Get ingest stream settings

Base URL: https://{kibana_url}

GET /api/streams/{name}/_ingest
GET /s/{space_id}/api/streams/{name}/_ingest

Refer to Spaces for more information.

Fetches the ingest settings of an ingest stream definition

Required authorization

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Request body

Response

200

Ingest settings for the stream.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/streams/NAME/_ingest
{}

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/streams/${NAME}/_ingest" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{}'

Generated from the API spec

Response

{
  "ingest": {
    "failure_store": {
      "inherit": {}
    },
    "lifecycle": {
      "inherit": {}
    },
    "processing": {
      "steps": [
        {
          "action": "grok",
          "from": "message",
          "ignore_missing": false,
          "patterns": [
            "%{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \\[%{HTTPDATE:@timestamp}\\] \u0022%{WORD:http.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}\u0022 %{NUMBER:http.response.status_code:int} (?:%{NUMBER:http.response.body.bytes:int}|-)"
          ]
        }
      ],
      "updated_at": "2025-01-15T10:30:00.000Z"
    },
    "settings": {},
    "wired": {
      "fields": {
        "client.ip": {
          "type": "ip"
        },
        "http.method": {
          "type": "keyword"
        },
        "http.response.body.bytes": {
          "type": "long"
        },
        "http.response.status_code": {
          "type": "long"
        },
        "url.original": {
          "type": "wildcard"
        }
      },
      "routing": [
        {
          "destination": "logs.nginx.errors",
          "status": "enabled",
          "where": {
            "field": "http.response.status_code",
            "gte": 500
          }
        }
      ]
    }
  }
}