Foreach Ingest processor + condition

Please advice. I have documents with fields looks like this

"something": "some value",
 "outdated_products": [
        "product": "Google Chrome earlier than 101.0.1034.124"
  "software": [
         "Google Chrome",
         "Mozilla Firefox"

I need to add field 'used: True' if one item of array "software" contained in "outdated_products"
That's what i did:
I added foreach ingest processor with following settings

      "foreach": {
        "field": "software",
        "processor": {
          "set": {
            "field": "used",
            "value": "true"
        "if": "ctx.outdated_products[0].product.contains('_ingest._value')",
        "ignore_failure": true

but nothing happens. If I add value of software directly instead of '_ingest._value' everything works fine. Where I'm wrong?

you seem to be hitting this bug Can not access _ingest metadata from painless scripting · Issue #60470 · elastic/elasticsearch · GitHub
-> _ingest._value is not added in the painless context, thus unavailable in the if

  • set an (inconditional) temporary field in the foreach as suggested in the issue, and use it in a later set processor
  • make a script instead of the foreach (if you're comfortable with java/painless)

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.