# Can I create ingest processor to do some action like append tags or insert an alert to other index when a document match some conditions

**URL:** <https://discuss.elastic.co/t/can-i-create-ingest-processor-to-do-some-action-like-append-tags-or-insert-an-alert-to-other-index-when-a-document-match-some-conditions/276999>\
**Category:** Elasticsearch\
**Tags:** ingest-pipeline\
**Created:** [June 25, 2021, 2:53am UTC](https://discuss.elastic.co/t/can-i-create-ingest-processor-to-do-some-action-like-append-tags-or-insert-an-alert-to-other-index-when-a-document-match-some-conditions/276999 "2021-06-25T02:53:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ndhcoder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ndhcoder/32/63850_2.png) [@ndhcoder](https://discuss.elastic.co/u/ndhcoder)\
**Post date:** [June 25, 2021, 2:53am UTC](https://discuss.elastic.co/t/can-i-create-ingest-processor-to-do-some-action-like-append-tags-or-insert-an-alert-to-other-index-when-a-document-match-some-conditions/276999/1 "2021-06-25T02:53:40Z")

</div>

Hello everyone, Have a nice day !  
I have a problem,  
Can I create ingest processor to do some action like append tags or insert an alert to other index when a document match some conditions ?

Example:  
I want to get some conditions from my config like:  
if "message" contains "some text" and "age" \> 18 then trigger an alert to "alerts" index and append "18+" to field "tags" on this document.

Thanks all.

---

<div class="post-metadata">

**Author:** ![ndhcoder](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ndhcoder/32/63850_2.png) [@ndhcoder](https://discuss.elastic.co/u/ndhcoder)\
**Post date:** [June 28, 2021, 1:49am UTC](https://discuss.elastic.co/t/can-i-create-ingest-processor-to-do-some-action-like-append-tags-or-insert-an-alert-to-other-index-when-a-document-match-some-conditions/276999/2 "2021-06-28T01:49:31Z")

</div>

hello

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 28, 2021, 1:59am UTC](https://discuss.elastic.co/t/can-i-create-ingest-processor-to-do-some-action-like-append-tags-or-insert-an-alert-to-other-index-when-a-document-match-some-conditions/276999/3 "2021-06-28T01:59:09Z")

</div>

Why not use the Alerting functionality in the stack to do that?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 28, 2021, 6:13am UTC](https://discuss.elastic.co/t/can-i-create-ingest-processor-to-do-some-action-like-append-tags-or-insert-an-alert-to-other-index-when-a-document-match-some-conditions/276999/4 "2021-06-28T06:13:50Z")

</div>

Ingest processors can alter the event so it is possible to add a tag. You can however not spawn new documents for other indices. For that you might need to use Logstash which has that capability through the clone filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 26, 2021, 6:14am UTC](https://discuss.elastic.co/t/can-i-create-ingest-processor-to-do-some-action-like-append-tags-or-insert-an-alert-to-other-index-when-a-document-match-some-conditions/276999/5 "2021-07-26T06:14:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.