IssueRaiser

[Ingest Pipeline] Ability to split documents

It is common for tools to output data in a combined format where one document may contain several entities. For example, a tool that scans several hosts for compliance or vulnerabilities or an API that provides an update to every train/bus etc. We really want to split all entities out to separate docs while copying some high-level information. This is possible using Logstash and the Split filter but not possible with Ingest Pipelines. The feature would allow this kind of document to be processed and split without having to include Logstash in the ingest chain.

Posted by m-adams on May 14, 2020, 1:23 PM

Tags

Related issues

Raise real-world problems, find people facing the same issue, and discuss solutions.3,500 issues0 comments

github (Other)

[Ingest Pipeline] Ability to split documents

m-adamsMay 14, 2020, 1:23 PM

It is common for tools to output data in a combined format where one document may contain several entities. For example, a tool that scans several hosts for compliance or vulnerabilities or an API that provides an update to every train/bus etc. We really want to split all entities out to separate docs while copying some high-level information. This is possible using Logstash and the Split filter but not possible with Ingest Pipelines. The feature would allow this kind of document to be processed and split without having to include Logstash in the ingest chain.

Comments (0)

No comments yet. Start the discussion.

Comment on this issue