Multiple foreach processors on array of JSON

Elastic Stack Elasticsearch
1

In the docs for the foreach processor, it says "The foreach processor does restore the original value, so that value is available to processors after the foreach processor." Can someone clarify what this means?

I have this pipeline that works, but based on my reading of the documentation I'm not actually expecting it to work:

{
  "pipeline": {
    "processors": [
      {
        "foreach": {
          "field": "venues",
          "processor": {
            "uppercase": {
              "field": "_ingest._value.venue"
            }
          }
        }
      },
      {
        "foreach": {
          "field": "venues",
          "processor": {
            "gsub": {
              "field": "_ingest._value.venue",
              "pattern": "CHI",
              "replacement": "XXX"
            }
          }
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_type": "type",
      "_id": "id",
      "_source": {
        "body": "blah blah",
        "venues": [
          {
            "id": "1",
            "venue": "Chicago, IL"
          },
          {
            "id": "2",
            "venue": "Washington, D.C."
          }
        ]
      }
    }
  ]
}

In the second foreach, shouldn't _ingest._value.venue be the original value and not the value that got uppercased in the prior foreach?

2

Hey Loren,

the way I understand it (after reading it 5 times in a row :slight_smile: , it works as expected. I think what it is trying to tell is that if you set _ingest._value outside a foreach loop, this value is gonna be restored. For example setting this first and then running your loops, should still work.

      {
        "set": {
          "field": "_ingest._value",
          "value": "foo"
        }
      }

--Alex

3

Thank you @spinscale. Good to know I wasn't the only person scratching my head over it.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.