Use ctx in if condition is always null_pointer_exception

[HiganFish (lsmg)]

PUT _ingest/pipeline/test1
{
  "processors": [
    {"dissect": {
      "field": "message",
      "pattern": "%{logdata}"
    }}
  ]
}

POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "dissect": {
          "field": "message",
          "pattern": "%{num1}"
        },
        "pipeline": {
          "name": "test1",
          "if": "ctx._source.num == '123'"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": "123"
      }
    }
  ]
}

I want to use the variable which generated by dissect or grok in if condition to use pipeline test1.

{
  "docs" : [
    {
      "error" : {
        "root_cause" : [
          {
            "type" : "script_exception",
            "reason" : "runtime error",
            "script_stack" : [
              "ctx._source.num == '123'",
              "           ^---- HERE"
            ],
            "script" : "ctx._source.num == '123'",
            "lang" : "painless",
            "position" : {
              "offset" : 11,
              "start" : 0,
              "end" : 24
            }
          }
        ],
        "type" : "script_exception",
        "reason" : "runtime error",
        "script_stack" : [
          "ctx._source.num == '123'",
          "           ^---- HERE"
        ],
        "script" : "ctx._source.num == '123'",
        "lang" : "painless",
        "position" : {
          "offset" : 11,
          "start" : 0,
          "end" : 24
        },
        "caused_by" : {
          "type" : "null_pointer_exception",
          "reason" : null
        }
      }
    }
  ]
}

But it will give an error.

How should i use it.

[stephenb (Stephen Brown)]

(edited) So a couple of items

There is no ctx._source in ingest pipelines

See: here

that's the ssue, you should just remove ._source

so perhaps try...

"if": "ctx.num == '123'"

Also just in case you are interesting in null safety

Ingest pipelines | Elasticsearch Guide [8.11] | Elastic

Incoming documents often contain object fields. If a processor script attempts to access a field whose parent object does not exist, Elasticsearch returns a NullPointerException. To avoid these exceptions, use null safe operators, such as ?., and write your scripts to be null safe.

For example, ctx.network?.name.equalsIgnoreCase('Guest') is not null safe. ctx.network?.name can return null. Rewrite the script as 'Guest'.equalsIgnoreCase(ctx.network?.name), which is null safe because Guest is always non-null.

If you can’t rewrite a script to be null safe, include an explicit null check.

Also I did notice that above you name the field num1 so that could also be a problem as well

"pattern": "%{num1}"