Ingest pipeline processor split

Elastic Stack Elasticsearch
1

Hi, when I specify the target_field in the split processor I get the following error:

{
   "error": {
      "root_cause": [
         {
            "type": "parse_exception",
            "reason": "processor [split] doesn't support one or more provided configuration parameters [target_field]",
            "header": {
               "processor_type": "split",
               "processor_tag": "splitMessageProcessor"
            }
         }
      ],
      "type": "parse_exception",
      "reason": "processor [split] doesn't support one or more provided configuration parameters [target_field]",
      "header": {
         "processor_type": "split",
         "processor_tag": "splitMessageProcessor"
      }
   },
   "status": 400
}

My test simulation in ES 5.5:

POST _ingest/pipeline/_simulate
{
  "pipeline": {
  "description" : "pipeline for online services",
      "processors": [
        {
          "split": {
            "field": "message",
             "tag": "splitMessageProcessor",
            "separator": "\\s+",
            "target_field": "splitedMessage"
          }
        }
      ]
    },
  "docs": [
    {
      "_source": { "message": "A B C" }
    }
  ]
}

it works without target_field, but I don't want to replace the existing field. Is this an issue?

2

According to the documentation, target_field was introduced in version 5.6. Are you on an older version?

If so, you could first copy the value of message to another field using the set processor and then split that target field. The following should work:

POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "pipeline for online services",
    "processors": [
      {
        "set": {
          "field": "splitedMessage",
          "value": "{{message}}"
        }
      },
      {
        "split": {
          "field": "splitedMessage",
          "tag": "splitMessageProcessor",
          "separator": "\\s+"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": "A B C"
      }
    }
  ]
}
3

ah! yes, I use 5.5

thanks for the work around.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.