Create or update a stream
- Base URL
-
https://{kibana_url}
- PUT /api/streams/{name}
Creates or updates a stream definition. Classic streams can not be created through this API, only updated
Required authorization
- Privileges manage_stream
Authentication
Authorization: <value>These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey
Authorization: Basic <credentials>Request body
-
streamobjectrequired -
ingestobjectrequired -
processingobjectrequired -
stepsunion anyOf[]required - Any of:
-
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: grok -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: grok -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: grok -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: dissect -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: dissect -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: dissect -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
keep_originalboolean -
If true (default), preserve the original URI string alongside the extracted parts
-
remove_if_successfulboolean -
If true, remove the source field after a successful parse. Source field is kept on failure.
-
tostring · min length: 1 -
Target field / column prefix for the extracted URI components (defaults to "url"). May equal
from— the canonical ECS shape parses theurlfield in place. Note: combiningto === fromwithremove_if_successful: truenulls the parsed object after writing it. -
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: uri_parts -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: uri_parts -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: uri_parts -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: date -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: date -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: date -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: drop_document -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: drop_document -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: drop_document -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: math -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: math -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: math -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: rename -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: rename -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: rename -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: set -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: set -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: set -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: append -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: append -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: append -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: remove -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: remove -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: remove -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: replace -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: replace -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: replace -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
patternsstring[] · min items: 1required -
Grok patterns to match sensitive data (for example, "%{IP:client}", "%{EMAILADDRESS:email}")
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: redact -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: redact -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: redact -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: uppercase -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: uppercase -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: uppercase -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: lowercase -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: lowercase -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: lowercase -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: trim -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: trim -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: trim -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: join -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: join -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: join -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
separatorstring · min length: 1required -
Regex separator used to split the field value into an array
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: split -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: split -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: split -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
orderenum -
Sort order - "asc" (ascending) or "desc" (descending). Defaults to "asc"
-
Values:
ascdesc -
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: sort -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: sort -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: sort -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
typeenumrequired -
Target data type: integer, long, double, boolean, or string
-
Values:
integerlongdoublebooleanstring -
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: convert -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: convert -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: convert -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: concat -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: concat -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: concat -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: network_direction -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: network_direction -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: network_direction -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: json_extract -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: json_extract -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: json_extract -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: enrich -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: enrich -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: enrich -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
propertiesenum[] -
Specific properties to extract (defaults to all)
-
Values:
nameosdeviceoriginalversion -
regex_filestring · min length: 1 -
Custom regex file name containing the regular expressions for parsing the user agent string
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: user_agent -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: user_agent -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: user_agent -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
prefixstring · min length: 1required -
The prefix for the output columns. The extracted parts are available as prefix.part_name
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: registered_domain -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: registered_domain -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: registered_domain -
actionenumrequired -
Manual ingest pipeline - executes raw Elasticsearch ingest processors
-
Values:
manual_ingest_pipeline -
customIdentifierstring · min length: 1 -
Custom identifier to correlate this processor across outputs
-
whereunion anyOf -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinaction: manual_ingest_pipeline -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinaction: manual_ingest_pipeline -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinaction: manual_ingest_pipeline -
conditionunion anyOfrequired - Any of:
-
elseunion anyOf[] -
Same options as
stepsinprocessing -
stepsunion anyOf[]required -
Same options as
stepsinprocessing -
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
andin{ and } -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
andin{ and } -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
andin{ and } -
elseunion anyOf[] -
Same options as
stepsinprocessing -
stepsunion anyOf[]required -
Same options as
stepsinprocessing -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
orin{ or } -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
orin{ or } -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
orin{ or } -
elseunion anyOf[] -
Same options as
stepsinprocessing -
stepsunion anyOf[]required -
Same options as
stepsinprocessing -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
notin{ not } -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
notin{ not } -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
notin{ not } -
wiredobjectrequired -
routingobject[]required -
whereunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
- Any of:
-
andunion anyOf[]required -
An array of conditions. All sub-conditions must be true for this condition to be true.
-
Same options as
whereinrouting -
orunion anyOf[]required -
An array of conditions. At least one sub-condition must be true for this condition to be true.
-
Same options as
whereinrouting -
notunion anyOfrequired -
The root condition object. It can be a simple filter or a combination of other conditions.
-
Same options as
whereinrouting
Grok processor - Extract fields from text using grok patterns
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Dissect processor - Extract fields from text using a lightweight, delimiter-based parser
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
URI parts processor - Parse a URI into components (scheme, domain, port, path, query, fragment, ...)
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Date processor - Parse dates from strings using one or more expected formats
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Rename processor - Change a field name and optionally its location
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Set processor - Assign a literal or copied value to a field (mutually exclusive inputs)
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Append processor - Append one or more values to an existing or new array field
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Remove by prefix processor - Remove a field and all nested fields matching the prefix
Remove processor - Delete one or more fields from the document
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Redact processor - Mask sensitive data using Grok patterns
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Split processor - Split a field value into an array using a separator
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Convert processor - Change the data type of a field value (integer, long, double, boolean, or string)
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
JsonExtract processor - Extract values from JSON strings using JSONPath-like selectors
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
User agent processor - Extract browser, OS, and device details from a user agent string
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Registered domain processor - extracts domain, registered_domain, top_level_domain, subdomain from a FQDN
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Manual ingest pipeline wrapper around native Elasticsearch processors
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A logical OR that groups multiple conditions.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A logical NOT that negates a condition.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
A condition that always evaluates to false.
A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
A basic filter condition, either unary or binary.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
-
streamobjectrequired -
ingestobjectrequired -
processingunion anyOfrequired - Any of:
-
stepsunion anyOf[]required -
Same options as
stepsinprocessing
Response
The stream was created or updated successfully.