--- type: api title: Update ingest stream settings description: **Spaces method and path for this operation:** url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-put-streams-name-ingest resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-put-streams-name-ingest products: - Kibana --- # Update ingest stream settings Availability: 9.1+ - Server: `https://{kibana_url}` ## Paths - `PUT` `/api/streams/{name}/_ingest` - `PUT` `/s/{space_id}/api/streams/{name}/_ingest` - [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth) - [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth) #### Path Parameters - `name` (string · max: 200) The name of the stream. ## Description Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. Upserts the ingest settings of an ingest stream definition

[Required authorization] Route required privileges: manage_stream. ## Request Body `application/json` - `ingest` (union anyOf) — required - **{ wired }** - `failure_store` (union) — required - **{ inherit }** - `inherit` (object) — required - **{ disabled }** - `disabled` (object) — required - **object** - `lifecycle` (object) — required - `enabled` (object) — required - `data_retention` (string · min: 1) — optional A non-empty string. - **object** - `lifecycle` (object) — required - `disabled` (object) — required - `lifecycle` (union) — required - **{ dsl }** - `dsl` (object) — required - `data_retention` (string · min: 1) — optional A non-empty string. - `downsample` ([] object) — optional - `after` (string · min: 1) — required A non-empty string. - `fixed_interval` (string · min: 1) — required A non-empty string. - `frozen_after` (string · min: 1) — optional A non-empty string. - **{ ilm }** - `ilm` (object) — required - `policy` (string · min: 1) — required A non-empty string. - **{ inherit }** - `inherit` (object) — required - `processing` (object) — required - `steps` ([] union) — required - **action: grok** Grok processor - Extract fields from text using grok patterns - `action` (enum) — required Values: `grok` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required Source field to parse with grok patterns - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip processing when source field is missing - `pattern_definitions` (map string to string) — optional - `patterns` ([] string · min: 1) — required Grok patterns applied in order to extract fields - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: grok` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: grok` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: grok` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: dissect** Dissect processor - Extract fields from text using a lightweight, delimiter-based parser - `action` (enum) — required Values: `dissect` - `append_separator` (string · min: 1) — optional Separator inserted when target fields are concatenated - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required Source field to parse with dissect pattern - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip processing when source field is missing - `pattern` (string · min: 1) — required Dissect pattern describing field boundaries - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: dissect` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: dissect` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: dissect` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: uri_parts** URI parts processor - Parse a URI into components (scheme, domain, port, path, query, fragment, ...) - `action` (enum) — required Values: `uri_parts` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required Source field holding the URI string to parse - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip processing when source field is missing - `keep_original` (boolean) — optional If true (default), preserve the original URI string alongside the extracted parts - `remove_if_successful` (boolean) — optional If true, remove the source field after a successful parse. Source field is kept on failure. - `to` (string · min: 1) — optional Target field / column prefix for the extracted URI components (defaults to "url"). May equal `from` — the canonical ECS shape parses the `url` field in place. Note: combining `to === from` with `remove_if_successful: true` nulls the parsed object after writing it. - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: uri_parts` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: uri_parts` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: uri_parts` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: date** Date processor - Parse dates from strings using one or more expected formats - `action` (enum) — required Values: `date` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `formats` ([] string) — required Accepted input date formats, tried in order - `from` (string · min: 1) — required Source field containing the date/time text - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `locale` (string · min: 1) — optional Optional locale for date parsing - `output_format` (string · min: 1) — optional Optional output format for storing the parsed date as text - `timezone` (string · min: 1) — optional Optional timezone for date parsing - `to` (string · min: 1) — optional Target field for the parsed date (defaults to source) - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: date` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: date` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: date` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: drop_document** - `action` (enum) — required Values: `drop_document` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: drop_document` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: drop_document` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: drop_document` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: math** - `action` (enum) — required Values: `math` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `expression` (string · min: 1) — required A non-empty string. - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional - `to` (string · min: 1) — required - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: math` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: math` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: math` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: rename** Rename processor - Change a field name and optionally its location - `action` (enum) — required Values: `rename` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required Existing source field to rename or move - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip when source field is missing - `override` (boolean) — optional Allow overwriting the target field if it already exists - `to` (string · min: 1) — required New field name or destination path - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: rename` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: rename` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: rename` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: set** Set processor - Assign a literal or copied value to a field (mutually exclusive inputs) - `action` (enum) — required Values: `set` - `copy_from` (string · min: 1) — optional Copy value from another field instead of providing a literal - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `override` (boolean) — optional Allow overwriting an existing target field - `to` (string · min: 1) — required Target field to set or create - `value` (object) — optional Literal value to assign to the target field - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: set` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: set` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: set` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: append** Append processor - Append one or more values to an existing or new array field - `action` (enum) — required Values: `append` - `allow_duplicates` (boolean) — optional If true, do not deduplicate appended values - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `to` (string · min: 1) — required Array field to append values to - `value` ([] object · min: 1) — required Values to append (must be literal, no templates) - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: append` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: append` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: append` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: remove_by_prefix** Remove by prefix processor - Remove a field and all nested fields matching the prefix - `action` (enum) — required Values: `remove_by_prefix` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required Field to remove along with all its nested fields - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - **action: remove** Remove processor - Delete one or more fields from the document - `action` (enum) — required Values: `remove` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required Field to remove from the document - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip processing when source field is missing - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: remove` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: remove` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: remove` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: replace** - `action` (enum) — required Values: `replace` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional - `pattern` (string · min: 1) — required - `replacement` (string) — required - `to` (string · min: 1) — optional - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: replace` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: replace` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: replace` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: redact** Redact processor - Mask sensitive data using Grok patterns - `action` (enum) — required Values: `redact` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required Source field to redact sensitive data from - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip processing when source field is missing (defaults to true) - `pattern_definitions` (map string to string) — optional Custom pattern definitions to use in the patterns - `patterns` ([] string · min: 1) — required Grok patterns to match sensitive data (for example, "%{IP:client}", "%{EMAILADDRESS:email}") - `prefix` (string) — optional Prefix to prepend to the redacted pattern name (defaults to "<") - `suffix` (string) — optional Suffix to append to the redacted pattern name (defaults to ">") - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: redact` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: redact` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: redact` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: uppercase** - `action` (enum) — required Values: `uppercase` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional - `to` (string · min: 1) — optional - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: uppercase` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: uppercase` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: uppercase` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: lowercase** - `action` (enum) — required Values: `lowercase` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional - `to` (string · min: 1) — optional - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: lowercase` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: lowercase` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: lowercase` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: trim** - `action` (enum) — required Values: `trim` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional - `to` (string · min: 1) — optional - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: trim` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: trim` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: trim` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: join** - `action` (enum) — required Values: `join` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `delimiter` (string) — required - `description` (string) — optional Human-readable notes about this processor step - `from` ([] string · min: 1) — required - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional - `to` (string · min: 1) — required - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: join` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: join` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: join` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: split** Split processor - Split a field value into an array using a separator - `action` (enum) — required Values: `split` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required Source field to split into an array - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip processing when source field is missing - `preserve_trailing` (boolean) — optional Preserve empty trailing fields in the split result - `separator` (string · min: 1) — required Regex separator used to split the field value into an array - `to` (string · min: 1) — optional Target field for the split array (defaults to source) - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: split` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: split` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: split` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: sort** - `action` (enum) — required Values: `sort` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required Array field to sort - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip processing when source field is missing - `order` (enum) — optional Sort order - "asc" (ascending) or "desc" (descending). Defaults to "asc" Values: `asc`, `desc` - `to` (string · min: 1) — optional Target field for the sorted array (defaults to source) - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: sort` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: sort` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: sort` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: convert** Convert processor - Change the data type of a field value (integer, long, double, boolean, or string) - `action` (enum) — required Values: `convert` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` (string · min: 1) — required Source field to convert to a different data type - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip processing when source field is missing - `to` (string · min: 1) — optional Target field for the converted value (defaults to source) - `type` (enum) — required Target data type: integer, long, double, boolean, or string Values: `integer`, `long`, `double`, `boolean`, `string` - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: convert` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: convert` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: convert` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: concat** - `action` (enum) — required Values: `concat` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `from` ([] union anyOf · min: 1) — required - **type: field** - `type` (enum) — required Values: `field` - `value` (string · min: 1) — required - **type: literal** - `type` (enum) — required Values: `literal` - `value` (string) — required - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional - `to` (string · min: 1) — required - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: concat` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: concat` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: concat` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: network_direction** - `action` (enum) — required Values: `network_direction` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `destination_ip` (string · min: 1) — required - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional - `source_ip` (string · min: 1) — required - `target_field` (string · min: 1) — optional - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: network_direction` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: network_direction` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: network_direction` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: json_extract** JsonExtract processor - Extract values from JSON strings using JSONPath-like selectors - `action` (enum) — required Values: `json_extract` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `extractions` ([] object · min: 1) — required List of extraction specifications - `selector` (string · min: 1) — required JSONPath-like selector to extract value (e.g., "user.id", "$.metadata.client.ip", "items[0].name") - `target_field` (string · min: 1) — required Target field to store the extracted value - `type` (enum) — optional Data type for the extracted value. Defaults to "keyword". Ensures consistent types across transpilers. Values: `keyword`, `integer`, `long`, `double`, `boolean` - `field` (string · min: 1) — required Source field containing the JSON string to parse - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip processing when source field is missing - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: json_extract` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: json_extract` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: json_extract` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: enrich** - `action` (enum) — required Values: `enrich` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional - `override` (boolean) — optional - `policy_name` (string · min: 1) — required A non-empty string. - `to` (string · min: 1) — required - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: enrich` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: enrich` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: enrich` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: user_agent** User agent processor - Extract browser, OS, and device details from a user agent string - `action` (enum) — required Values: `user_agent` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `extract_device_type` (boolean) — optional Extracts device type from the user agent string - `from` (string · min: 1) — required The field containing the user agent string - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip processing when source field is missing - `properties` ([] enum) — optional Specific properties to extract (defaults to all) Values: `name`, `os`, `device`, `original`, `version` - `regex_file` (string · min: 1) — optional Custom regex file name containing the regular expressions for parsing the user agent string - `to` (string · min: 1) — optional The field that will be filled with the user agent details - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: user_agent` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: user_agent` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: user_agent` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: registered_domain** Registered domain processor - extracts domain, registered_domain, top_level_domain, subdomain from a FQDN - `action` (enum) — required Values: `registered_domain` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `expression` (string · min: 1) — required The string expression containing the FQDN to parse - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `ignore_missing` (boolean) — optional Skip processing when expression field is missing - `prefix` (string · min: 1) — required The prefix for the output columns. The extracted parts are available as prefix.part_name - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: registered_domain` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: registered_domain` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: registered_domain` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **action: manual_ingest_pipeline** Manual ingest pipeline wrapper around native Elasticsearch processors - `action` (enum) — required Manual ingest pipeline - executes raw Elasticsearch ingest processors Values: `manual_ingest_pipeline` - `customIdentifier` (string · min: 1) — optional Custom identifier to correlate this processor across outputs - `description` (string) — optional Human-readable notes about this processor step - `ignore_failure` (boolean) — optional Continue pipeline execution if this processor fails - `on_failure` ([] string to object) — optional Fallback processors to run when a processor fails - `processors` ([] string to object) — required List of raw Elasticsearch ingest processors to run - `tag` (string) — optional Optional ingest processor tag for Elasticsearch - `where` (union) — optional The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `action: manual_ingest_pipeline` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `action: manual_ingest_pipeline` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `action: manual_ingest_pipeline` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **StreamlangConditionBlock** - `condition` (union) — required - **FilterCondition** A basic filter condition, either unary or binary. - `else` ([] union) — optional — recursive Same options as `steps` in `processing` - `steps` ([] union) — required — recursive Same options as `steps` in `processing` - **{ and }** A logical AND that groups multiple conditions. - `else` ([] union) — optional — recursive Same options as `steps` in `processing` - `steps` ([] union) — required — recursive Same options as `steps` in `processing` - `and` ([] union) — required An array of conditions. All sub-conditions must be true for this condition to be true. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `and` in `{ and }` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `and` in `{ and }` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `and` in `{ and }` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **{ or }** A logical OR that groups multiple conditions. - `else` ([] union) — optional — recursive Same options as `steps` in `processing` - `steps` ([] union) — required — recursive Same options as `steps` in `processing` - `or` ([] union) — required An array of conditions. At least one sub-condition must be true for this condition to be true. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `or` in `{ or }` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `or` in `{ or }` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `or` in `{ or }` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **{ not }** A logical NOT that negates a condition. - `else` ([] union) — optional — recursive Same options as `steps` in `processing` - `steps` ([] union) — required — recursive Same options as `steps` in `processing` - `not` (union) — required The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `not` in `{ not }` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `not` in `{ not }` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `not` in `{ not }` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **{ never }** A condition that always evaluates to false. - `else` ([] union) — optional — recursive Same options as `steps` in `processing` - `steps` ([] union) — required — recursive Same options as `steps` in `processing` - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `else` ([] union) — optional — recursive Same options as `steps` in `processing` - `steps` ([] union) — required — recursive Same options as `steps` in `processing` - `always` (object) — required An empty object. This condition always matches. - `customIdentifier` (string) — optional - `settings` (object) — required - `index.number_of_replicas` (object) — optional - `value` (number) — required - `index.number_of_shards` (object) — optional - `value` (number) — required - `index.refresh_interval` (object) — optional - `value` (union string | enum) — required Values: `-1` - `wired` (object) — required - `draft` (boolean) — optional - `fields` (object) — required - `routing` ([] object) — required - `destination` (string · min: 1) — required A non-empty string. - `draft` (boolean) — optional - `status` (enum) — optional Values: `enabled`, `disabled` - `where` (union) — required The root condition object. It can be a simple filter or a combination of other conditions. - **FilterCondition** A basic filter condition, either unary or binary. - **{ and }** A logical AND that groups multiple conditions. - `and` ([] union) — required — recursive An array of conditions. All sub-conditions must be true for this condition to be true. Same options as `where` in `routing` - **{ or }** A logical OR that groups multiple conditions. - `or` ([] union) — required — recursive An array of conditions. At least one sub-condition must be true for this condition to be true. Same options as `where` in `routing` - **{ not }** A logical NOT that negates a condition. - `not` (union) — required — recursive The root condition object. It can be a simple filter or a combination of other conditions. Same options as `where` in `routing` - **{ never }** A condition that always evaluates to false. - `never` (object) — required An empty object. This condition never matches. - **{ always }** A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered. - `always` (object) — required An empty object. This condition always matches. - **{ classic }** - `classic` (object) — required - `field_overrides` (object) — optional - `failure_store` (union) — required - **{ inherit }** - `inherit` (object) — required - **{ disabled }** - `disabled` (object) — required - **object** - `lifecycle` (object) — required - `enabled` (object) — required - `data_retention` (string · min: 1) — optional A non-empty string. - **object** - `lifecycle` (object) — required - `disabled` (object) — required - `lifecycle` (union) — required - **{ dsl }** - `dsl` (object) — required - `data_retention` (string · min: 1) — optional A non-empty string. - `downsample` ([] object) — optional - `after` (string · min: 1) — required A non-empty string. - `fixed_interval` (string · min: 1) — required A non-empty string. - `frozen_after` (string · min: 1) — optional A non-empty string. - **{ ilm }** - `ilm` (object) — required - `policy` (string · min: 1) — required A non-empty string. - **{ inherit }** - `inherit` (object) — required - `processing` (union anyOf) — required - **{ steps }** - `steps` ([] union) — required Same options as `steps` in `processing` - **{ processors }** - `processors` ([] string to object) — required - `settings` (object) — required - `index.number_of_replicas` (object) — optional - `value` (number) — required - `index.number_of_shards` (object) — optional - `value` (number) — required - `index.refresh_interval` (object) — optional - `value` (union string | enum) — required Values: `-1` ## Response The ingest settings were updated successfully. ## Code Examples #### Console ```console PUT /api/streams/{name}/_ingest { "ingest": { "failure_store": { "inherit": {} }, "lifecycle": { "inherit": {} }, "processing": { "steps": [ { "action": "grok", "from": "message", "ignore_missing": false, "patterns": [ "%{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \\[%{HTTPDATE:@timestamp}\\] \u0022%{WORD:http.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}\u0022 %{NUMBER:http.response.status_code:int} (?:%{NUMBER:http.response.body.bytes:int}|-)" ] } ] }, "settings": {}, "wired": { "fields": { "client.ip": { "type": "ip" }, "http.method": { "type": "keyword" }, "http.response.body.bytes": { "type": "long" }, "http.response.status_code": { "type": "long" }, "url.original": { "type": "wildcard" } }, "routing": [ { "destination": "logs.nginx.errors", "status": "enabled", "where": { "eq": "500", "field": "http.response.status_code" } } ] } } } ``` #### curl ```curl curl -X PUT "https://{kibana_url}/api/streams/{name}/_ingest" \ -H "kbn-xsrf: true" \ -H "Content-Type: application/json" \ -d '{ "ingest": { "failure_store": { "inherit": {} }, "lifecycle": { "inherit": {} }, "processing": { "steps": [ { "action": "grok", "from": "message", "ignore_missing": false, "patterns": [ "%{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \\[%{HTTPDATE:@timestamp}\\] \u0022%{WORD:http.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}\u0022 %{NUMBER:http.response.status_code:int} (?:%{NUMBER:http.response.body.bytes:int}|-)" ] } ] }, "settings": {}, "wired": { "fields": { "client.ip": { "type": "ip" }, "http.method": { "type": "keyword" }, "http.response.body.bytes": { "type": "long" }, "http.response.status_code": { "type": "long" }, "url.original": { "type": "wildcard" } }, "routing": [ { "destination": "logs.nginx.errors", "status": "enabled", "where": { "eq": "500", "field": "http.response.status_code" } } ] } } }' ```