.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
-
dashboardsstringrequired -
rulesstringrequired -
streamobjectrequired -
descriptionstringrequired -
ingestobjectrequired -
classicobjectrequired -
field_overridesobject -
failure_store -
lifecycle -
dslobjectrequired -
data_retentionstring · min: 1 -
A non-empty string.
-
downsampleobject -
afterstring · min: 1required -
A non-empty string.
-
fixed_intervalstring · min: 1required -
A non-empty string.
-
frozen_afterstring · min: 1 -
A non-empty string.
-
inheritobjectrequired -
processinganyOfrequired -
steps -
processorsstring to objectrequired -
settingsobjectrequired -
index.number_of_replicasobject -
valuenumberrequired -
index.number_of_shardsobject -
valuenumberrequired -
index.refresh_intervalobject -
valuestring | enumrequired -
Values:
-1 -
query_streamsobject -
namestringrequired -
type -
Values:
classic
-
dashboardsstringrequired -
rulesstringrequired -
streamobjectrequired -
descriptionstringrequired -
field_descriptionsmap string to string -
query_streamsobject -
namestringrequired -
type -
Values:
query
Response
The stream was created or updated successfully.