Ingest pipeline add field with date in the future

Elastic Stack Elasticsearch
1

Via an ingest pipeline using a processor such as a script (similar to this) or another processor is it simple to add a field with the date x days (a field on the ingested doc) after its ingested.

Such that a doc

field: somedata
SLA: 14

has a field 'overdue' that is the date x days (in this example 14) from when its ingested

field: somedata
SLA: 14
overdue: x/x/21

Cheers

2

So replying to my own question again, Not tested but through digging around this is likely to be possible via the use of a script processor.

Get the field convert to millis, Instant, ZTD, then on that ZTD object a function .plusHours(x) or plusDays(x) etc ctx.SLA = ZTD object then set it as a field with the set processor.

Im sure this can be made more efficient but as a baseline this should achieve the result.

Cheers me.

3

This looks correct. Depending on the type of time stamp you could go with ZonedDateTime.parse directly or have your own custom date formatter, that can also be used to write out the date as a string again.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.