"target_prefix" equivalent for ingest pipeline?

Elastic Stack Elasticsearch
1

The filebeat dissect processor has a handy "target_prefix" option, which allows everything it extracts to be placed under a common prefix.

Is there any equivalent for the dissect or grok processors in an ingest pipeline, or an easy way to accomplish the same thing for a grok pattern that's made up of a bunch of pattern definitions?

2

I don't think so, there is nothing in the documentation for the dissect and grok processors.

The dissect and grok processors on an Ingest pipeline works similar to the same filters on a Logstash pipeline, where also there is no target_prefix to store the fields on a top-level field.

If you need to store it on a top-level field as a prefix you will need to directly add the prefix on the fields names, for example, instead of fieldName you will need to use prefix.fieldName.

3

Thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.