[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-ingest-pipelines":3,"mdc--bv06ej-key":36,"related-org-elastic-ingest-pipelines":7261,"related-repo-elastic-ingest-pipelines":7433},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":34,"mdContent":35},"ingest-pipelines","design and modify Elasticsearch ingest pipelines","Use when designing or modifying Elasticsearch ingest pipelines, including single-path parsing, branching logic, sub-pipelines, enrichment processors, and robust on_failure handling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Data Engineering","data-engineering","tag",{"name":17,"slug":18,"type":15},"ETL","etl",{"name":20,"slug":21,"type":15},"Data Pipeline","data-pipeline",{"name":23,"slug":24,"type":15},"Elasticsearch","elasticsearch",11,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills","2026-07-12T07:47:01.44443","Apache-2.0",2,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":33},[],null,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fintegration-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fingest-pipelines","---\nname: ingest-pipelines\ndescription: \"Use when designing or modifying Elasticsearch ingest pipelines, including single-path parsing, branching logic, sub-pipelines, enrichment processors, and robust on_failure handling.\"\nlicense: Apache-2.0\nmetadata:\n  author: elastic\n  version: \"1.0\"\n---\n\n# ingest-pipelines\n\n\n## Skill authority\n\nThe rules and patterns defined in this skill and its reference files are the **authoritative source of truth**. When examining existing integrations in the `elastic\u002Fintegrations` repository for reference, you may encounter patterns that conflict with what is specified here — many integrations contain legacy patterns that predate current standards. **Always follow this skill over patterns observed in other integrations.** If a reference integration uses a deprecated or prohibited pattern, do not copy it.\n\n## When to use\n\nUse this skill when tasks include:\n- building or modifying `elasticsearch\u002Fingest_pipeline\u002Fdefault.yml` for a data stream\n- choosing parser and normalization processors (`grok`, `dissect`, `json`, `kv`, `date`, `convert`)\n- designing conditional branches and sub-pipeline routing with `pipeline` processors\n- implementing resilient error handling with top-level `on_failure`\n- tuning processor order for ingest performance and maintainability\n\n## When not to use\n\nDo not use this skill as the primary guide for:\n- ECS field selection, categorization values, and field mapping strategy (`ecs-field-mappings`)\n- elastic-package command and stack lifecycle workflows (`elastic-package-cli`)\n- test fixture authoring and expected output workflows (`integration-testing` → `references\u002Fpipeline-testing.md`)\n\n## Pipeline anatomy\n\nIn integration packages, ingest pipelines live under:\n\n`data_stream\u002F\u003Cstream>\u002Felasticsearch\u002Fingest_pipeline\u002F`\n\nEvery stream usually has a `default.yml` with:\n- `description`\n- `processors` list\n- optional pipeline-level `on_failure`\n\nKeep `default.yml` readable and focused. Move large format-specific logic into sub-pipelines where needed.\n\n## ECS version\n\nSet the pipeline ECS reference version explicitly at the top of `processors` (after any introductory processors you already use). **Use `9.3.0`** — do not pin an older ECS version.\n\n```yaml\n  - set:\n      field: ecs.version\n      tag: set_ecs_version\n      value: '9.3.0'\n```\n\n## Rename vs set (mapping to ECS)\n\nWhen moving a value from a **custom or vendor field** into an **ECS field**, **prefer the `rename` processor** so the source field is removed and you avoid duplicate data. Use `set` with `copy_from` only when you must keep the source field or when `rename` is not applicable.\n\n## Processor tags\n\n**Every processor** in the pipeline should have a `tag` (not only processors that can fail). Tags make failures and telemetry attributable to a specific step.\n\n## CEL-only opening processors (Agentless metadata and error-only documents)\n\nFor **CEL-based** integrations only, include these **before** the standard `message` → `event.original` handling when they apply:\n\n- **`remove`**: drop Agentless metadata fields (`organization`, `division`, `team`) when all are strings, so they do not collide with ECS. Use `ignore_missing: true` and a conditional `if`.\n- **`terminate`**: stop processing when the document is an error placeholder from the collector (`ctx.error?.message != null && ctx.message == null && ctx.event?.original == null`).\n\n**Non-CEL** integrations (logs, syslog, filebeat-style inputs) **must not** copy this block blindly — those fields and error shapes are specific to the CEL\u002FAgentless path. See the `create-integration` skill: the orchestrator must only expect this block when the data stream uses CEL input.\n\n## Standard opening: ECS, optional CEL block, JSE00001, then parse `event.original`\n\nAfter the optional CEL-only processors, the pipeline should follow this shape. **All parsing** (`json`, `csv`, `grok`, etc.) runs on **`event.original`**. **Never overwrite or mutate `event.original`** in later processors — derive structured fields into other paths (for example `json`, `_temp.*`, ECS fields).\n\n```yaml\ndescription: Parse \u003Cdataset> events.\nprocessors:\n  - set:\n      field: ecs.version\n      tag: set_ecs_version\n      value: '9.3.0'\n\n  # --- CEL input only (omit for log\u002Fsyslog-only streams) ---\n  - remove:\n      field:\n        - organization\n        - division\n        - team\n      ignore_missing: true\n      if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String\n      tag: remove_agentless_tags\n      description: >-\n        Removes the fields added by Agentless as metadata,\n        as they can collide with ECS fields.\n  - terminate:\n      tag: data_collection_error\n      if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null\n      description: error message set and no data to process.\n  # --- end CEL-only ---\n\n  - rename:\n      field: message\n      tag: rename_message_to_event_original\n      target_field: event.original\n      ignore_missing: true\n      description: Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.\n      if: ctx.event?.original == null\n  - remove:\n      field: message\n      tag: remove_message\n      ignore_missing: true\n      description: The `message` field is no longer required if the document has an `event.original` field.\n      if: ctx.event?.original != null\n\n  # Parse (always read from event.original; do not modify event.original)\n  - json:\n      field: event.original\n      target_field: json\n      tag: parse_json\n      if: ctx.event?.original != null\n\n  # ... normalize, enrich, ECS categorization, cleanup ...\n\n  - append:\n      field: tags\n      value: preserve_original_event\n      allow_duplicates: false\n      if: ctx.error?.message != null\n\non_failure:\n  - append:\n      field: error.message\n      value: >-\n        Processor '{{{ _ingest.on_failure_processor_type }}}'\n        {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'\n        {{{\u002F_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}'\n  - set:\n      field: event.kind\n      tag: set_pipeline_error_to_event_kind\n      value: pipeline_error\n  - append:\n      field: tags\n      value: preserve_original_event\n      allow_duplicates: false\n```\n\n## Single-path pattern (linear pipeline)\n\nUse this pattern when one parser flow handles all events. Combine the **standard opening** (ECS version, optional CEL-only block, JSE00001 rename\u002Fremove, parse from `event.original` without mutating it), middle processors with **tags on every step**, and the **pipeline-level `on_failure`** and **conditional `append` for `preserve_original_event`** shown above.\n\nExample middle section (illustrative):\n\n```yaml\n  - grok:\n      field: event.original\n      patterns:\n        - '^...$'\n      tag: parse_main\n\n  - date:\n      field: some.time\n      target_field: '@timestamp'\n      formats: [ISO8601]\n      tag: parse_timestamp\n  - convert:\n      field: http.response.status_code\n      type: long\n      ignore_missing: true\n      tag: convert_status\n\n  - user_agent:\n      field: user_agent.original\n      ignore_missing: true\n      tag: enrich_user_agent\n  - geoip:\n      field: source.ip\n      target_field: source.geo\n      ignore_missing: true\n      tag: enrich_source_geo\n  - geoip:\n      database_file: GeoLite2-ASN.mmdb\n      field: source.ip\n      target_field: source.as\n      properties:\n        - asn\n        - organization_name\n      ignore_missing: true\n      tag: enrich_source_asn\n  - rename:\n      field: source.as.asn\n      target_field: source.as.number\n      ignore_missing: true\n      tag: rename_source_asn\n  - rename:\n      field: source.as.organization_name\n      target_field: source.as.organization.name\n      ignore_missing: true\n      tag: rename_source_as_org\n\n  - set:\n      field: event.kind\n      tag: set_event_kind\n      value: event\n  - append:\n      field: event.category\n      tag: append_event_category_web\n      value: web\n  - remove:\n      field: temp\n      ignore_missing: true\n      tag: remove_temp\n```\n\n## Branching pattern (router + sub-pipelines)\n\nUse branching when event formats or object models diverge:\n- format-based branching (for example JSON vs text)\n- class\u002Fcategory-based branching (for example OCSF class\u002Fcategory routing)\n- object-presence branching (`ctx.ocsf.user != null`)\n\nPattern:\n\n```yaml\nprocessors:\n  - pipeline:\n      name: '{{ IngestPipeline \"pipeline_branch_json\" }}'\n      if: ctx.event?.original != null && ctx.event.original.startsWith('{')\n      ignore_missing_pipeline: true\n      tag: route_json\n  - pipeline:\n      name: '{{ IngestPipeline \"pipeline_branch_text\" }}'\n      if: ctx.event?.original != null && !ctx.event.original.startsWith('{')\n      ignore_missing_pipeline: true\n      tag: route_text\n```\n\nIn large integrations, keep `default.yml` as the router and put branch logic in files like:\n- `pipeline_object_\u003Cname>.yml`\n- `pipeline_category_\u003Cname>.yml`\n\nSee `references\u002Fbranching-patterns.md` for full patterns from `amazon_security_lake`.\n\n## Sub-pipeline routing for multi-log-type integrations\n\nWhen a data stream receives multiple distinct log types (for example a firewall that emits traffic, auth, and DNS logs in the same stream), **do not implement all parsing in a single monolithic `default.yml`**. Use `default.yml` as a thin router that detects the log type and delegates to a dedicated sub-pipeline per type.\n\n### File layout\n\n```text\nelasticsearch\u002Fingest_pipeline\u002F\n  default.yml              # router only — detects log type, calls sub-pipelines\n  pipeline-\u003Ctype>.yml      # one file per log type (e.g. pipeline-traffic.yml)\n```\n\n### Router pattern in `default.yml`\n\nUse the same **`ecs.version`**, **JSE00001** `rename`\u002F`remove` pair for `message`, and **full pipeline-level `on_failure`** as in the standard opening. The router only branches sub-pipelines; it does not parse payloads.\n\n```yaml\nprocessors:\n  - set:\n      field: ecs.version\n      tag: set_ecs_version\n      value: '9.3.0'\n  - rename:\n      field: message\n      tag: rename_message_to_event_original\n      target_field: event.original\n      ignore_missing: true\n      if: ctx.event?.original == null\n  - remove:\n      field: message\n      tag: remove_message\n      ignore_missing: true\n      if: ctx.event?.original != null\n  - pipeline:\n      name: '{{ IngestPipeline \"pipeline-traffic\" }}'\n      if: 'ctx.event?.original != null && ctx.event.original.contains(\"TRAFFIC\")'\n      tag: route_traffic\n  - pipeline:\n      name: '{{ IngestPipeline \"pipeline-auth\" }}'\n      if: 'ctx.event?.original != null && ctx.event.original.contains(\"AUTH\")'\n      tag: route_auth\n  - pipeline:\n      name: '{{ IngestPipeline \"pipeline-dns\" }}'\n      if: 'ctx.event?.original != null && ctx.event.original.contains(\"DNS\")'\n      tag: route_dns\non_failure:\n  - append:\n      field: error.message\n      value: >-\n        Processor '{{{ _ingest.on_failure_processor_type }}}'\n        {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'\n        {{{\u002F_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}'\n  - set:\n      field: event.kind\n      tag: set_pipeline_error_to_event_kind\n      value: pipeline_error\n  - append:\n      field: tags\n      value: preserve_original_event\n      allow_duplicates: false\n```\n\n### Rules\n\n- `default.yml` must contain **only** routing logic and `on_failure` handling — no field parsing.\n- Each sub-pipeline handles parsing, ECS mapping, and categorization for its own log type.\n- Each sub-pipeline must have its own `on_failure` block.\n- Name sub-pipeline files `pipeline-\u003Ctype>.yml` where `\u003Ctype>` matches the log type identifier used in the routing condition.\n- Each log type gets its own pipeline test fixture file following the naming convention `test-\u003Cpackage>-\u003Cdatastream>-\u003Ctype>-sample.log`.\n\n## Processor ordering and performance\n\n- run cheap existence checks before expensive operations\n- drop early if records are out of scope\n- prefer `dissect` over `grok` for stable delimited formats\n- **never use a `script` processor when a built-in processor can do the job** — `set`, `rename`, `remove`, `append`, `convert`, `dissect`, `grok`, `gsub`, `lowercase`, `uppercase`, and `trim` are all faster than Painless and easier to review. See the cost tiers in `references\u002Fprocessor-cookbook.md` → **Processor performance guide**.\n- use enrichment processors (`geoip`, `user_agent`) only when needed\n- always anchor `grok` patterns with `^` and `$` — without anchors the regex engine scans the entire input string looking for a partial match, which is slow and can produce incorrect results on noisy log lines\n\n## Mustache template syntax in processor values\n\nIngest pipeline processors use Mustache templates to reference field values in `value`, `message`, and similar string parameters. Use **triple braces** `{{{field}}}` with **single quotes** — never double braces or double quotes:\n\n```yaml\n# CORRECT — triple braces, single quotes\n- append:\n    field: related.user\n    value: '{{{user.target.email}}}'\n    allow_duplicates: false\n    if: ctx.user?.target?.email != null\n\n# WRONG — double braces HTML-escape the value; double quotes\n- append:\n    field: related.user\n    value: \"{{user.target.email}}\"\n    allow_duplicates: false\n    if: ctx.user?.target?.email != null\n```\n\nWhy: Mustache double braces `{{...}}` HTML-encode the value (e.g., `&` becomes `&`), which corrupts data in ingest pipelines. Triple braces `{{{...}}}` emit the raw value. Single quotes prevent YAML from interpreting braces.\n\n**Exception:** `{{ IngestPipeline \"...\" }}` in `pipeline.name` is a Go template directive processed at build time, not a Mustache template — it correctly uses double braces.\n\n## Error handling essentials\n\nUse pipeline-level `on_failure` as the main error reporting mechanism.\n\nRecommended baseline (order matters):\n- **append** contextual `error.message` first using `_ingest.on_failure_*` variables (full template in the standard opening example)\n- **set** `event.kind: pipeline_error` (with a `tag` on the `set` processor)\n- **append** `preserve_original_event` to `tags` when you need to retain the failed document for triage\n- give **every** processor a `tag` (not only processors that can fail)\n\nUse processor-level `on_failure` for local cleanup or fallback parsing, not as the primary global error message path.\n\nSee `references\u002Ferror-handling-patterns.md` for full examples and tradeoffs (`ignore_failure`, `fail`, processor-level `on_failure`).\n\n## event.original handling (JSE00001)\n\nThe `elastic-package build` validator enforces that pipelines correctly handle the `message` to `event.original` rename. This check is known as JSE00001. New packages must comply; some legacy packages exclude it via `validation.yml`.\n\n### Required two-processor pattern\n\nEvery pipeline that consumes a `message` field must include both processors (typically **after** `ecs.version` and **after** any CEL-only `remove`\u002F`terminate` steps when applicable):\n\n```yaml\n- rename:\n    field: message\n    tag: rename_message_to_event_original\n    target_field: event.original\n    ignore_missing: true\n    description: Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.\n    if: ctx.event?.original == null\n- remove:\n    field: message\n    tag: remove_message\n    ignore_missing: true\n    description: The `message` field is no longer required if the document has an `event.original` field.\n    if: ctx.event?.original != null\n```\n\nStep 1 (`rename`): moves `message` into `event.original`, but only when `event.original` is not already populated (idempotent when a prior pipeline or Logstash has already set it).\n\nStep 2 (`remove`): removes the redundant `message` field when `event.original` is present (after rename or from an upstream producer).\n\n### Do NOT add an `event.original` removal processor at the end of the pipeline\n\nSome existing integrations contain a `remove` processor that deletes `event.original` at the end of the pipeline when `preserve_original_event` is not in `tags`. **This pattern is deprecated and must not be used in new pipelines.** The removal of `event.original` for storage optimization is now handled by a separate final pipeline outside the integration. Do not copy this pattern from reference integrations that still have it — it is legacy.\n\n### Reference\n\nThe two-processor JSE00001 pattern (rename + remove of `message`) shown above is required and complete. Do not add any additional `event.original` processors beyond those two.\n\n## Timezone handling (`tz_offset`)\n\nFor data streams that include the `tz_offset` manifest var (syslog streams where messages lack a timezone), set `event.timezone` from `_conf.tz_offset` early in the pipeline, before any date parsing:\n\n```yaml\n- set:\n    field: event.timezone\n    tag: set_event_timezone\n    value: '{{{_conf.tz_offset}}}'\n    if: ctx._conf?.tz_offset != null && ctx._conf.tz_offset != ''\n```\n\nThis ensures date processors can apply the correct timezone when parsing timestamps that have no timezone component.\n\n## Syslog structured data (RFC 5424 SD-ELEMENT) parsing\n\nFor vendor `key=value` payloads and RFC 5424 SD-ELEMENT blocks, three strategies are available: KV with `trim_value` (simplest, Strategy 1), `SYSLOG5424SD` grok + KV with regex splits (Strategy 2), and Painless for edge cases with embedded equals or mixed quoting (Strategy 3).\n\nPrefer Strategy 1 or 2; use Painless only when KV edge cases demand it.\n\nSee `references\u002Fgrok-recipes.md` → **Syslog structured data strategies** for full code examples, key settings, and reference implementations.\n\n## Keyword fields delivered as numbers\n\nFields that carry identifiers, protocol codes, or other opaque values must be declared as `keyword` in `fields.yml` — even when the source data delivers them as numbers. Common examples:\n\n- network protocol numbers (`network.iana_number`)\n- port numbers used as identifiers\n- error codes, result codes, status codes\n- SNMP OIDs, event IDs, object class codes\n\nDo **not** add a `convert` processor to stringify these values. Elasticsearch silently coerces numbers into `keyword` strings at index time, so the pipeline can pass the raw numeric value through unchanged.\n\nThe field declaration in `fields.yml`:\n```yaml\n- name: network.iana_number\n  type: keyword\n  description: IANA protocol number.\n```\n\nBecause the test runner compares raw value types against declared field types, it will flag `6` (long) as a mismatch for `keyword`. Declare the field in `numeric_keyword_fields` in the pipeline test config so the runner accepts the numeric representation without requiring the fixture to artificially stringify the value. See `integration-testing\u002Freferences\u002Fpipeline-testing.md` for the config syntax.\n\n## Vendor field naming\n\nPreserve vendor field names exactly as they appear in the source. Do not rename, reformat, or normalize vendor-specific field names — the only permitted renaming is mapping a vendor field to an ECS field (e.g. renaming `src_ip` to `source.ip`). When a vendor field has no ECS equivalent, keep it under a vendor-namespaced prefix (e.g. `vendor.product.field_name`) using the original name from the source.\n\n## related.ip population\n\n**Every IP address present in the document must be appended to `related.ip`.** This includes source, destination, client, server, host, and any other IP fields — whatever applies to the event type.\n\nUse one `append` processor per IP field, with `ignore_missing: true` so it is a no-op when the field is absent. Place these processors after all IP fields have been set (for example after `geoip`, `convert`, and any ECS rename steps) and before the cleanup `remove` processors.\n\n```yaml\n  - append:\n      field: related.ip\n      tag: append_source_ip_to_related\n      value: '{{{source.ip}}}'\n      allow_duplicates: false\n      if: ctx.source?.ip != null\n  - append:\n      field: related.ip\n      tag: append_destination_ip_to_related\n      value: '{{{destination.ip}}}'\n      allow_duplicates: false\n      if: ctx.destination?.ip != null\n  # repeat the same pattern for client.ip, server.ip, host.ip, and any other IP fields the pipeline sets\n```\n\nRules:\n- Use `allow_duplicates: false` on every append to avoid repeated values.\n- Add an `if` guard on every processor so it skips fields absent in the event.\n- Add one `append` per IP field the pipeline actually writes — do not add processors for fields the pipeline never sets.\n\n## Painless script best practices\n\n**Before writing any `script` processor, you MUST check whether a built-in processor can do the same job.** `script` is the slowest general-purpose processor (Painless compilation + per-document execution). The following operations have dedicated processors that are cheaper and easier to review:\n\n| If you need to … | Use this processor, not `script` |\n|---|---|\n| Copy, move, or rename a field | `rename` or `set` with `copy_from` |\n| Set a constant or derived value | `set` |\n| Add a value to a list | `append` |\n| Change a field's type | `convert` |\n| Extract a substring from a delimited string | `dissect` |\n| Extract a substring with regex | `grok` |\n| Replace characters in a string | `gsub` |\n| Normalize case | `lowercase` \u002F `uppercase` |\n\nOnly reach for `script` when no combination of built-in processors can express the logic — for example, ECS categorization lookup tables with 5+ entries (Pattern A), complex conditional arithmetic, or edge-case string parsing that `dissect` and `grok` genuinely cannot handle.\n\n**Case-insensitive comparisons — use `equalsIgnoreCase()` when casing is unpredictable**\n\nSyslog and vendor devices are often inconsistent about casing, so Painless scripts comparing vendor-specific free-text fields should use `equalsIgnoreCase()` rather than `==`. However, **apply this judgement contextually, not blanket:**\n\n- **Use `equalsIgnoreCase()`** when the vendor field value may vary in casing between devices, firmware versions, or log sources (e.g. action fields like `allow\u002FAllow\u002FALLOW`, severity strings, free-text status fields).\n- **Use `==`** when the API or spec defines a fixed lowercase enum and the values are always delivered as-specified (e.g. ECS categorization fields, API response fields documented as lowercase-only enums). Adding `equalsIgnoreCase()` to fixed-enum fields adds noise without value.\n\n```painless\n\u002F\u002F Correct for unpredictable vendor casing\nif (ctx.vendor?.action?.equalsIgnoreCase('allow')) { ... }\n\n\u002F\u002F Correct for a fixed lowercase API enum — == is appropriate here\nif (ctx.json?.event_type == 'login') { ... }\n\n\u002F\u002F Incorrect for unpredictable casing — breaks on \"Allow\", \"ALLOW\"\nif (ctx.vendor?.action == 'allow') { ... }\n```\n\n**Access `ctx` directly in script bodies — no null-safe operators**\n\nIn `script` processor `source` blocks, access `ctx` fields directly. Use explicit null checks instead of the null-safe `?.` operator.\n\n```painless\n\u002F\u002F Correct — direct access with explicit null check\nif (ctx.source != null && ctx.source.ip != null) { ... }\n\n\u002F\u002F Incorrect — null-safe operator in a script body\nif (ctx.source?.ip != null) { ... }\n```\n\nNote: null-safe `?.` is acceptable in processor `if` conditions (YAML), which are a different Painless execution context:\n```yaml\n- append:\n    field: related.ip\n    value: '{{{source.ip}}}'\n    if: ctx.source?.ip != null\n```\n\n**Other rules**\n- Every `script` processor must have a `tag` and a `description`.\n- Keep scripts short and scoped — move complex logic into helper variables inside the script, not across multiple script processors.\n- **Do not use `script` when built-in processors suffice** — see the mandatory checklist table at the top of this section.\n\n## ECS categorization mapping\n\nWhen mapping source event types or actions to `event.category`, `event.type`, `event.outcome`, and `event.action`, use the patterns in `references\u002Fprocessor-cookbook.md` → **ECS categorization mapping patterns**:\n\n- **Pattern A** (script with `params` lookup table): recommended for **5+ mappings**. Mapping data in `params` enables Painless compilation caching and keeps the script body generic.\n- **Pattern B** (`set` processors with conditionals): for **fewer than 5 mappings** where a script is overkill.\n- **Pattern C** (sub-pipeline): for **100+ mappings**, extract the categorization into a dedicated sub-pipeline file.\n\n**Do NOT** use bulk `append` processors (2 per event type = 50+ processors for 25 types) or inline Painless `if`\u002F`else` chains without `params` (defeats compilation caching). These are explicit anti-patterns — see the cookbook for details.\n\n## Grok best practices\n\n- prefer `dissect` when structure is fixed\n- use simpler grok patterns where possible\n- always anchor grok patterns with `^` and `$`:\n  ```yaml\n  # Correct — anchored, fails fast on non-matching lines\n  patterns:\n    - '^%{IPORHOST:source.ip} %{USER:user.name} %{DATA:message}$'\n\n  # Incorrect — unanchored, scans the whole string for a partial match\n  patterns:\n    - '%{IPORHOST:source.ip} %{USER:user.name} %{DATA:message}'\n  ```\n- avoid unnecessary backtracking-heavy custom regex\n- add a `tag` to every grok (and every other) processor\n\nFor grok syntax (three expression forms, inline regex, type coercion, `pattern_definitions`), syslog header splitting recipes, and common mistakes, see `references\u002Fgrok-recipes.md`.\n\n## Prohibited patterns\n\nThese patterns exist in many legacy integrations but **must not** be used in new or updated pipelines. Do not copy them from reference integrations.\n\n### Never set `event.ingested`\n\nThe `event.ingested` field is managed by Elasticsearch outside the integration pipeline. **Do not** add a `set` processor for `event.ingested` in any integration pipeline. This includes patterns like:\n\n```yaml\n# PROHIBITED — do not use\n- set:\n    field: event.ingested\n    value: '{{{_ingest.timestamp}}}'\n```\n\nThe pipeline **should** set `@timestamp` from the original event's timestamp. When the source data contains multiple timestamps, map them as follows:\n\n- **`@timestamp`**: the primary event timestamp parsed from the source data. This is required.\n- **`event.created`**: when the event was first created or recorded by the source system (if different from `@timestamp`).\n- **`event.start`**: when an activity or period began (e.g., session start, connection start).\n- **`event.end`**: when an activity or period ended (e.g., session end, connection close).\n\nIf a source timestamp does not match the semantics of `event.created`, `event.start`, or `event.end`, map it to a custom field under the vendor namespace with `type: date` in `fields.yml` and use a `date` processor with the appropriate `target_field`.\n\n### Never use `preserve_duplicate_custom_fields`\n\nThe `preserve_duplicate_custom_fields` tag pattern — where source fields are copied to ECS fields using `set` with `copy_from` and the originals are conditionally retained — is a legacy anti-pattern. **Do not use it in any new or updated pipeline.** Do not add a `preserve_duplicate_custom_fields` manifest variable, tag, or conditional logic.\n\nInstead, follow these field mapping rules:\n- When a source field maps to an ECS field, use `rename` to move it directly. The source field is removed and no duplicate exists.\n- When a type conversion is needed (e.g., string to date, string to long), use the appropriate processor (`date`, `convert`, `set` with `copy_from`) to populate the ECS target field, then `remove` the source field in the cleanup section at the end of the pipeline.\n- **Never design a pipeline that needs to preserve both the original vendor field and the ECS copy.** The ECS field is the canonical location.\n\nIf you encounter this pattern in a reference integration, ignore it — it is legacy.\n\n### Never add an `event.original` removal processor at the end\n\nAs documented in the JSE00001 section above: do not add a `remove` processor for `event.original` at the end of the pipeline. This is handled by a separate final pipeline.\n\n## References\n\n- `references\u002Fprocessor-cookbook.md` — processor selection, parsing\u002Fnormalization\u002Fenrichment examples, ECS categorization mapping patterns (Pattern A\u002FB\u002FC + anti-patterns)\n- `references\u002Fbranching-patterns.md`\n- `references\u002Ferror-handling-patterns.md`\n- `references\u002Fgrok-recipes.md` — grok syntax, type coercion, syslog header recipes, common mistakes, pattern library link\n- `references\u002Fbuilder-subagent-guidance.md` — subagent operating manual: scope boundaries, skill-load sequence, input data paths (CEL-first vs Direct), 9-step pipeline build workflow, \"review generated output, never hand-edit expected JSON\", reporting contract. The orchestrator dispatches subagents by passing this file's **path** in the task prompt; the subagent reads it itself in its own fresh context. Do NOT embed\u002Fpaste its contents into the task prompt.\n\n",{"data":37,"body":40},{"name":4,"description":6,"license":28,"metadata":38},{"author":8,"version":39},"1.0",{"type":41,"children":42},"root",[43,50,57,87,93,98,194,200,205,252,258,263,272,285,318,330,336,361,459,465,521,527,544,550,584,661,686,697,765,1799,1805,1864,1869,2770,2776,2781,2806,2811,3004,3016,3037,3057,3063,3087,3094,3104,3115,3170,3859,3865,3942,3948,4129,4135,4174,4381,4418,4443,4449,4461,4466,4566,4578,4611,4617,4650,4656,4699,4905,4938,4964,4977,5023,5029,5048,5061,5089,5183,5188,5194,5223,5228,5246,5252,5272,5302,5328,5339,5401,5437,5443,5471,5477,5494,5533,5751,5756,5795,5801,5824,6005,6030,6046,6071,6117,6188,6204,6239,6285,6304,6379,6387,6437,6443,6489,6564,6602,6608,6754,6773,6779,6790,6802,6833,6903,6922,6986,7039,7051,7089,7094,7156,7161,7174,7192,7198,7255],{"type":44,"tag":45,"props":46,"children":47},"element","h1",{"id":4},[48],{"type":49,"value":4},"text",{"type":44,"tag":51,"props":52,"children":54},"h2",{"id":53},"skill-authority",[55],{"type":49,"value":56},"Skill authority",{"type":44,"tag":58,"props":59,"children":60},"p",{},[61,63,69,71,78,80,85],{"type":49,"value":62},"The rules and patterns defined in this skill and its reference files are the ",{"type":44,"tag":64,"props":65,"children":66},"strong",{},[67],{"type":49,"value":68},"authoritative source of truth",{"type":49,"value":70},". When examining existing integrations in the ",{"type":44,"tag":72,"props":73,"children":75},"code",{"className":74},[],[76],{"type":49,"value":77},"elastic\u002Fintegrations",{"type":49,"value":79}," repository for reference, you may encounter patterns that conflict with what is specified here — many integrations contain legacy patterns that predate current standards. ",{"type":44,"tag":64,"props":81,"children":82},{},[83],{"type":49,"value":84},"Always follow this skill over patterns observed in other integrations.",{"type":49,"value":86}," If a reference integration uses a deprecated or prohibited pattern, do not copy it.",{"type":44,"tag":51,"props":88,"children":90},{"id":89},"when-to-use",[91],{"type":49,"value":92},"When to use",{"type":44,"tag":58,"props":94,"children":95},{},[96],{"type":49,"value":97},"Use this skill when tasks include:",{"type":44,"tag":99,"props":100,"children":101},"ul",{},[102,116,165,178,189],{"type":44,"tag":103,"props":104,"children":105},"li",{},[106,108,114],{"type":49,"value":107},"building or modifying ",{"type":44,"tag":72,"props":109,"children":111},{"className":110},[],[112],{"type":49,"value":113},"elasticsearch\u002Fingest_pipeline\u002Fdefault.yml",{"type":49,"value":115}," for a data stream",{"type":44,"tag":103,"props":117,"children":118},{},[119,121,127,129,135,136,142,143,149,150,156,157,163],{"type":49,"value":120},"choosing parser and normalization processors (",{"type":44,"tag":72,"props":122,"children":124},{"className":123},[],[125],{"type":49,"value":126},"grok",{"type":49,"value":128},", ",{"type":44,"tag":72,"props":130,"children":132},{"className":131},[],[133],{"type":49,"value":134},"dissect",{"type":49,"value":128},{"type":44,"tag":72,"props":137,"children":139},{"className":138},[],[140],{"type":49,"value":141},"json",{"type":49,"value":128},{"type":44,"tag":72,"props":144,"children":146},{"className":145},[],[147],{"type":49,"value":148},"kv",{"type":49,"value":128},{"type":44,"tag":72,"props":151,"children":153},{"className":152},[],[154],{"type":49,"value":155},"date",{"type":49,"value":128},{"type":44,"tag":72,"props":158,"children":160},{"className":159},[],[161],{"type":49,"value":162},"convert",{"type":49,"value":164},")",{"type":44,"tag":103,"props":166,"children":167},{},[168,170,176],{"type":49,"value":169},"designing conditional branches and sub-pipeline routing with ",{"type":44,"tag":72,"props":171,"children":173},{"className":172},[],[174],{"type":49,"value":175},"pipeline",{"type":49,"value":177}," processors",{"type":44,"tag":103,"props":179,"children":180},{},[181,183],{"type":49,"value":182},"implementing resilient error handling with top-level ",{"type":44,"tag":72,"props":184,"children":186},{"className":185},[],[187],{"type":49,"value":188},"on_failure",{"type":44,"tag":103,"props":190,"children":191},{},[192],{"type":49,"value":193},"tuning processor order for ingest performance and maintainability",{"type":44,"tag":51,"props":195,"children":197},{"id":196},"when-not-to-use",[198],{"type":49,"value":199},"When not to use",{"type":44,"tag":58,"props":201,"children":202},{},[203],{"type":49,"value":204},"Do not use this skill as the primary guide for:",{"type":44,"tag":99,"props":206,"children":207},{},[208,220,232],{"type":44,"tag":103,"props":209,"children":210},{},[211,213,219],{"type":49,"value":212},"ECS field selection, categorization values, and field mapping strategy (",{"type":44,"tag":72,"props":214,"children":216},{"className":215},[],[217],{"type":49,"value":218},"ecs-field-mappings",{"type":49,"value":164},{"type":44,"tag":103,"props":221,"children":222},{},[223,225,231],{"type":49,"value":224},"elastic-package command and stack lifecycle workflows (",{"type":44,"tag":72,"props":226,"children":228},{"className":227},[],[229],{"type":49,"value":230},"elastic-package-cli",{"type":49,"value":164},{"type":44,"tag":103,"props":233,"children":234},{},[235,237,243,245,251],{"type":49,"value":236},"test fixture authoring and expected output workflows (",{"type":44,"tag":72,"props":238,"children":240},{"className":239},[],[241],{"type":49,"value":242},"integration-testing",{"type":49,"value":244}," → ",{"type":44,"tag":72,"props":246,"children":248},{"className":247},[],[249],{"type":49,"value":250},"references\u002Fpipeline-testing.md",{"type":49,"value":164},{"type":44,"tag":51,"props":253,"children":255},{"id":254},"pipeline-anatomy",[256],{"type":49,"value":257},"Pipeline anatomy",{"type":44,"tag":58,"props":259,"children":260},{},[261],{"type":49,"value":262},"In integration packages, ingest pipelines live under:",{"type":44,"tag":58,"props":264,"children":265},{},[266],{"type":44,"tag":72,"props":267,"children":269},{"className":268},[],[270],{"type":49,"value":271},"data_stream\u002F\u003Cstream>\u002Felasticsearch\u002Fingest_pipeline\u002F",{"type":44,"tag":58,"props":273,"children":274},{},[275,277,283],{"type":49,"value":276},"Every stream usually has a ",{"type":44,"tag":72,"props":278,"children":280},{"className":279},[],[281],{"type":49,"value":282},"default.yml",{"type":49,"value":284}," with:",{"type":44,"tag":99,"props":286,"children":287},{},[288,297,308],{"type":44,"tag":103,"props":289,"children":290},{},[291],{"type":44,"tag":72,"props":292,"children":294},{"className":293},[],[295],{"type":49,"value":296},"description",{"type":44,"tag":103,"props":298,"children":299},{},[300,306],{"type":44,"tag":72,"props":301,"children":303},{"className":302},[],[304],{"type":49,"value":305},"processors",{"type":49,"value":307}," list",{"type":44,"tag":103,"props":309,"children":310},{},[311,313],{"type":49,"value":312},"optional pipeline-level ",{"type":44,"tag":72,"props":314,"children":316},{"className":315},[],[317],{"type":49,"value":188},{"type":44,"tag":58,"props":319,"children":320},{},[321,323,328],{"type":49,"value":322},"Keep ",{"type":44,"tag":72,"props":324,"children":326},{"className":325},[],[327],{"type":49,"value":282},{"type":49,"value":329}," readable and focused. Move large format-specific logic into sub-pipelines where needed.",{"type":44,"tag":51,"props":331,"children":333},{"id":332},"ecs-version",[334],{"type":49,"value":335},"ECS version",{"type":44,"tag":58,"props":337,"children":338},{},[339,341,346,348,359],{"type":49,"value":340},"Set the pipeline ECS reference version explicitly at the top of ",{"type":44,"tag":72,"props":342,"children":344},{"className":343},[],[345],{"type":49,"value":305},{"type":49,"value":347}," (after any introductory processors you already use). ",{"type":44,"tag":64,"props":349,"children":350},{},[351,353],{"type":49,"value":352},"Use ",{"type":44,"tag":72,"props":354,"children":356},{"className":355},[],[357],{"type":49,"value":358},"9.3.0",{"type":49,"value":360}," — do not pin an older ECS version.",{"type":44,"tag":362,"props":363,"children":368},"pre",{"className":364,"code":365,"language":366,"meta":367,"style":367},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","  - set:\n      field: ecs.version\n      tag: set_ecs_version\n      value: '9.3.0'\n","yaml","",[369],{"type":44,"tag":72,"props":370,"children":371},{"__ignoreMap":367},[372,395,414,432],{"type":44,"tag":373,"props":374,"children":377},"span",{"class":375,"line":376},"line",1,[378,384,390],{"type":44,"tag":373,"props":379,"children":381},{"style":380},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[382],{"type":49,"value":383},"  -",{"type":44,"tag":373,"props":385,"children":387},{"style":386},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[388],{"type":49,"value":389}," set",{"type":44,"tag":373,"props":391,"children":392},{"style":380},[393],{"type":49,"value":394},":\n",{"type":44,"tag":373,"props":396,"children":397},{"class":375,"line":29},[398,403,408],{"type":44,"tag":373,"props":399,"children":400},{"style":386},[401],{"type":49,"value":402},"      field",{"type":44,"tag":373,"props":404,"children":405},{"style":380},[406],{"type":49,"value":407},":",{"type":44,"tag":373,"props":409,"children":411},{"style":410},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[412],{"type":49,"value":413}," ecs.version\n",{"type":44,"tag":373,"props":415,"children":417},{"class":375,"line":416},3,[418,423,427],{"type":44,"tag":373,"props":419,"children":420},{"style":386},[421],{"type":49,"value":422},"      tag",{"type":44,"tag":373,"props":424,"children":425},{"style":380},[426],{"type":49,"value":407},{"type":44,"tag":373,"props":428,"children":429},{"style":410},[430],{"type":49,"value":431}," set_ecs_version\n",{"type":44,"tag":373,"props":433,"children":435},{"class":375,"line":434},4,[436,441,445,450,454],{"type":44,"tag":373,"props":437,"children":438},{"style":386},[439],{"type":49,"value":440},"      value",{"type":44,"tag":373,"props":442,"children":443},{"style":380},[444],{"type":49,"value":407},{"type":44,"tag":373,"props":446,"children":447},{"style":380},[448],{"type":49,"value":449}," '",{"type":44,"tag":373,"props":451,"children":452},{"style":410},[453],{"type":49,"value":358},{"type":44,"tag":373,"props":455,"children":456},{"style":380},[457],{"type":49,"value":458},"'\n",{"type":44,"tag":51,"props":460,"children":462},{"id":461},"rename-vs-set-mapping-to-ecs",[463],{"type":49,"value":464},"Rename vs set (mapping to ECS)",{"type":44,"tag":58,"props":466,"children":467},{},[468,470,475,477,482,483,496,498,504,506,512,514,519],{"type":49,"value":469},"When moving a value from a ",{"type":44,"tag":64,"props":471,"children":472},{},[473],{"type":49,"value":474},"custom or vendor field",{"type":49,"value":476}," into an ",{"type":44,"tag":64,"props":478,"children":479},{},[480],{"type":49,"value":481},"ECS field",{"type":49,"value":128},{"type":44,"tag":64,"props":484,"children":485},{},[486,488,494],{"type":49,"value":487},"prefer the ",{"type":44,"tag":72,"props":489,"children":491},{"className":490},[],[492],{"type":49,"value":493},"rename",{"type":49,"value":495}," processor",{"type":49,"value":497}," so the source field is removed and you avoid duplicate data. Use ",{"type":44,"tag":72,"props":499,"children":501},{"className":500},[],[502],{"type":49,"value":503},"set",{"type":49,"value":505}," with ",{"type":44,"tag":72,"props":507,"children":509},{"className":508},[],[510],{"type":49,"value":511},"copy_from",{"type":49,"value":513}," only when you must keep the source field or when ",{"type":44,"tag":72,"props":515,"children":517},{"className":516},[],[518],{"type":49,"value":493},{"type":49,"value":520}," is not applicable.",{"type":44,"tag":51,"props":522,"children":524},{"id":523},"processor-tags",[525],{"type":49,"value":526},"Processor tags",{"type":44,"tag":58,"props":528,"children":529},{},[530,535,537,542],{"type":44,"tag":64,"props":531,"children":532},{},[533],{"type":49,"value":534},"Every processor",{"type":49,"value":536}," in the pipeline should have a ",{"type":44,"tag":72,"props":538,"children":540},{"className":539},[],[541],{"type":49,"value":15},{"type":49,"value":543}," (not only processors that can fail). Tags make failures and telemetry attributable to a specific step.",{"type":44,"tag":51,"props":545,"children":547},{"id":546},"cel-only-opening-processors-agentless-metadata-and-error-only-documents",[548],{"type":49,"value":549},"CEL-only opening processors (Agentless metadata and error-only documents)",{"type":44,"tag":58,"props":551,"children":552},{},[553,555,560,562,567,569,575,576,582],{"type":49,"value":554},"For ",{"type":44,"tag":64,"props":556,"children":557},{},[558],{"type":49,"value":559},"CEL-based",{"type":49,"value":561}," integrations only, include these ",{"type":44,"tag":64,"props":563,"children":564},{},[565],{"type":49,"value":566},"before",{"type":49,"value":568}," the standard ",{"type":44,"tag":72,"props":570,"children":572},{"className":571},[],[573],{"type":49,"value":574},"message",{"type":49,"value":244},{"type":44,"tag":72,"props":577,"children":579},{"className":578},[],[580],{"type":49,"value":581},"event.original",{"type":49,"value":583}," handling when they apply:",{"type":44,"tag":99,"props":585,"children":586},{},[587,639],{"type":44,"tag":103,"props":588,"children":589},{},[590,599,601,607,608,614,615,621,623,629,631,637],{"type":44,"tag":64,"props":591,"children":592},{},[593],{"type":44,"tag":72,"props":594,"children":596},{"className":595},[],[597],{"type":49,"value":598},"remove",{"type":49,"value":600},": drop Agentless metadata fields (",{"type":44,"tag":72,"props":602,"children":604},{"className":603},[],[605],{"type":49,"value":606},"organization",{"type":49,"value":128},{"type":44,"tag":72,"props":609,"children":611},{"className":610},[],[612],{"type":49,"value":613},"division",{"type":49,"value":128},{"type":44,"tag":72,"props":616,"children":618},{"className":617},[],[619],{"type":49,"value":620},"team",{"type":49,"value":622},") when all are strings, so they do not collide with ECS. Use ",{"type":44,"tag":72,"props":624,"children":626},{"className":625},[],[627],{"type":49,"value":628},"ignore_missing: true",{"type":49,"value":630}," and a conditional ",{"type":44,"tag":72,"props":632,"children":634},{"className":633},[],[635],{"type":49,"value":636},"if",{"type":49,"value":638},".",{"type":44,"tag":103,"props":640,"children":641},{},[642,651,653,659],{"type":44,"tag":64,"props":643,"children":644},{},[645],{"type":44,"tag":72,"props":646,"children":648},{"className":647},[],[649],{"type":49,"value":650},"terminate",{"type":49,"value":652},": stop processing when the document is an error placeholder from the collector (",{"type":44,"tag":72,"props":654,"children":656},{"className":655},[],[657],{"type":49,"value":658},"ctx.error?.message != null && ctx.message == null && ctx.event?.original == null",{"type":49,"value":660},").",{"type":44,"tag":58,"props":662,"children":663},{},[664,669,671,676,678,684],{"type":44,"tag":64,"props":665,"children":666},{},[667],{"type":49,"value":668},"Non-CEL",{"type":49,"value":670}," integrations (logs, syslog, filebeat-style inputs) ",{"type":44,"tag":64,"props":672,"children":673},{},[674],{"type":49,"value":675},"must not",{"type":49,"value":677}," copy this block blindly — those fields and error shapes are specific to the CEL\u002FAgentless path. See the ",{"type":44,"tag":72,"props":679,"children":681},{"className":680},[],[682],{"type":49,"value":683},"create-integration",{"type":49,"value":685}," skill: the orchestrator must only expect this block when the data stream uses CEL input.",{"type":44,"tag":51,"props":687,"children":689},{"id":688},"standard-opening-ecs-optional-cel-block-jse00001-then-parse-eventoriginal",[690,692],{"type":49,"value":691},"Standard opening: ECS, optional CEL block, JSE00001, then parse ",{"type":44,"tag":72,"props":693,"children":695},{"className":694},[],[696],{"type":49,"value":581},{"type":44,"tag":58,"props":698,"children":699},{},[700,702,707,709,714,715,721,722,727,729,737,739,749,751,756,757,763],{"type":49,"value":701},"After the optional CEL-only processors, the pipeline should follow this shape. ",{"type":44,"tag":64,"props":703,"children":704},{},[705],{"type":49,"value":706},"All parsing",{"type":49,"value":708}," (",{"type":44,"tag":72,"props":710,"children":712},{"className":711},[],[713],{"type":49,"value":141},{"type":49,"value":128},{"type":44,"tag":72,"props":716,"children":718},{"className":717},[],[719],{"type":49,"value":720},"csv",{"type":49,"value":128},{"type":44,"tag":72,"props":723,"children":725},{"className":724},[],[726],{"type":49,"value":126},{"type":49,"value":728},", etc.) runs on ",{"type":44,"tag":64,"props":730,"children":731},{},[732],{"type":44,"tag":72,"props":733,"children":735},{"className":734},[],[736],{"type":49,"value":581},{"type":49,"value":738},". ",{"type":44,"tag":64,"props":740,"children":741},{},[742,744],{"type":49,"value":743},"Never overwrite or mutate ",{"type":44,"tag":72,"props":745,"children":747},{"className":746},[],[748],{"type":49,"value":581},{"type":49,"value":750}," in later processors — derive structured fields into other paths (for example ",{"type":44,"tag":72,"props":752,"children":754},{"className":753},[],[755],{"type":49,"value":141},{"type":49,"value":128},{"type":44,"tag":72,"props":758,"children":760},{"className":759},[],[761],{"type":49,"value":762},"_temp.*",{"type":49,"value":764},", ECS fields).",{"type":44,"tag":362,"props":766,"children":768},{"className":364,"code":767,"language":366,"meta":367,"style":367},"description: Parse \u003Cdataset> events.\nprocessors:\n  - set:\n      field: ecs.version\n      tag: set_ecs_version\n      value: '9.3.0'\n\n  # --- CEL input only (omit for log\u002Fsyslog-only streams) ---\n  - remove:\n      field:\n        - organization\n        - division\n        - team\n      ignore_missing: true\n      if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String\n      tag: remove_agentless_tags\n      description: >-\n        Removes the fields added by Agentless as metadata,\n        as they can collide with ECS fields.\n  - terminate:\n      tag: data_collection_error\n      if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null\n      description: error message set and no data to process.\n  # --- end CEL-only ---\n\n  - rename:\n      field: message\n      tag: rename_message_to_event_original\n      target_field: event.original\n      ignore_missing: true\n      description: Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.\n      if: ctx.event?.original == null\n  - remove:\n      field: message\n      tag: remove_message\n      ignore_missing: true\n      description: The `message` field is no longer required if the document has an `event.original` field.\n      if: ctx.event?.original != null\n\n  # Parse (always read from event.original; do not modify event.original)\n  - json:\n      field: event.original\n      target_field: json\n      tag: parse_json\n      if: ctx.event?.original != null\n\n  # ... normalize, enrich, ECS categorization, cleanup ...\n\n  - append:\n      field: tags\n      value: preserve_original_event\n      allow_duplicates: false\n      if: ctx.error?.message != null\n\non_failure:\n  - append:\n      field: error.message\n      value: >-\n        Processor '{{{ _ingest.on_failure_processor_type }}}'\n        {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'\n        {{{\u002F_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}'\n  - set:\n      field: event.kind\n      tag: set_pipeline_error_to_event_kind\n      value: pipeline_error\n  - append:\n      field: tags\n      value: preserve_original_event\n      allow_duplicates: false\n",[769],{"type":44,"tag":72,"props":770,"children":771},{"__ignoreMap":367},[772,788,799,814,829,845,869,879,889,906,918,931,944,957,976,994,1011,1036,1045,1054,1071,1088,1105,1122,1131,1139,1156,1173,1190,1208,1224,1241,1258,1274,1290,1307,1323,1340,1357,1365,1374,1391,1407,1424,1441,1457,1465,1474,1482,1499,1516,1533,1551,1568,1576,1588,1604,1621,1641,1650,1659,1668,1684,1701,1718,1735,1751,1767,1783],{"type":44,"tag":373,"props":773,"children":774},{"class":375,"line":376},[775,779,783],{"type":44,"tag":373,"props":776,"children":777},{"style":386},[778],{"type":49,"value":296},{"type":44,"tag":373,"props":780,"children":781},{"style":380},[782],{"type":49,"value":407},{"type":44,"tag":373,"props":784,"children":785},{"style":410},[786],{"type":49,"value":787}," Parse \u003Cdataset> events.\n",{"type":44,"tag":373,"props":789,"children":790},{"class":375,"line":29},[791,795],{"type":44,"tag":373,"props":792,"children":793},{"style":386},[794],{"type":49,"value":305},{"type":44,"tag":373,"props":796,"children":797},{"style":380},[798],{"type":49,"value":394},{"type":44,"tag":373,"props":800,"children":801},{"class":375,"line":416},[802,806,810],{"type":44,"tag":373,"props":803,"children":804},{"style":380},[805],{"type":49,"value":383},{"type":44,"tag":373,"props":807,"children":808},{"style":386},[809],{"type":49,"value":389},{"type":44,"tag":373,"props":811,"children":812},{"style":380},[813],{"type":49,"value":394},{"type":44,"tag":373,"props":815,"children":816},{"class":375,"line":434},[817,821,825],{"type":44,"tag":373,"props":818,"children":819},{"style":386},[820],{"type":49,"value":402},{"type":44,"tag":373,"props":822,"children":823},{"style":380},[824],{"type":49,"value":407},{"type":44,"tag":373,"props":826,"children":827},{"style":410},[828],{"type":49,"value":413},{"type":44,"tag":373,"props":830,"children":832},{"class":375,"line":831},5,[833,837,841],{"type":44,"tag":373,"props":834,"children":835},{"style":386},[836],{"type":49,"value":422},{"type":44,"tag":373,"props":838,"children":839},{"style":380},[840],{"type":49,"value":407},{"type":44,"tag":373,"props":842,"children":843},{"style":410},[844],{"type":49,"value":431},{"type":44,"tag":373,"props":846,"children":848},{"class":375,"line":847},6,[849,853,857,861,865],{"type":44,"tag":373,"props":850,"children":851},{"style":386},[852],{"type":49,"value":440},{"type":44,"tag":373,"props":854,"children":855},{"style":380},[856],{"type":49,"value":407},{"type":44,"tag":373,"props":858,"children":859},{"style":380},[860],{"type":49,"value":449},{"type":44,"tag":373,"props":862,"children":863},{"style":410},[864],{"type":49,"value":358},{"type":44,"tag":373,"props":866,"children":867},{"style":380},[868],{"type":49,"value":458},{"type":44,"tag":373,"props":870,"children":872},{"class":375,"line":871},7,[873],{"type":44,"tag":373,"props":874,"children":876},{"emptyLinePlaceholder":875},true,[877],{"type":49,"value":878},"\n",{"type":44,"tag":373,"props":880,"children":882},{"class":375,"line":881},8,[883],{"type":44,"tag":373,"props":884,"children":886},{"style":885},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[887],{"type":49,"value":888},"  # --- CEL input only (omit for log\u002Fsyslog-only streams) ---\n",{"type":44,"tag":373,"props":890,"children":892},{"class":375,"line":891},9,[893,897,902],{"type":44,"tag":373,"props":894,"children":895},{"style":380},[896],{"type":49,"value":383},{"type":44,"tag":373,"props":898,"children":899},{"style":386},[900],{"type":49,"value":901}," remove",{"type":44,"tag":373,"props":903,"children":904},{"style":380},[905],{"type":49,"value":394},{"type":44,"tag":373,"props":907,"children":909},{"class":375,"line":908},10,[910,914],{"type":44,"tag":373,"props":911,"children":912},{"style":386},[913],{"type":49,"value":402},{"type":44,"tag":373,"props":915,"children":916},{"style":380},[917],{"type":49,"value":394},{"type":44,"tag":373,"props":919,"children":920},{"class":375,"line":25},[921,926],{"type":44,"tag":373,"props":922,"children":923},{"style":380},[924],{"type":49,"value":925},"        -",{"type":44,"tag":373,"props":927,"children":928},{"style":410},[929],{"type":49,"value":930}," organization\n",{"type":44,"tag":373,"props":932,"children":934},{"class":375,"line":933},12,[935,939],{"type":44,"tag":373,"props":936,"children":937},{"style":380},[938],{"type":49,"value":925},{"type":44,"tag":373,"props":940,"children":941},{"style":410},[942],{"type":49,"value":943}," division\n",{"type":44,"tag":373,"props":945,"children":947},{"class":375,"line":946},13,[948,952],{"type":44,"tag":373,"props":949,"children":950},{"style":380},[951],{"type":49,"value":925},{"type":44,"tag":373,"props":953,"children":954},{"style":410},[955],{"type":49,"value":956}," team\n",{"type":44,"tag":373,"props":958,"children":960},{"class":375,"line":959},14,[961,966,970],{"type":44,"tag":373,"props":962,"children":963},{"style":386},[964],{"type":49,"value":965},"      ignore_missing",{"type":44,"tag":373,"props":967,"children":968},{"style":380},[969],{"type":49,"value":407},{"type":44,"tag":373,"props":971,"children":973},{"style":972},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[974],{"type":49,"value":975}," true\n",{"type":44,"tag":373,"props":977,"children":979},{"class":375,"line":978},15,[980,985,989],{"type":44,"tag":373,"props":981,"children":982},{"style":386},[983],{"type":49,"value":984},"      if",{"type":44,"tag":373,"props":986,"children":987},{"style":380},[988],{"type":49,"value":407},{"type":44,"tag":373,"props":990,"children":991},{"style":410},[992],{"type":49,"value":993}," ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String\n",{"type":44,"tag":373,"props":995,"children":997},{"class":375,"line":996},16,[998,1002,1006],{"type":44,"tag":373,"props":999,"children":1000},{"style":386},[1001],{"type":49,"value":422},{"type":44,"tag":373,"props":1003,"children":1004},{"style":380},[1005],{"type":49,"value":407},{"type":44,"tag":373,"props":1007,"children":1008},{"style":410},[1009],{"type":49,"value":1010}," remove_agentless_tags\n",{"type":44,"tag":373,"props":1012,"children":1014},{"class":375,"line":1013},17,[1015,1020,1024,1030],{"type":44,"tag":373,"props":1016,"children":1017},{"style":386},[1018],{"type":49,"value":1019},"      description",{"type":44,"tag":373,"props":1021,"children":1022},{"style":380},[1023],{"type":49,"value":407},{"type":44,"tag":373,"props":1025,"children":1027},{"style":1026},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1028],{"type":49,"value":1029}," >",{"type":44,"tag":373,"props":1031,"children":1033},{"style":1032},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[1034],{"type":49,"value":1035},"-\n",{"type":44,"tag":373,"props":1037,"children":1039},{"class":375,"line":1038},18,[1040],{"type":44,"tag":373,"props":1041,"children":1042},{"style":410},[1043],{"type":49,"value":1044},"        Removes the fields added by Agentless as metadata,\n",{"type":44,"tag":373,"props":1046,"children":1048},{"class":375,"line":1047},19,[1049],{"type":44,"tag":373,"props":1050,"children":1051},{"style":410},[1052],{"type":49,"value":1053},"        as they can collide with ECS fields.\n",{"type":44,"tag":373,"props":1055,"children":1057},{"class":375,"line":1056},20,[1058,1062,1067],{"type":44,"tag":373,"props":1059,"children":1060},{"style":380},[1061],{"type":49,"value":383},{"type":44,"tag":373,"props":1063,"children":1064},{"style":386},[1065],{"type":49,"value":1066}," terminate",{"type":44,"tag":373,"props":1068,"children":1069},{"style":380},[1070],{"type":49,"value":394},{"type":44,"tag":373,"props":1072,"children":1074},{"class":375,"line":1073},21,[1075,1079,1083],{"type":44,"tag":373,"props":1076,"children":1077},{"style":386},[1078],{"type":49,"value":422},{"type":44,"tag":373,"props":1080,"children":1081},{"style":380},[1082],{"type":49,"value":407},{"type":44,"tag":373,"props":1084,"children":1085},{"style":410},[1086],{"type":49,"value":1087}," data_collection_error\n",{"type":44,"tag":373,"props":1089,"children":1091},{"class":375,"line":1090},22,[1092,1096,1100],{"type":44,"tag":373,"props":1093,"children":1094},{"style":386},[1095],{"type":49,"value":984},{"type":44,"tag":373,"props":1097,"children":1098},{"style":380},[1099],{"type":49,"value":407},{"type":44,"tag":373,"props":1101,"children":1102},{"style":410},[1103],{"type":49,"value":1104}," ctx.error?.message != null && ctx.message == null && ctx.event?.original == null\n",{"type":44,"tag":373,"props":1106,"children":1108},{"class":375,"line":1107},23,[1109,1113,1117],{"type":44,"tag":373,"props":1110,"children":1111},{"style":386},[1112],{"type":49,"value":1019},{"type":44,"tag":373,"props":1114,"children":1115},{"style":380},[1116],{"type":49,"value":407},{"type":44,"tag":373,"props":1118,"children":1119},{"style":410},[1120],{"type":49,"value":1121}," error message set and no data to process.\n",{"type":44,"tag":373,"props":1123,"children":1125},{"class":375,"line":1124},24,[1126],{"type":44,"tag":373,"props":1127,"children":1128},{"style":885},[1129],{"type":49,"value":1130},"  # --- end CEL-only ---\n",{"type":44,"tag":373,"props":1132,"children":1134},{"class":375,"line":1133},25,[1135],{"type":44,"tag":373,"props":1136,"children":1137},{"emptyLinePlaceholder":875},[1138],{"type":49,"value":878},{"type":44,"tag":373,"props":1140,"children":1142},{"class":375,"line":1141},26,[1143,1147,1152],{"type":44,"tag":373,"props":1144,"children":1145},{"style":380},[1146],{"type":49,"value":383},{"type":44,"tag":373,"props":1148,"children":1149},{"style":386},[1150],{"type":49,"value":1151}," rename",{"type":44,"tag":373,"props":1153,"children":1154},{"style":380},[1155],{"type":49,"value":394},{"type":44,"tag":373,"props":1157,"children":1159},{"class":375,"line":1158},27,[1160,1164,1168],{"type":44,"tag":373,"props":1161,"children":1162},{"style":386},[1163],{"type":49,"value":402},{"type":44,"tag":373,"props":1165,"children":1166},{"style":380},[1167],{"type":49,"value":407},{"type":44,"tag":373,"props":1169,"children":1170},{"style":410},[1171],{"type":49,"value":1172}," message\n",{"type":44,"tag":373,"props":1174,"children":1176},{"class":375,"line":1175},28,[1177,1181,1185],{"type":44,"tag":373,"props":1178,"children":1179},{"style":386},[1180],{"type":49,"value":422},{"type":44,"tag":373,"props":1182,"children":1183},{"style":380},[1184],{"type":49,"value":407},{"type":44,"tag":373,"props":1186,"children":1187},{"style":410},[1188],{"type":49,"value":1189}," rename_message_to_event_original\n",{"type":44,"tag":373,"props":1191,"children":1193},{"class":375,"line":1192},29,[1194,1199,1203],{"type":44,"tag":373,"props":1195,"children":1196},{"style":386},[1197],{"type":49,"value":1198},"      target_field",{"type":44,"tag":373,"props":1200,"children":1201},{"style":380},[1202],{"type":49,"value":407},{"type":44,"tag":373,"props":1204,"children":1205},{"style":410},[1206],{"type":49,"value":1207}," event.original\n",{"type":44,"tag":373,"props":1209,"children":1211},{"class":375,"line":1210},30,[1212,1216,1220],{"type":44,"tag":373,"props":1213,"children":1214},{"style":386},[1215],{"type":49,"value":965},{"type":44,"tag":373,"props":1217,"children":1218},{"style":380},[1219],{"type":49,"value":407},{"type":44,"tag":373,"props":1221,"children":1222},{"style":972},[1223],{"type":49,"value":975},{"type":44,"tag":373,"props":1225,"children":1227},{"class":375,"line":1226},31,[1228,1232,1236],{"type":44,"tag":373,"props":1229,"children":1230},{"style":386},[1231],{"type":49,"value":1019},{"type":44,"tag":373,"props":1233,"children":1234},{"style":380},[1235],{"type":49,"value":407},{"type":44,"tag":373,"props":1237,"children":1238},{"style":410},[1239],{"type":49,"value":1240}," Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.\n",{"type":44,"tag":373,"props":1242,"children":1244},{"class":375,"line":1243},32,[1245,1249,1253],{"type":44,"tag":373,"props":1246,"children":1247},{"style":386},[1248],{"type":49,"value":984},{"type":44,"tag":373,"props":1250,"children":1251},{"style":380},[1252],{"type":49,"value":407},{"type":44,"tag":373,"props":1254,"children":1255},{"style":410},[1256],{"type":49,"value":1257}," ctx.event?.original == null\n",{"type":44,"tag":373,"props":1259,"children":1261},{"class":375,"line":1260},33,[1262,1266,1270],{"type":44,"tag":373,"props":1263,"children":1264},{"style":380},[1265],{"type":49,"value":383},{"type":44,"tag":373,"props":1267,"children":1268},{"style":386},[1269],{"type":49,"value":901},{"type":44,"tag":373,"props":1271,"children":1272},{"style":380},[1273],{"type":49,"value":394},{"type":44,"tag":373,"props":1275,"children":1277},{"class":375,"line":1276},34,[1278,1282,1286],{"type":44,"tag":373,"props":1279,"children":1280},{"style":386},[1281],{"type":49,"value":402},{"type":44,"tag":373,"props":1283,"children":1284},{"style":380},[1285],{"type":49,"value":407},{"type":44,"tag":373,"props":1287,"children":1288},{"style":410},[1289],{"type":49,"value":1172},{"type":44,"tag":373,"props":1291,"children":1293},{"class":375,"line":1292},35,[1294,1298,1302],{"type":44,"tag":373,"props":1295,"children":1296},{"style":386},[1297],{"type":49,"value":422},{"type":44,"tag":373,"props":1299,"children":1300},{"style":380},[1301],{"type":49,"value":407},{"type":44,"tag":373,"props":1303,"children":1304},{"style":410},[1305],{"type":49,"value":1306}," remove_message\n",{"type":44,"tag":373,"props":1308,"children":1310},{"class":375,"line":1309},36,[1311,1315,1319],{"type":44,"tag":373,"props":1312,"children":1313},{"style":386},[1314],{"type":49,"value":965},{"type":44,"tag":373,"props":1316,"children":1317},{"style":380},[1318],{"type":49,"value":407},{"type":44,"tag":373,"props":1320,"children":1321},{"style":972},[1322],{"type":49,"value":975},{"type":44,"tag":373,"props":1324,"children":1326},{"class":375,"line":1325},37,[1327,1331,1335],{"type":44,"tag":373,"props":1328,"children":1329},{"style":386},[1330],{"type":49,"value":1019},{"type":44,"tag":373,"props":1332,"children":1333},{"style":380},[1334],{"type":49,"value":407},{"type":44,"tag":373,"props":1336,"children":1337},{"style":410},[1338],{"type":49,"value":1339}," The `message` field is no longer required if the document has an `event.original` field.\n",{"type":44,"tag":373,"props":1341,"children":1343},{"class":375,"line":1342},38,[1344,1348,1352],{"type":44,"tag":373,"props":1345,"children":1346},{"style":386},[1347],{"type":49,"value":984},{"type":44,"tag":373,"props":1349,"children":1350},{"style":380},[1351],{"type":49,"value":407},{"type":44,"tag":373,"props":1353,"children":1354},{"style":410},[1355],{"type":49,"value":1356}," ctx.event?.original != null\n",{"type":44,"tag":373,"props":1358,"children":1360},{"class":375,"line":1359},39,[1361],{"type":44,"tag":373,"props":1362,"children":1363},{"emptyLinePlaceholder":875},[1364],{"type":49,"value":878},{"type":44,"tag":373,"props":1366,"children":1368},{"class":375,"line":1367},40,[1369],{"type":44,"tag":373,"props":1370,"children":1371},{"style":885},[1372],{"type":49,"value":1373},"  # Parse (always read from event.original; do not modify event.original)\n",{"type":44,"tag":373,"props":1375,"children":1377},{"class":375,"line":1376},41,[1378,1382,1387],{"type":44,"tag":373,"props":1379,"children":1380},{"style":380},[1381],{"type":49,"value":383},{"type":44,"tag":373,"props":1383,"children":1384},{"style":386},[1385],{"type":49,"value":1386}," json",{"type":44,"tag":373,"props":1388,"children":1389},{"style":380},[1390],{"type":49,"value":394},{"type":44,"tag":373,"props":1392,"children":1394},{"class":375,"line":1393},42,[1395,1399,1403],{"type":44,"tag":373,"props":1396,"children":1397},{"style":386},[1398],{"type":49,"value":402},{"type":44,"tag":373,"props":1400,"children":1401},{"style":380},[1402],{"type":49,"value":407},{"type":44,"tag":373,"props":1404,"children":1405},{"style":410},[1406],{"type":49,"value":1207},{"type":44,"tag":373,"props":1408,"children":1410},{"class":375,"line":1409},43,[1411,1415,1419],{"type":44,"tag":373,"props":1412,"children":1413},{"style":386},[1414],{"type":49,"value":1198},{"type":44,"tag":373,"props":1416,"children":1417},{"style":380},[1418],{"type":49,"value":407},{"type":44,"tag":373,"props":1420,"children":1421},{"style":410},[1422],{"type":49,"value":1423}," json\n",{"type":44,"tag":373,"props":1425,"children":1427},{"class":375,"line":1426},44,[1428,1432,1436],{"type":44,"tag":373,"props":1429,"children":1430},{"style":386},[1431],{"type":49,"value":422},{"type":44,"tag":373,"props":1433,"children":1434},{"style":380},[1435],{"type":49,"value":407},{"type":44,"tag":373,"props":1437,"children":1438},{"style":410},[1439],{"type":49,"value":1440}," parse_json\n",{"type":44,"tag":373,"props":1442,"children":1444},{"class":375,"line":1443},45,[1445,1449,1453],{"type":44,"tag":373,"props":1446,"children":1447},{"style":386},[1448],{"type":49,"value":984},{"type":44,"tag":373,"props":1450,"children":1451},{"style":380},[1452],{"type":49,"value":407},{"type":44,"tag":373,"props":1454,"children":1455},{"style":410},[1456],{"type":49,"value":1356},{"type":44,"tag":373,"props":1458,"children":1460},{"class":375,"line":1459},46,[1461],{"type":44,"tag":373,"props":1462,"children":1463},{"emptyLinePlaceholder":875},[1464],{"type":49,"value":878},{"type":44,"tag":373,"props":1466,"children":1468},{"class":375,"line":1467},47,[1469],{"type":44,"tag":373,"props":1470,"children":1471},{"style":885},[1472],{"type":49,"value":1473},"  # ... normalize, enrich, ECS categorization, cleanup ...\n",{"type":44,"tag":373,"props":1475,"children":1477},{"class":375,"line":1476},48,[1478],{"type":44,"tag":373,"props":1479,"children":1480},{"emptyLinePlaceholder":875},[1481],{"type":49,"value":878},{"type":44,"tag":373,"props":1483,"children":1485},{"class":375,"line":1484},49,[1486,1490,1495],{"type":44,"tag":373,"props":1487,"children":1488},{"style":380},[1489],{"type":49,"value":383},{"type":44,"tag":373,"props":1491,"children":1492},{"style":386},[1493],{"type":49,"value":1494}," append",{"type":44,"tag":373,"props":1496,"children":1497},{"style":380},[1498],{"type":49,"value":394},{"type":44,"tag":373,"props":1500,"children":1502},{"class":375,"line":1501},50,[1503,1507,1511],{"type":44,"tag":373,"props":1504,"children":1505},{"style":386},[1506],{"type":49,"value":402},{"type":44,"tag":373,"props":1508,"children":1509},{"style":380},[1510],{"type":49,"value":407},{"type":44,"tag":373,"props":1512,"children":1513},{"style":410},[1514],{"type":49,"value":1515}," tags\n",{"type":44,"tag":373,"props":1517,"children":1519},{"class":375,"line":1518},51,[1520,1524,1528],{"type":44,"tag":373,"props":1521,"children":1522},{"style":386},[1523],{"type":49,"value":440},{"type":44,"tag":373,"props":1525,"children":1526},{"style":380},[1527],{"type":49,"value":407},{"type":44,"tag":373,"props":1529,"children":1530},{"style":410},[1531],{"type":49,"value":1532}," preserve_original_event\n",{"type":44,"tag":373,"props":1534,"children":1536},{"class":375,"line":1535},52,[1537,1542,1546],{"type":44,"tag":373,"props":1538,"children":1539},{"style":386},[1540],{"type":49,"value":1541},"      allow_duplicates",{"type":44,"tag":373,"props":1543,"children":1544},{"style":380},[1545],{"type":49,"value":407},{"type":44,"tag":373,"props":1547,"children":1548},{"style":972},[1549],{"type":49,"value":1550}," false\n",{"type":44,"tag":373,"props":1552,"children":1554},{"class":375,"line":1553},53,[1555,1559,1563],{"type":44,"tag":373,"props":1556,"children":1557},{"style":386},[1558],{"type":49,"value":984},{"type":44,"tag":373,"props":1560,"children":1561},{"style":380},[1562],{"type":49,"value":407},{"type":44,"tag":373,"props":1564,"children":1565},{"style":410},[1566],{"type":49,"value":1567}," ctx.error?.message != null\n",{"type":44,"tag":373,"props":1569,"children":1571},{"class":375,"line":1570},54,[1572],{"type":44,"tag":373,"props":1573,"children":1574},{"emptyLinePlaceholder":875},[1575],{"type":49,"value":878},{"type":44,"tag":373,"props":1577,"children":1579},{"class":375,"line":1578},55,[1580,1584],{"type":44,"tag":373,"props":1581,"children":1582},{"style":386},[1583],{"type":49,"value":188},{"type":44,"tag":373,"props":1585,"children":1586},{"style":380},[1587],{"type":49,"value":394},{"type":44,"tag":373,"props":1589,"children":1591},{"class":375,"line":1590},56,[1592,1596,1600],{"type":44,"tag":373,"props":1593,"children":1594},{"style":380},[1595],{"type":49,"value":383},{"type":44,"tag":373,"props":1597,"children":1598},{"style":386},[1599],{"type":49,"value":1494},{"type":44,"tag":373,"props":1601,"children":1602},{"style":380},[1603],{"type":49,"value":394},{"type":44,"tag":373,"props":1605,"children":1607},{"class":375,"line":1606},57,[1608,1612,1616],{"type":44,"tag":373,"props":1609,"children":1610},{"style":386},[1611],{"type":49,"value":402},{"type":44,"tag":373,"props":1613,"children":1614},{"style":380},[1615],{"type":49,"value":407},{"type":44,"tag":373,"props":1617,"children":1618},{"style":410},[1619],{"type":49,"value":1620}," error.message\n",{"type":44,"tag":373,"props":1622,"children":1624},{"class":375,"line":1623},58,[1625,1629,1633,1637],{"type":44,"tag":373,"props":1626,"children":1627},{"style":386},[1628],{"type":49,"value":440},{"type":44,"tag":373,"props":1630,"children":1631},{"style":380},[1632],{"type":49,"value":407},{"type":44,"tag":373,"props":1634,"children":1635},{"style":1026},[1636],{"type":49,"value":1029},{"type":44,"tag":373,"props":1638,"children":1639},{"style":1032},[1640],{"type":49,"value":1035},{"type":44,"tag":373,"props":1642,"children":1644},{"class":375,"line":1643},59,[1645],{"type":44,"tag":373,"props":1646,"children":1647},{"style":410},[1648],{"type":49,"value":1649},"        Processor '{{{ _ingest.on_failure_processor_type }}}'\n",{"type":44,"tag":373,"props":1651,"children":1653},{"class":375,"line":1652},60,[1654],{"type":44,"tag":373,"props":1655,"children":1656},{"style":410},[1657],{"type":49,"value":1658},"        {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'\n",{"type":44,"tag":373,"props":1660,"children":1662},{"class":375,"line":1661},61,[1663],{"type":44,"tag":373,"props":1664,"children":1665},{"style":410},[1666],{"type":49,"value":1667},"        {{{\u002F_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}'\n",{"type":44,"tag":373,"props":1669,"children":1671},{"class":375,"line":1670},62,[1672,1676,1680],{"type":44,"tag":373,"props":1673,"children":1674},{"style":380},[1675],{"type":49,"value":383},{"type":44,"tag":373,"props":1677,"children":1678},{"style":386},[1679],{"type":49,"value":389},{"type":44,"tag":373,"props":1681,"children":1682},{"style":380},[1683],{"type":49,"value":394},{"type":44,"tag":373,"props":1685,"children":1687},{"class":375,"line":1686},63,[1688,1692,1696],{"type":44,"tag":373,"props":1689,"children":1690},{"style":386},[1691],{"type":49,"value":402},{"type":44,"tag":373,"props":1693,"children":1694},{"style":380},[1695],{"type":49,"value":407},{"type":44,"tag":373,"props":1697,"children":1698},{"style":410},[1699],{"type":49,"value":1700}," event.kind\n",{"type":44,"tag":373,"props":1702,"children":1704},{"class":375,"line":1703},64,[1705,1709,1713],{"type":44,"tag":373,"props":1706,"children":1707},{"style":386},[1708],{"type":49,"value":422},{"type":44,"tag":373,"props":1710,"children":1711},{"style":380},[1712],{"type":49,"value":407},{"type":44,"tag":373,"props":1714,"children":1715},{"style":410},[1716],{"type":49,"value":1717}," set_pipeline_error_to_event_kind\n",{"type":44,"tag":373,"props":1719,"children":1721},{"class":375,"line":1720},65,[1722,1726,1730],{"type":44,"tag":373,"props":1723,"children":1724},{"style":386},[1725],{"type":49,"value":440},{"type":44,"tag":373,"props":1727,"children":1728},{"style":380},[1729],{"type":49,"value":407},{"type":44,"tag":373,"props":1731,"children":1732},{"style":410},[1733],{"type":49,"value":1734}," pipeline_error\n",{"type":44,"tag":373,"props":1736,"children":1738},{"class":375,"line":1737},66,[1739,1743,1747],{"type":44,"tag":373,"props":1740,"children":1741},{"style":380},[1742],{"type":49,"value":383},{"type":44,"tag":373,"props":1744,"children":1745},{"style":386},[1746],{"type":49,"value":1494},{"type":44,"tag":373,"props":1748,"children":1749},{"style":380},[1750],{"type":49,"value":394},{"type":44,"tag":373,"props":1752,"children":1754},{"class":375,"line":1753},67,[1755,1759,1763],{"type":44,"tag":373,"props":1756,"children":1757},{"style":386},[1758],{"type":49,"value":402},{"type":44,"tag":373,"props":1760,"children":1761},{"style":380},[1762],{"type":49,"value":407},{"type":44,"tag":373,"props":1764,"children":1765},{"style":410},[1766],{"type":49,"value":1515},{"type":44,"tag":373,"props":1768,"children":1770},{"class":375,"line":1769},68,[1771,1775,1779],{"type":44,"tag":373,"props":1772,"children":1773},{"style":386},[1774],{"type":49,"value":440},{"type":44,"tag":373,"props":1776,"children":1777},{"style":380},[1778],{"type":49,"value":407},{"type":44,"tag":373,"props":1780,"children":1781},{"style":410},[1782],{"type":49,"value":1532},{"type":44,"tag":373,"props":1784,"children":1786},{"class":375,"line":1785},69,[1787,1791,1795],{"type":44,"tag":373,"props":1788,"children":1789},{"style":386},[1790],{"type":49,"value":1541},{"type":44,"tag":373,"props":1792,"children":1793},{"style":380},[1794],{"type":49,"value":407},{"type":44,"tag":373,"props":1796,"children":1797},{"style":972},[1798],{"type":49,"value":1550},{"type":44,"tag":51,"props":1800,"children":1802},{"id":1801},"single-path-pattern-linear-pipeline",[1803],{"type":49,"value":1804},"Single-path pattern (linear pipeline)",{"type":44,"tag":58,"props":1806,"children":1807},{},[1808,1810,1815,1817,1822,1824,1829,1831,1841,1843,1862],{"type":49,"value":1809},"Use this pattern when one parser flow handles all events. Combine the ",{"type":44,"tag":64,"props":1811,"children":1812},{},[1813],{"type":49,"value":1814},"standard opening",{"type":49,"value":1816}," (ECS version, optional CEL-only block, JSE00001 rename\u002Fremove, parse from ",{"type":44,"tag":72,"props":1818,"children":1820},{"className":1819},[],[1821],{"type":49,"value":581},{"type":49,"value":1823}," without mutating it), middle processors with ",{"type":44,"tag":64,"props":1825,"children":1826},{},[1827],{"type":49,"value":1828},"tags on every step",{"type":49,"value":1830},", and the ",{"type":44,"tag":64,"props":1832,"children":1833},{},[1834,1836],{"type":49,"value":1835},"pipeline-level ",{"type":44,"tag":72,"props":1837,"children":1839},{"className":1838},[],[1840],{"type":49,"value":188},{"type":49,"value":1842}," and ",{"type":44,"tag":64,"props":1844,"children":1845},{},[1846,1848,1854,1856],{"type":49,"value":1847},"conditional ",{"type":44,"tag":72,"props":1849,"children":1851},{"className":1850},[],[1852],{"type":49,"value":1853},"append",{"type":49,"value":1855}," for ",{"type":44,"tag":72,"props":1857,"children":1859},{"className":1858},[],[1860],{"type":49,"value":1861},"preserve_original_event",{"type":49,"value":1863}," shown above.",{"type":44,"tag":58,"props":1865,"children":1866},{},[1867],{"type":49,"value":1868},"Example middle section (illustrative):",{"type":44,"tag":362,"props":1870,"children":1872},{"className":364,"code":1871,"language":366,"meta":367,"style":367},"  - grok:\n      field: event.original\n      patterns:\n        - '^...$'\n      tag: parse_main\n\n  - date:\n      field: some.time\n      target_field: '@timestamp'\n      formats: [ISO8601]\n      tag: parse_timestamp\n  - convert:\n      field: http.response.status_code\n      type: long\n      ignore_missing: true\n      tag: convert_status\n\n  - user_agent:\n      field: user_agent.original\n      ignore_missing: true\n      tag: enrich_user_agent\n  - geoip:\n      field: source.ip\n      target_field: source.geo\n      ignore_missing: true\n      tag: enrich_source_geo\n  - geoip:\n      database_file: GeoLite2-ASN.mmdb\n      field: source.ip\n      target_field: source.as\n      properties:\n        - asn\n        - organization_name\n      ignore_missing: true\n      tag: enrich_source_asn\n  - rename:\n      field: source.as.asn\n      target_field: source.as.number\n      ignore_missing: true\n      tag: rename_source_asn\n  - rename:\n      field: source.as.organization_name\n      target_field: source.as.organization.name\n      ignore_missing: true\n      tag: rename_source_as_org\n\n  - set:\n      field: event.kind\n      tag: set_event_kind\n      value: event\n  - append:\n      field: event.category\n      tag: append_event_category_web\n      value: web\n  - remove:\n      field: temp\n      ignore_missing: true\n      tag: remove_temp\n",[1873],{"type":44,"tag":72,"props":1874,"children":1875},{"__ignoreMap":367},[1876,1892,1907,1919,1939,1955,1962,1978,1994,2018,2045,2061,2077,2093,2110,2125,2141,2148,2164,2180,2195,2211,2227,2243,2259,2274,2290,2305,2322,2337,2353,2365,2377,2389,2404,2420,2435,2451,2467,2482,2498,2513,2529,2545,2560,2576,2583,2598,2613,2629,2645,2660,2676,2692,2708,2723,2739,2754],{"type":44,"tag":373,"props":1877,"children":1878},{"class":375,"line":376},[1879,1883,1888],{"type":44,"tag":373,"props":1880,"children":1881},{"style":380},[1882],{"type":49,"value":383},{"type":44,"tag":373,"props":1884,"children":1885},{"style":386},[1886],{"type":49,"value":1887}," grok",{"type":44,"tag":373,"props":1889,"children":1890},{"style":380},[1891],{"type":49,"value":394},{"type":44,"tag":373,"props":1893,"children":1894},{"class":375,"line":29},[1895,1899,1903],{"type":44,"tag":373,"props":1896,"children":1897},{"style":386},[1898],{"type":49,"value":402},{"type":44,"tag":373,"props":1900,"children":1901},{"style":380},[1902],{"type":49,"value":407},{"type":44,"tag":373,"props":1904,"children":1905},{"style":410},[1906],{"type":49,"value":1207},{"type":44,"tag":373,"props":1908,"children":1909},{"class":375,"line":416},[1910,1915],{"type":44,"tag":373,"props":1911,"children":1912},{"style":386},[1913],{"type":49,"value":1914},"      patterns",{"type":44,"tag":373,"props":1916,"children":1917},{"style":380},[1918],{"type":49,"value":394},{"type":44,"tag":373,"props":1920,"children":1921},{"class":375,"line":434},[1922,1926,1930,1935],{"type":44,"tag":373,"props":1923,"children":1924},{"style":380},[1925],{"type":49,"value":925},{"type":44,"tag":373,"props":1927,"children":1928},{"style":380},[1929],{"type":49,"value":449},{"type":44,"tag":373,"props":1931,"children":1932},{"style":410},[1933],{"type":49,"value":1934},"^...$",{"type":44,"tag":373,"props":1936,"children":1937},{"style":380},[1938],{"type":49,"value":458},{"type":44,"tag":373,"props":1940,"children":1941},{"class":375,"line":831},[1942,1946,1950],{"type":44,"tag":373,"props":1943,"children":1944},{"style":386},[1945],{"type":49,"value":422},{"type":44,"tag":373,"props":1947,"children":1948},{"style":380},[1949],{"type":49,"value":407},{"type":44,"tag":373,"props":1951,"children":1952},{"style":410},[1953],{"type":49,"value":1954}," parse_main\n",{"type":44,"tag":373,"props":1956,"children":1957},{"class":375,"line":847},[1958],{"type":44,"tag":373,"props":1959,"children":1960},{"emptyLinePlaceholder":875},[1961],{"type":49,"value":878},{"type":44,"tag":373,"props":1963,"children":1964},{"class":375,"line":871},[1965,1969,1974],{"type":44,"tag":373,"props":1966,"children":1967},{"style":380},[1968],{"type":49,"value":383},{"type":44,"tag":373,"props":1970,"children":1971},{"style":386},[1972],{"type":49,"value":1973}," date",{"type":44,"tag":373,"props":1975,"children":1976},{"style":380},[1977],{"type":49,"value":394},{"type":44,"tag":373,"props":1979,"children":1980},{"class":375,"line":881},[1981,1985,1989],{"type":44,"tag":373,"props":1982,"children":1983},{"style":386},[1984],{"type":49,"value":402},{"type":44,"tag":373,"props":1986,"children":1987},{"style":380},[1988],{"type":49,"value":407},{"type":44,"tag":373,"props":1990,"children":1991},{"style":410},[1992],{"type":49,"value":1993}," some.time\n",{"type":44,"tag":373,"props":1995,"children":1996},{"class":375,"line":891},[1997,2001,2005,2009,2014],{"type":44,"tag":373,"props":1998,"children":1999},{"style":386},[2000],{"type":49,"value":1198},{"type":44,"tag":373,"props":2002,"children":2003},{"style":380},[2004],{"type":49,"value":407},{"type":44,"tag":373,"props":2006,"children":2007},{"style":380},[2008],{"type":49,"value":449},{"type":44,"tag":373,"props":2010,"children":2011},{"style":410},[2012],{"type":49,"value":2013},"@timestamp",{"type":44,"tag":373,"props":2015,"children":2016},{"style":380},[2017],{"type":49,"value":458},{"type":44,"tag":373,"props":2019,"children":2020},{"class":375,"line":908},[2021,2026,2030,2035,2040],{"type":44,"tag":373,"props":2022,"children":2023},{"style":386},[2024],{"type":49,"value":2025},"      formats",{"type":44,"tag":373,"props":2027,"children":2028},{"style":380},[2029],{"type":49,"value":407},{"type":44,"tag":373,"props":2031,"children":2032},{"style":380},[2033],{"type":49,"value":2034}," [",{"type":44,"tag":373,"props":2036,"children":2037},{"style":410},[2038],{"type":49,"value":2039},"ISO8601",{"type":44,"tag":373,"props":2041,"children":2042},{"style":380},[2043],{"type":49,"value":2044},"]\n",{"type":44,"tag":373,"props":2046,"children":2047},{"class":375,"line":25},[2048,2052,2056],{"type":44,"tag":373,"props":2049,"children":2050},{"style":386},[2051],{"type":49,"value":422},{"type":44,"tag":373,"props":2053,"children":2054},{"style":380},[2055],{"type":49,"value":407},{"type":44,"tag":373,"props":2057,"children":2058},{"style":410},[2059],{"type":49,"value":2060}," parse_timestamp\n",{"type":44,"tag":373,"props":2062,"children":2063},{"class":375,"line":933},[2064,2068,2073],{"type":44,"tag":373,"props":2065,"children":2066},{"style":380},[2067],{"type":49,"value":383},{"type":44,"tag":373,"props":2069,"children":2070},{"style":386},[2071],{"type":49,"value":2072}," convert",{"type":44,"tag":373,"props":2074,"children":2075},{"style":380},[2076],{"type":49,"value":394},{"type":44,"tag":373,"props":2078,"children":2079},{"class":375,"line":946},[2080,2084,2088],{"type":44,"tag":373,"props":2081,"children":2082},{"style":386},[2083],{"type":49,"value":402},{"type":44,"tag":373,"props":2085,"children":2086},{"style":380},[2087],{"type":49,"value":407},{"type":44,"tag":373,"props":2089,"children":2090},{"style":410},[2091],{"type":49,"value":2092}," http.response.status_code\n",{"type":44,"tag":373,"props":2094,"children":2095},{"class":375,"line":959},[2096,2101,2105],{"type":44,"tag":373,"props":2097,"children":2098},{"style":386},[2099],{"type":49,"value":2100},"      type",{"type":44,"tag":373,"props":2102,"children":2103},{"style":380},[2104],{"type":49,"value":407},{"type":44,"tag":373,"props":2106,"children":2107},{"style":410},[2108],{"type":49,"value":2109}," long\n",{"type":44,"tag":373,"props":2111,"children":2112},{"class":375,"line":978},[2113,2117,2121],{"type":44,"tag":373,"props":2114,"children":2115},{"style":386},[2116],{"type":49,"value":965},{"type":44,"tag":373,"props":2118,"children":2119},{"style":380},[2120],{"type":49,"value":407},{"type":44,"tag":373,"props":2122,"children":2123},{"style":972},[2124],{"type":49,"value":975},{"type":44,"tag":373,"props":2126,"children":2127},{"class":375,"line":996},[2128,2132,2136],{"type":44,"tag":373,"props":2129,"children":2130},{"style":386},[2131],{"type":49,"value":422},{"type":44,"tag":373,"props":2133,"children":2134},{"style":380},[2135],{"type":49,"value":407},{"type":44,"tag":373,"props":2137,"children":2138},{"style":410},[2139],{"type":49,"value":2140}," convert_status\n",{"type":44,"tag":373,"props":2142,"children":2143},{"class":375,"line":1013},[2144],{"type":44,"tag":373,"props":2145,"children":2146},{"emptyLinePlaceholder":875},[2147],{"type":49,"value":878},{"type":44,"tag":373,"props":2149,"children":2150},{"class":375,"line":1038},[2151,2155,2160],{"type":44,"tag":373,"props":2152,"children":2153},{"style":380},[2154],{"type":49,"value":383},{"type":44,"tag":373,"props":2156,"children":2157},{"style":386},[2158],{"type":49,"value":2159}," user_agent",{"type":44,"tag":373,"props":2161,"children":2162},{"style":380},[2163],{"type":49,"value":394},{"type":44,"tag":373,"props":2165,"children":2166},{"class":375,"line":1047},[2167,2171,2175],{"type":44,"tag":373,"props":2168,"children":2169},{"style":386},[2170],{"type":49,"value":402},{"type":44,"tag":373,"props":2172,"children":2173},{"style":380},[2174],{"type":49,"value":407},{"type":44,"tag":373,"props":2176,"children":2177},{"style":410},[2178],{"type":49,"value":2179}," user_agent.original\n",{"type":44,"tag":373,"props":2181,"children":2182},{"class":375,"line":1056},[2183,2187,2191],{"type":44,"tag":373,"props":2184,"children":2185},{"style":386},[2186],{"type":49,"value":965},{"type":44,"tag":373,"props":2188,"children":2189},{"style":380},[2190],{"type":49,"value":407},{"type":44,"tag":373,"props":2192,"children":2193},{"style":972},[2194],{"type":49,"value":975},{"type":44,"tag":373,"props":2196,"children":2197},{"class":375,"line":1073},[2198,2202,2206],{"type":44,"tag":373,"props":2199,"children":2200},{"style":386},[2201],{"type":49,"value":422},{"type":44,"tag":373,"props":2203,"children":2204},{"style":380},[2205],{"type":49,"value":407},{"type":44,"tag":373,"props":2207,"children":2208},{"style":410},[2209],{"type":49,"value":2210}," enrich_user_agent\n",{"type":44,"tag":373,"props":2212,"children":2213},{"class":375,"line":1090},[2214,2218,2223],{"type":44,"tag":373,"props":2215,"children":2216},{"style":380},[2217],{"type":49,"value":383},{"type":44,"tag":373,"props":2219,"children":2220},{"style":386},[2221],{"type":49,"value":2222}," geoip",{"type":44,"tag":373,"props":2224,"children":2225},{"style":380},[2226],{"type":49,"value":394},{"type":44,"tag":373,"props":2228,"children":2229},{"class":375,"line":1107},[2230,2234,2238],{"type":44,"tag":373,"props":2231,"children":2232},{"style":386},[2233],{"type":49,"value":402},{"type":44,"tag":373,"props":2235,"children":2236},{"style":380},[2237],{"type":49,"value":407},{"type":44,"tag":373,"props":2239,"children":2240},{"style":410},[2241],{"type":49,"value":2242}," source.ip\n",{"type":44,"tag":373,"props":2244,"children":2245},{"class":375,"line":1124},[2246,2250,2254],{"type":44,"tag":373,"props":2247,"children":2248},{"style":386},[2249],{"type":49,"value":1198},{"type":44,"tag":373,"props":2251,"children":2252},{"style":380},[2253],{"type":49,"value":407},{"type":44,"tag":373,"props":2255,"children":2256},{"style":410},[2257],{"type":49,"value":2258}," source.geo\n",{"type":44,"tag":373,"props":2260,"children":2261},{"class":375,"line":1133},[2262,2266,2270],{"type":44,"tag":373,"props":2263,"children":2264},{"style":386},[2265],{"type":49,"value":965},{"type":44,"tag":373,"props":2267,"children":2268},{"style":380},[2269],{"type":49,"value":407},{"type":44,"tag":373,"props":2271,"children":2272},{"style":972},[2273],{"type":49,"value":975},{"type":44,"tag":373,"props":2275,"children":2276},{"class":375,"line":1141},[2277,2281,2285],{"type":44,"tag":373,"props":2278,"children":2279},{"style":386},[2280],{"type":49,"value":422},{"type":44,"tag":373,"props":2282,"children":2283},{"style":380},[2284],{"type":49,"value":407},{"type":44,"tag":373,"props":2286,"children":2287},{"style":410},[2288],{"type":49,"value":2289}," enrich_source_geo\n",{"type":44,"tag":373,"props":2291,"children":2292},{"class":375,"line":1158},[2293,2297,2301],{"type":44,"tag":373,"props":2294,"children":2295},{"style":380},[2296],{"type":49,"value":383},{"type":44,"tag":373,"props":2298,"children":2299},{"style":386},[2300],{"type":49,"value":2222},{"type":44,"tag":373,"props":2302,"children":2303},{"style":380},[2304],{"type":49,"value":394},{"type":44,"tag":373,"props":2306,"children":2307},{"class":375,"line":1175},[2308,2313,2317],{"type":44,"tag":373,"props":2309,"children":2310},{"style":386},[2311],{"type":49,"value":2312},"      database_file",{"type":44,"tag":373,"props":2314,"children":2315},{"style":380},[2316],{"type":49,"value":407},{"type":44,"tag":373,"props":2318,"children":2319},{"style":410},[2320],{"type":49,"value":2321}," GeoLite2-ASN.mmdb\n",{"type":44,"tag":373,"props":2323,"children":2324},{"class":375,"line":1192},[2325,2329,2333],{"type":44,"tag":373,"props":2326,"children":2327},{"style":386},[2328],{"type":49,"value":402},{"type":44,"tag":373,"props":2330,"children":2331},{"style":380},[2332],{"type":49,"value":407},{"type":44,"tag":373,"props":2334,"children":2335},{"style":410},[2336],{"type":49,"value":2242},{"type":44,"tag":373,"props":2338,"children":2339},{"class":375,"line":1210},[2340,2344,2348],{"type":44,"tag":373,"props":2341,"children":2342},{"style":386},[2343],{"type":49,"value":1198},{"type":44,"tag":373,"props":2345,"children":2346},{"style":380},[2347],{"type":49,"value":407},{"type":44,"tag":373,"props":2349,"children":2350},{"style":410},[2351],{"type":49,"value":2352}," source.as\n",{"type":44,"tag":373,"props":2354,"children":2355},{"class":375,"line":1226},[2356,2361],{"type":44,"tag":373,"props":2357,"children":2358},{"style":386},[2359],{"type":49,"value":2360},"      properties",{"type":44,"tag":373,"props":2362,"children":2363},{"style":380},[2364],{"type":49,"value":394},{"type":44,"tag":373,"props":2366,"children":2367},{"class":375,"line":1243},[2368,2372],{"type":44,"tag":373,"props":2369,"children":2370},{"style":380},[2371],{"type":49,"value":925},{"type":44,"tag":373,"props":2373,"children":2374},{"style":410},[2375],{"type":49,"value":2376}," asn\n",{"type":44,"tag":373,"props":2378,"children":2379},{"class":375,"line":1260},[2380,2384],{"type":44,"tag":373,"props":2381,"children":2382},{"style":380},[2383],{"type":49,"value":925},{"type":44,"tag":373,"props":2385,"children":2386},{"style":410},[2387],{"type":49,"value":2388}," organization_name\n",{"type":44,"tag":373,"props":2390,"children":2391},{"class":375,"line":1276},[2392,2396,2400],{"type":44,"tag":373,"props":2393,"children":2394},{"style":386},[2395],{"type":49,"value":965},{"type":44,"tag":373,"props":2397,"children":2398},{"style":380},[2399],{"type":49,"value":407},{"type":44,"tag":373,"props":2401,"children":2402},{"style":972},[2403],{"type":49,"value":975},{"type":44,"tag":373,"props":2405,"children":2406},{"class":375,"line":1292},[2407,2411,2415],{"type":44,"tag":373,"props":2408,"children":2409},{"style":386},[2410],{"type":49,"value":422},{"type":44,"tag":373,"props":2412,"children":2413},{"style":380},[2414],{"type":49,"value":407},{"type":44,"tag":373,"props":2416,"children":2417},{"style":410},[2418],{"type":49,"value":2419}," enrich_source_asn\n",{"type":44,"tag":373,"props":2421,"children":2422},{"class":375,"line":1309},[2423,2427,2431],{"type":44,"tag":373,"props":2424,"children":2425},{"style":380},[2426],{"type":49,"value":383},{"type":44,"tag":373,"props":2428,"children":2429},{"style":386},[2430],{"type":49,"value":1151},{"type":44,"tag":373,"props":2432,"children":2433},{"style":380},[2434],{"type":49,"value":394},{"type":44,"tag":373,"props":2436,"children":2437},{"class":375,"line":1325},[2438,2442,2446],{"type":44,"tag":373,"props":2439,"children":2440},{"style":386},[2441],{"type":49,"value":402},{"type":44,"tag":373,"props":2443,"children":2444},{"style":380},[2445],{"type":49,"value":407},{"type":44,"tag":373,"props":2447,"children":2448},{"style":410},[2449],{"type":49,"value":2450}," source.as.asn\n",{"type":44,"tag":373,"props":2452,"children":2453},{"class":375,"line":1342},[2454,2458,2462],{"type":44,"tag":373,"props":2455,"children":2456},{"style":386},[2457],{"type":49,"value":1198},{"type":44,"tag":373,"props":2459,"children":2460},{"style":380},[2461],{"type":49,"value":407},{"type":44,"tag":373,"props":2463,"children":2464},{"style":410},[2465],{"type":49,"value":2466}," source.as.number\n",{"type":44,"tag":373,"props":2468,"children":2469},{"class":375,"line":1359},[2470,2474,2478],{"type":44,"tag":373,"props":2471,"children":2472},{"style":386},[2473],{"type":49,"value":965},{"type":44,"tag":373,"props":2475,"children":2476},{"style":380},[2477],{"type":49,"value":407},{"type":44,"tag":373,"props":2479,"children":2480},{"style":972},[2481],{"type":49,"value":975},{"type":44,"tag":373,"props":2483,"children":2484},{"class":375,"line":1367},[2485,2489,2493],{"type":44,"tag":373,"props":2486,"children":2487},{"style":386},[2488],{"type":49,"value":422},{"type":44,"tag":373,"props":2490,"children":2491},{"style":380},[2492],{"type":49,"value":407},{"type":44,"tag":373,"props":2494,"children":2495},{"style":410},[2496],{"type":49,"value":2497}," rename_source_asn\n",{"type":44,"tag":373,"props":2499,"children":2500},{"class":375,"line":1376},[2501,2505,2509],{"type":44,"tag":373,"props":2502,"children":2503},{"style":380},[2504],{"type":49,"value":383},{"type":44,"tag":373,"props":2506,"children":2507},{"style":386},[2508],{"type":49,"value":1151},{"type":44,"tag":373,"props":2510,"children":2511},{"style":380},[2512],{"type":49,"value":394},{"type":44,"tag":373,"props":2514,"children":2515},{"class":375,"line":1393},[2516,2520,2524],{"type":44,"tag":373,"props":2517,"children":2518},{"style":386},[2519],{"type":49,"value":402},{"type":44,"tag":373,"props":2521,"children":2522},{"style":380},[2523],{"type":49,"value":407},{"type":44,"tag":373,"props":2525,"children":2526},{"style":410},[2527],{"type":49,"value":2528}," source.as.organization_name\n",{"type":44,"tag":373,"props":2530,"children":2531},{"class":375,"line":1409},[2532,2536,2540],{"type":44,"tag":373,"props":2533,"children":2534},{"style":386},[2535],{"type":49,"value":1198},{"type":44,"tag":373,"props":2537,"children":2538},{"style":380},[2539],{"type":49,"value":407},{"type":44,"tag":373,"props":2541,"children":2542},{"style":410},[2543],{"type":49,"value":2544}," source.as.organization.name\n",{"type":44,"tag":373,"props":2546,"children":2547},{"class":375,"line":1426},[2548,2552,2556],{"type":44,"tag":373,"props":2549,"children":2550},{"style":386},[2551],{"type":49,"value":965},{"type":44,"tag":373,"props":2553,"children":2554},{"style":380},[2555],{"type":49,"value":407},{"type":44,"tag":373,"props":2557,"children":2558},{"style":972},[2559],{"type":49,"value":975},{"type":44,"tag":373,"props":2561,"children":2562},{"class":375,"line":1443},[2563,2567,2571],{"type":44,"tag":373,"props":2564,"children":2565},{"style":386},[2566],{"type":49,"value":422},{"type":44,"tag":373,"props":2568,"children":2569},{"style":380},[2570],{"type":49,"value":407},{"type":44,"tag":373,"props":2572,"children":2573},{"style":410},[2574],{"type":49,"value":2575}," rename_source_as_org\n",{"type":44,"tag":373,"props":2577,"children":2578},{"class":375,"line":1459},[2579],{"type":44,"tag":373,"props":2580,"children":2581},{"emptyLinePlaceholder":875},[2582],{"type":49,"value":878},{"type":44,"tag":373,"props":2584,"children":2585},{"class":375,"line":1467},[2586,2590,2594],{"type":44,"tag":373,"props":2587,"children":2588},{"style":380},[2589],{"type":49,"value":383},{"type":44,"tag":373,"props":2591,"children":2592},{"style":386},[2593],{"type":49,"value":389},{"type":44,"tag":373,"props":2595,"children":2596},{"style":380},[2597],{"type":49,"value":394},{"type":44,"tag":373,"props":2599,"children":2600},{"class":375,"line":1476},[2601,2605,2609],{"type":44,"tag":373,"props":2602,"children":2603},{"style":386},[2604],{"type":49,"value":402},{"type":44,"tag":373,"props":2606,"children":2607},{"style":380},[2608],{"type":49,"value":407},{"type":44,"tag":373,"props":2610,"children":2611},{"style":410},[2612],{"type":49,"value":1700},{"type":44,"tag":373,"props":2614,"children":2615},{"class":375,"line":1484},[2616,2620,2624],{"type":44,"tag":373,"props":2617,"children":2618},{"style":386},[2619],{"type":49,"value":422},{"type":44,"tag":373,"props":2621,"children":2622},{"style":380},[2623],{"type":49,"value":407},{"type":44,"tag":373,"props":2625,"children":2626},{"style":410},[2627],{"type":49,"value":2628}," set_event_kind\n",{"type":44,"tag":373,"props":2630,"children":2631},{"class":375,"line":1501},[2632,2636,2640],{"type":44,"tag":373,"props":2633,"children":2634},{"style":386},[2635],{"type":49,"value":440},{"type":44,"tag":373,"props":2637,"children":2638},{"style":380},[2639],{"type":49,"value":407},{"type":44,"tag":373,"props":2641,"children":2642},{"style":410},[2643],{"type":49,"value":2644}," event\n",{"type":44,"tag":373,"props":2646,"children":2647},{"class":375,"line":1518},[2648,2652,2656],{"type":44,"tag":373,"props":2649,"children":2650},{"style":380},[2651],{"type":49,"value":383},{"type":44,"tag":373,"props":2653,"children":2654},{"style":386},[2655],{"type":49,"value":1494},{"type":44,"tag":373,"props":2657,"children":2658},{"style":380},[2659],{"type":49,"value":394},{"type":44,"tag":373,"props":2661,"children":2662},{"class":375,"line":1535},[2663,2667,2671],{"type":44,"tag":373,"props":2664,"children":2665},{"style":386},[2666],{"type":49,"value":402},{"type":44,"tag":373,"props":2668,"children":2669},{"style":380},[2670],{"type":49,"value":407},{"type":44,"tag":373,"props":2672,"children":2673},{"style":410},[2674],{"type":49,"value":2675}," event.category\n",{"type":44,"tag":373,"props":2677,"children":2678},{"class":375,"line":1553},[2679,2683,2687],{"type":44,"tag":373,"props":2680,"children":2681},{"style":386},[2682],{"type":49,"value":422},{"type":44,"tag":373,"props":2684,"children":2685},{"style":380},[2686],{"type":49,"value":407},{"type":44,"tag":373,"props":2688,"children":2689},{"style":410},[2690],{"type":49,"value":2691}," append_event_category_web\n",{"type":44,"tag":373,"props":2693,"children":2694},{"class":375,"line":1570},[2695,2699,2703],{"type":44,"tag":373,"props":2696,"children":2697},{"style":386},[2698],{"type":49,"value":440},{"type":44,"tag":373,"props":2700,"children":2701},{"style":380},[2702],{"type":49,"value":407},{"type":44,"tag":373,"props":2704,"children":2705},{"style":410},[2706],{"type":49,"value":2707}," web\n",{"type":44,"tag":373,"props":2709,"children":2710},{"class":375,"line":1578},[2711,2715,2719],{"type":44,"tag":373,"props":2712,"children":2713},{"style":380},[2714],{"type":49,"value":383},{"type":44,"tag":373,"props":2716,"children":2717},{"style":386},[2718],{"type":49,"value":901},{"type":44,"tag":373,"props":2720,"children":2721},{"style":380},[2722],{"type":49,"value":394},{"type":44,"tag":373,"props":2724,"children":2725},{"class":375,"line":1590},[2726,2730,2734],{"type":44,"tag":373,"props":2727,"children":2728},{"style":386},[2729],{"type":49,"value":402},{"type":44,"tag":373,"props":2731,"children":2732},{"style":380},[2733],{"type":49,"value":407},{"type":44,"tag":373,"props":2735,"children":2736},{"style":410},[2737],{"type":49,"value":2738}," temp\n",{"type":44,"tag":373,"props":2740,"children":2741},{"class":375,"line":1606},[2742,2746,2750],{"type":44,"tag":373,"props":2743,"children":2744},{"style":386},[2745],{"type":49,"value":965},{"type":44,"tag":373,"props":2747,"children":2748},{"style":380},[2749],{"type":49,"value":407},{"type":44,"tag":373,"props":2751,"children":2752},{"style":972},[2753],{"type":49,"value":975},{"type":44,"tag":373,"props":2755,"children":2756},{"class":375,"line":1623},[2757,2761,2765],{"type":44,"tag":373,"props":2758,"children":2759},{"style":386},[2760],{"type":49,"value":422},{"type":44,"tag":373,"props":2762,"children":2763},{"style":380},[2764],{"type":49,"value":407},{"type":44,"tag":373,"props":2766,"children":2767},{"style":410},[2768],{"type":49,"value":2769}," remove_temp\n",{"type":44,"tag":51,"props":2771,"children":2773},{"id":2772},"branching-pattern-router-sub-pipelines",[2774],{"type":49,"value":2775},"Branching pattern (router + sub-pipelines)",{"type":44,"tag":58,"props":2777,"children":2778},{},[2779],{"type":49,"value":2780},"Use branching when event formats or object models diverge:",{"type":44,"tag":99,"props":2782,"children":2783},{},[2784,2789,2794],{"type":44,"tag":103,"props":2785,"children":2786},{},[2787],{"type":49,"value":2788},"format-based branching (for example JSON vs text)",{"type":44,"tag":103,"props":2790,"children":2791},{},[2792],{"type":49,"value":2793},"class\u002Fcategory-based branching (for example OCSF class\u002Fcategory routing)",{"type":44,"tag":103,"props":2795,"children":2796},{},[2797,2799,2805],{"type":49,"value":2798},"object-presence branching (",{"type":44,"tag":72,"props":2800,"children":2802},{"className":2801},[],[2803],{"type":49,"value":2804},"ctx.ocsf.user != null",{"type":49,"value":164},{"type":44,"tag":58,"props":2807,"children":2808},{},[2809],{"type":49,"value":2810},"Pattern:",{"type":44,"tag":362,"props":2812,"children":2814},{"className":364,"code":2813,"language":366,"meta":367,"style":367},"processors:\n  - pipeline:\n      name: '{{ IngestPipeline \"pipeline_branch_json\" }}'\n      if: ctx.event?.original != null && ctx.event.original.startsWith('{')\n      ignore_missing_pipeline: true\n      tag: route_json\n  - pipeline:\n      name: '{{ IngestPipeline \"pipeline_branch_text\" }}'\n      if: ctx.event?.original != null && !ctx.event.original.startsWith('{')\n      ignore_missing_pipeline: true\n      tag: route_text\n",[2815],{"type":44,"tag":72,"props":2816,"children":2817},{"__ignoreMap":367},[2818,2829,2845,2870,2886,2902,2918,2933,2957,2973,2988],{"type":44,"tag":373,"props":2819,"children":2820},{"class":375,"line":376},[2821,2825],{"type":44,"tag":373,"props":2822,"children":2823},{"style":386},[2824],{"type":49,"value":305},{"type":44,"tag":373,"props":2826,"children":2827},{"style":380},[2828],{"type":49,"value":394},{"type":44,"tag":373,"props":2830,"children":2831},{"class":375,"line":29},[2832,2836,2841],{"type":44,"tag":373,"props":2833,"children":2834},{"style":380},[2835],{"type":49,"value":383},{"type":44,"tag":373,"props":2837,"children":2838},{"style":386},[2839],{"type":49,"value":2840}," pipeline",{"type":44,"tag":373,"props":2842,"children":2843},{"style":380},[2844],{"type":49,"value":394},{"type":44,"tag":373,"props":2846,"children":2847},{"class":375,"line":416},[2848,2853,2857,2861,2866],{"type":44,"tag":373,"props":2849,"children":2850},{"style":386},[2851],{"type":49,"value":2852},"      name",{"type":44,"tag":373,"props":2854,"children":2855},{"style":380},[2856],{"type":49,"value":407},{"type":44,"tag":373,"props":2858,"children":2859},{"style":380},[2860],{"type":49,"value":449},{"type":44,"tag":373,"props":2862,"children":2863},{"style":410},[2864],{"type":49,"value":2865},"{{ IngestPipeline \"pipeline_branch_json\" }}",{"type":44,"tag":373,"props":2867,"children":2868},{"style":380},[2869],{"type":49,"value":458},{"type":44,"tag":373,"props":2871,"children":2872},{"class":375,"line":434},[2873,2877,2881],{"type":44,"tag":373,"props":2874,"children":2875},{"style":386},[2876],{"type":49,"value":984},{"type":44,"tag":373,"props":2878,"children":2879},{"style":380},[2880],{"type":49,"value":407},{"type":44,"tag":373,"props":2882,"children":2883},{"style":410},[2884],{"type":49,"value":2885}," ctx.event?.original != null && ctx.event.original.startsWith('{')\n",{"type":44,"tag":373,"props":2887,"children":2888},{"class":375,"line":831},[2889,2894,2898],{"type":44,"tag":373,"props":2890,"children":2891},{"style":386},[2892],{"type":49,"value":2893},"      ignore_missing_pipeline",{"type":44,"tag":373,"props":2895,"children":2896},{"style":380},[2897],{"type":49,"value":407},{"type":44,"tag":373,"props":2899,"children":2900},{"style":972},[2901],{"type":49,"value":975},{"type":44,"tag":373,"props":2903,"children":2904},{"class":375,"line":847},[2905,2909,2913],{"type":44,"tag":373,"props":2906,"children":2907},{"style":386},[2908],{"type":49,"value":422},{"type":44,"tag":373,"props":2910,"children":2911},{"style":380},[2912],{"type":49,"value":407},{"type":44,"tag":373,"props":2914,"children":2915},{"style":410},[2916],{"type":49,"value":2917}," route_json\n",{"type":44,"tag":373,"props":2919,"children":2920},{"class":375,"line":871},[2921,2925,2929],{"type":44,"tag":373,"props":2922,"children":2923},{"style":380},[2924],{"type":49,"value":383},{"type":44,"tag":373,"props":2926,"children":2927},{"style":386},[2928],{"type":49,"value":2840},{"type":44,"tag":373,"props":2930,"children":2931},{"style":380},[2932],{"type":49,"value":394},{"type":44,"tag":373,"props":2934,"children":2935},{"class":375,"line":881},[2936,2940,2944,2948,2953],{"type":44,"tag":373,"props":2937,"children":2938},{"style":386},[2939],{"type":49,"value":2852},{"type":44,"tag":373,"props":2941,"children":2942},{"style":380},[2943],{"type":49,"value":407},{"type":44,"tag":373,"props":2945,"children":2946},{"style":380},[2947],{"type":49,"value":449},{"type":44,"tag":373,"props":2949,"children":2950},{"style":410},[2951],{"type":49,"value":2952},"{{ IngestPipeline \"pipeline_branch_text\" }}",{"type":44,"tag":373,"props":2954,"children":2955},{"style":380},[2956],{"type":49,"value":458},{"type":44,"tag":373,"props":2958,"children":2959},{"class":375,"line":891},[2960,2964,2968],{"type":44,"tag":373,"props":2961,"children":2962},{"style":386},[2963],{"type":49,"value":984},{"type":44,"tag":373,"props":2965,"children":2966},{"style":380},[2967],{"type":49,"value":407},{"type":44,"tag":373,"props":2969,"children":2970},{"style":410},[2971],{"type":49,"value":2972}," ctx.event?.original != null && !ctx.event.original.startsWith('{')\n",{"type":44,"tag":373,"props":2974,"children":2975},{"class":375,"line":908},[2976,2980,2984],{"type":44,"tag":373,"props":2977,"children":2978},{"style":386},[2979],{"type":49,"value":2893},{"type":44,"tag":373,"props":2981,"children":2982},{"style":380},[2983],{"type":49,"value":407},{"type":44,"tag":373,"props":2985,"children":2986},{"style":972},[2987],{"type":49,"value":975},{"type":44,"tag":373,"props":2989,"children":2990},{"class":375,"line":25},[2991,2995,2999],{"type":44,"tag":373,"props":2992,"children":2993},{"style":386},[2994],{"type":49,"value":422},{"type":44,"tag":373,"props":2996,"children":2997},{"style":380},[2998],{"type":49,"value":407},{"type":44,"tag":373,"props":3000,"children":3001},{"style":410},[3002],{"type":49,"value":3003}," route_text\n",{"type":44,"tag":58,"props":3005,"children":3006},{},[3007,3009,3014],{"type":49,"value":3008},"In large integrations, keep ",{"type":44,"tag":72,"props":3010,"children":3012},{"className":3011},[],[3013],{"type":49,"value":282},{"type":49,"value":3015}," as the router and put branch logic in files like:",{"type":44,"tag":99,"props":3017,"children":3018},{},[3019,3028],{"type":44,"tag":103,"props":3020,"children":3021},{},[3022],{"type":44,"tag":72,"props":3023,"children":3025},{"className":3024},[],[3026],{"type":49,"value":3027},"pipeline_object_\u003Cname>.yml",{"type":44,"tag":103,"props":3029,"children":3030},{},[3031],{"type":44,"tag":72,"props":3032,"children":3034},{"className":3033},[],[3035],{"type":49,"value":3036},"pipeline_category_\u003Cname>.yml",{"type":44,"tag":58,"props":3038,"children":3039},{},[3040,3042,3048,3050,3056],{"type":49,"value":3041},"See ",{"type":44,"tag":72,"props":3043,"children":3045},{"className":3044},[],[3046],{"type":49,"value":3047},"references\u002Fbranching-patterns.md",{"type":49,"value":3049}," for full patterns from ",{"type":44,"tag":72,"props":3051,"children":3053},{"className":3052},[],[3054],{"type":49,"value":3055},"amazon_security_lake",{"type":49,"value":638},{"type":44,"tag":51,"props":3058,"children":3060},{"id":3059},"sub-pipeline-routing-for-multi-log-type-integrations",[3061],{"type":49,"value":3062},"Sub-pipeline routing for multi-log-type integrations",{"type":44,"tag":58,"props":3064,"children":3065},{},[3066,3068,3078,3080,3085],{"type":49,"value":3067},"When a data stream receives multiple distinct log types (for example a firewall that emits traffic, auth, and DNS logs in the same stream), ",{"type":44,"tag":64,"props":3069,"children":3070},{},[3071,3073],{"type":49,"value":3072},"do not implement all parsing in a single monolithic ",{"type":44,"tag":72,"props":3074,"children":3076},{"className":3075},[],[3077],{"type":49,"value":282},{"type":49,"value":3079},". Use ",{"type":44,"tag":72,"props":3081,"children":3083},{"className":3082},[],[3084],{"type":49,"value":282},{"type":49,"value":3086}," as a thin router that detects the log type and delegates to a dedicated sub-pipeline per type.",{"type":44,"tag":3088,"props":3089,"children":3091},"h3",{"id":3090},"file-layout",[3092],{"type":49,"value":3093},"File layout",{"type":44,"tag":362,"props":3095,"children":3099},{"className":3096,"code":3098,"language":49,"meta":367},[3097],"language-text","elasticsearch\u002Fingest_pipeline\u002F\n  default.yml              # router only — detects log type, calls sub-pipelines\n  pipeline-\u003Ctype>.yml      # one file per log type (e.g. pipeline-traffic.yml)\n",[3100],{"type":44,"tag":72,"props":3101,"children":3102},{"__ignoreMap":367},[3103],{"type":49,"value":3098},{"type":44,"tag":3088,"props":3105,"children":3107},{"id":3106},"router-pattern-in-defaultyml",[3108,3110],{"type":49,"value":3109},"Router pattern in ",{"type":44,"tag":72,"props":3111,"children":3113},{"className":3112},[],[3114],{"type":49,"value":282},{"type":44,"tag":58,"props":3116,"children":3117},{},[3118,3120,3129,3130,3135,3137,3142,3144,3149,3151,3156,3158,3168],{"type":49,"value":3119},"Use the same ",{"type":44,"tag":64,"props":3121,"children":3122},{},[3123],{"type":44,"tag":72,"props":3124,"children":3126},{"className":3125},[],[3127],{"type":49,"value":3128},"ecs.version",{"type":49,"value":128},{"type":44,"tag":64,"props":3131,"children":3132},{},[3133],{"type":49,"value":3134},"JSE00001",{"type":49,"value":3136}," ",{"type":44,"tag":72,"props":3138,"children":3140},{"className":3139},[],[3141],{"type":49,"value":493},{"type":49,"value":3143},"\u002F",{"type":44,"tag":72,"props":3145,"children":3147},{"className":3146},[],[3148],{"type":49,"value":598},{"type":49,"value":3150}," pair for ",{"type":44,"tag":72,"props":3152,"children":3154},{"className":3153},[],[3155],{"type":49,"value":574},{"type":49,"value":3157},", and ",{"type":44,"tag":64,"props":3159,"children":3160},{},[3161,3163],{"type":49,"value":3162},"full pipeline-level ",{"type":44,"tag":72,"props":3164,"children":3166},{"className":3165},[],[3167],{"type":49,"value":188},{"type":49,"value":3169}," as in the standard opening. The router only branches sub-pipelines; it does not parse payloads.",{"type":44,"tag":362,"props":3171,"children":3173},{"className":364,"code":3172,"language":366,"meta":367,"style":367},"processors:\n  - set:\n      field: ecs.version\n      tag: set_ecs_version\n      value: '9.3.0'\n  - rename:\n      field: message\n      tag: rename_message_to_event_original\n      target_field: event.original\n      ignore_missing: true\n      if: ctx.event?.original == null\n  - remove:\n      field: message\n      tag: remove_message\n      ignore_missing: true\n      if: ctx.event?.original != null\n  - pipeline:\n      name: '{{ IngestPipeline \"pipeline-traffic\" }}'\n      if: 'ctx.event?.original != null && ctx.event.original.contains(\"TRAFFIC\")'\n      tag: route_traffic\n  - pipeline:\n      name: '{{ IngestPipeline \"pipeline-auth\" }}'\n      if: 'ctx.event?.original != null && ctx.event.original.contains(\"AUTH\")'\n      tag: route_auth\n  - pipeline:\n      name: '{{ IngestPipeline \"pipeline-dns\" }}'\n      if: 'ctx.event?.original != null && ctx.event.original.contains(\"DNS\")'\n      tag: route_dns\non_failure:\n  - append:\n      field: error.message\n      value: >-\n        Processor '{{{ _ingest.on_failure_processor_type }}}'\n        {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'\n        {{{\u002F_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}'\n  - set:\n      field: event.kind\n      tag: set_pipeline_error_to_event_kind\n      value: pipeline_error\n  - append:\n      field: tags\n      value: preserve_original_event\n      allow_duplicates: false\n",[3174],{"type":44,"tag":72,"props":3175,"children":3176},{"__ignoreMap":367},[3177,3188,3203,3218,3233,3256,3271,3286,3301,3316,3331,3346,3361,3376,3391,3406,3421,3436,3460,3484,3500,3515,3539,3563,3579,3594,3618,3642,3658,3669,3684,3699,3718,3725,3732,3739,3754,3769,3784,3799,3814,3829,3844],{"type":44,"tag":373,"props":3178,"children":3179},{"class":375,"line":376},[3180,3184],{"type":44,"tag":373,"props":3181,"children":3182},{"style":386},[3183],{"type":49,"value":305},{"type":44,"tag":373,"props":3185,"children":3186},{"style":380},[3187],{"type":49,"value":394},{"type":44,"tag":373,"props":3189,"children":3190},{"class":375,"line":29},[3191,3195,3199],{"type":44,"tag":373,"props":3192,"children":3193},{"style":380},[3194],{"type":49,"value":383},{"type":44,"tag":373,"props":3196,"children":3197},{"style":386},[3198],{"type":49,"value":389},{"type":44,"tag":373,"props":3200,"children":3201},{"style":380},[3202],{"type":49,"value":394},{"type":44,"tag":373,"props":3204,"children":3205},{"class":375,"line":416},[3206,3210,3214],{"type":44,"tag":373,"props":3207,"children":3208},{"style":386},[3209],{"type":49,"value":402},{"type":44,"tag":373,"props":3211,"children":3212},{"style":380},[3213],{"type":49,"value":407},{"type":44,"tag":373,"props":3215,"children":3216},{"style":410},[3217],{"type":49,"value":413},{"type":44,"tag":373,"props":3219,"children":3220},{"class":375,"line":434},[3221,3225,3229],{"type":44,"tag":373,"props":3222,"children":3223},{"style":386},[3224],{"type":49,"value":422},{"type":44,"tag":373,"props":3226,"children":3227},{"style":380},[3228],{"type":49,"value":407},{"type":44,"tag":373,"props":3230,"children":3231},{"style":410},[3232],{"type":49,"value":431},{"type":44,"tag":373,"props":3234,"children":3235},{"class":375,"line":831},[3236,3240,3244,3248,3252],{"type":44,"tag":373,"props":3237,"children":3238},{"style":386},[3239],{"type":49,"value":440},{"type":44,"tag":373,"props":3241,"children":3242},{"style":380},[3243],{"type":49,"value":407},{"type":44,"tag":373,"props":3245,"children":3246},{"style":380},[3247],{"type":49,"value":449},{"type":44,"tag":373,"props":3249,"children":3250},{"style":410},[3251],{"type":49,"value":358},{"type":44,"tag":373,"props":3253,"children":3254},{"style":380},[3255],{"type":49,"value":458},{"type":44,"tag":373,"props":3257,"children":3258},{"class":375,"line":847},[3259,3263,3267],{"type":44,"tag":373,"props":3260,"children":3261},{"style":380},[3262],{"type":49,"value":383},{"type":44,"tag":373,"props":3264,"children":3265},{"style":386},[3266],{"type":49,"value":1151},{"type":44,"tag":373,"props":3268,"children":3269},{"style":380},[3270],{"type":49,"value":394},{"type":44,"tag":373,"props":3272,"children":3273},{"class":375,"line":871},[3274,3278,3282],{"type":44,"tag":373,"props":3275,"children":3276},{"style":386},[3277],{"type":49,"value":402},{"type":44,"tag":373,"props":3279,"children":3280},{"style":380},[3281],{"type":49,"value":407},{"type":44,"tag":373,"props":3283,"children":3284},{"style":410},[3285],{"type":49,"value":1172},{"type":44,"tag":373,"props":3287,"children":3288},{"class":375,"line":881},[3289,3293,3297],{"type":44,"tag":373,"props":3290,"children":3291},{"style":386},[3292],{"type":49,"value":422},{"type":44,"tag":373,"props":3294,"children":3295},{"style":380},[3296],{"type":49,"value":407},{"type":44,"tag":373,"props":3298,"children":3299},{"style":410},[3300],{"type":49,"value":1189},{"type":44,"tag":373,"props":3302,"children":3303},{"class":375,"line":891},[3304,3308,3312],{"type":44,"tag":373,"props":3305,"children":3306},{"style":386},[3307],{"type":49,"value":1198},{"type":44,"tag":373,"props":3309,"children":3310},{"style":380},[3311],{"type":49,"value":407},{"type":44,"tag":373,"props":3313,"children":3314},{"style":410},[3315],{"type":49,"value":1207},{"type":44,"tag":373,"props":3317,"children":3318},{"class":375,"line":908},[3319,3323,3327],{"type":44,"tag":373,"props":3320,"children":3321},{"style":386},[3322],{"type":49,"value":965},{"type":44,"tag":373,"props":3324,"children":3325},{"style":380},[3326],{"type":49,"value":407},{"type":44,"tag":373,"props":3328,"children":3329},{"style":972},[3330],{"type":49,"value":975},{"type":44,"tag":373,"props":3332,"children":3333},{"class":375,"line":25},[3334,3338,3342],{"type":44,"tag":373,"props":3335,"children":3336},{"style":386},[3337],{"type":49,"value":984},{"type":44,"tag":373,"props":3339,"children":3340},{"style":380},[3341],{"type":49,"value":407},{"type":44,"tag":373,"props":3343,"children":3344},{"style":410},[3345],{"type":49,"value":1257},{"type":44,"tag":373,"props":3347,"children":3348},{"class":375,"line":933},[3349,3353,3357],{"type":44,"tag":373,"props":3350,"children":3351},{"style":380},[3352],{"type":49,"value":383},{"type":44,"tag":373,"props":3354,"children":3355},{"style":386},[3356],{"type":49,"value":901},{"type":44,"tag":373,"props":3358,"children":3359},{"style":380},[3360],{"type":49,"value":394},{"type":44,"tag":373,"props":3362,"children":3363},{"class":375,"line":946},[3364,3368,3372],{"type":44,"tag":373,"props":3365,"children":3366},{"style":386},[3367],{"type":49,"value":402},{"type":44,"tag":373,"props":3369,"children":3370},{"style":380},[3371],{"type":49,"value":407},{"type":44,"tag":373,"props":3373,"children":3374},{"style":410},[3375],{"type":49,"value":1172},{"type":44,"tag":373,"props":3377,"children":3378},{"class":375,"line":959},[3379,3383,3387],{"type":44,"tag":373,"props":3380,"children":3381},{"style":386},[3382],{"type":49,"value":422},{"type":44,"tag":373,"props":3384,"children":3385},{"style":380},[3386],{"type":49,"value":407},{"type":44,"tag":373,"props":3388,"children":3389},{"style":410},[3390],{"type":49,"value":1306},{"type":44,"tag":373,"props":3392,"children":3393},{"class":375,"line":978},[3394,3398,3402],{"type":44,"tag":373,"props":3395,"children":3396},{"style":386},[3397],{"type":49,"value":965},{"type":44,"tag":373,"props":3399,"children":3400},{"style":380},[3401],{"type":49,"value":407},{"type":44,"tag":373,"props":3403,"children":3404},{"style":972},[3405],{"type":49,"value":975},{"type":44,"tag":373,"props":3407,"children":3408},{"class":375,"line":996},[3409,3413,3417],{"type":44,"tag":373,"props":3410,"children":3411},{"style":386},[3412],{"type":49,"value":984},{"type":44,"tag":373,"props":3414,"children":3415},{"style":380},[3416],{"type":49,"value":407},{"type":44,"tag":373,"props":3418,"children":3419},{"style":410},[3420],{"type":49,"value":1356},{"type":44,"tag":373,"props":3422,"children":3423},{"class":375,"line":1013},[3424,3428,3432],{"type":44,"tag":373,"props":3425,"children":3426},{"style":380},[3427],{"type":49,"value":383},{"type":44,"tag":373,"props":3429,"children":3430},{"style":386},[3431],{"type":49,"value":2840},{"type":44,"tag":373,"props":3433,"children":3434},{"style":380},[3435],{"type":49,"value":394},{"type":44,"tag":373,"props":3437,"children":3438},{"class":375,"line":1038},[3439,3443,3447,3451,3456],{"type":44,"tag":373,"props":3440,"children":3441},{"style":386},[3442],{"type":49,"value":2852},{"type":44,"tag":373,"props":3444,"children":3445},{"style":380},[3446],{"type":49,"value":407},{"type":44,"tag":373,"props":3448,"children":3449},{"style":380},[3450],{"type":49,"value":449},{"type":44,"tag":373,"props":3452,"children":3453},{"style":410},[3454],{"type":49,"value":3455},"{{ IngestPipeline \"pipeline-traffic\" }}",{"type":44,"tag":373,"props":3457,"children":3458},{"style":380},[3459],{"type":49,"value":458},{"type":44,"tag":373,"props":3461,"children":3462},{"class":375,"line":1047},[3463,3467,3471,3475,3480],{"type":44,"tag":373,"props":3464,"children":3465},{"style":386},[3466],{"type":49,"value":984},{"type":44,"tag":373,"props":3468,"children":3469},{"style":380},[3470],{"type":49,"value":407},{"type":44,"tag":373,"props":3472,"children":3473},{"style":380},[3474],{"type":49,"value":449},{"type":44,"tag":373,"props":3476,"children":3477},{"style":410},[3478],{"type":49,"value":3479},"ctx.event?.original != null && ctx.event.original.contains(\"TRAFFIC\")",{"type":44,"tag":373,"props":3481,"children":3482},{"style":380},[3483],{"type":49,"value":458},{"type":44,"tag":373,"props":3485,"children":3486},{"class":375,"line":1056},[3487,3491,3495],{"type":44,"tag":373,"props":3488,"children":3489},{"style":386},[3490],{"type":49,"value":422},{"type":44,"tag":373,"props":3492,"children":3493},{"style":380},[3494],{"type":49,"value":407},{"type":44,"tag":373,"props":3496,"children":3497},{"style":410},[3498],{"type":49,"value":3499}," route_traffic\n",{"type":44,"tag":373,"props":3501,"children":3502},{"class":375,"line":1073},[3503,3507,3511],{"type":44,"tag":373,"props":3504,"children":3505},{"style":380},[3506],{"type":49,"value":383},{"type":44,"tag":373,"props":3508,"children":3509},{"style":386},[3510],{"type":49,"value":2840},{"type":44,"tag":373,"props":3512,"children":3513},{"style":380},[3514],{"type":49,"value":394},{"type":44,"tag":373,"props":3516,"children":3517},{"class":375,"line":1090},[3518,3522,3526,3530,3535],{"type":44,"tag":373,"props":3519,"children":3520},{"style":386},[3521],{"type":49,"value":2852},{"type":44,"tag":373,"props":3523,"children":3524},{"style":380},[3525],{"type":49,"value":407},{"type":44,"tag":373,"props":3527,"children":3528},{"style":380},[3529],{"type":49,"value":449},{"type":44,"tag":373,"props":3531,"children":3532},{"style":410},[3533],{"type":49,"value":3534},"{{ IngestPipeline \"pipeline-auth\" }}",{"type":44,"tag":373,"props":3536,"children":3537},{"style":380},[3538],{"type":49,"value":458},{"type":44,"tag":373,"props":3540,"children":3541},{"class":375,"line":1107},[3542,3546,3550,3554,3559],{"type":44,"tag":373,"props":3543,"children":3544},{"style":386},[3545],{"type":49,"value":984},{"type":44,"tag":373,"props":3547,"children":3548},{"style":380},[3549],{"type":49,"value":407},{"type":44,"tag":373,"props":3551,"children":3552},{"style":380},[3553],{"type":49,"value":449},{"type":44,"tag":373,"props":3555,"children":3556},{"style":410},[3557],{"type":49,"value":3558},"ctx.event?.original != null && ctx.event.original.contains(\"AUTH\")",{"type":44,"tag":373,"props":3560,"children":3561},{"style":380},[3562],{"type":49,"value":458},{"type":44,"tag":373,"props":3564,"children":3565},{"class":375,"line":1124},[3566,3570,3574],{"type":44,"tag":373,"props":3567,"children":3568},{"style":386},[3569],{"type":49,"value":422},{"type":44,"tag":373,"props":3571,"children":3572},{"style":380},[3573],{"type":49,"value":407},{"type":44,"tag":373,"props":3575,"children":3576},{"style":410},[3577],{"type":49,"value":3578}," route_auth\n",{"type":44,"tag":373,"props":3580,"children":3581},{"class":375,"line":1133},[3582,3586,3590],{"type":44,"tag":373,"props":3583,"children":3584},{"style":380},[3585],{"type":49,"value":383},{"type":44,"tag":373,"props":3587,"children":3588},{"style":386},[3589],{"type":49,"value":2840},{"type":44,"tag":373,"props":3591,"children":3592},{"style":380},[3593],{"type":49,"value":394},{"type":44,"tag":373,"props":3595,"children":3596},{"class":375,"line":1141},[3597,3601,3605,3609,3614],{"type":44,"tag":373,"props":3598,"children":3599},{"style":386},[3600],{"type":49,"value":2852},{"type":44,"tag":373,"props":3602,"children":3603},{"style":380},[3604],{"type":49,"value":407},{"type":44,"tag":373,"props":3606,"children":3607},{"style":380},[3608],{"type":49,"value":449},{"type":44,"tag":373,"props":3610,"children":3611},{"style":410},[3612],{"type":49,"value":3613},"{{ IngestPipeline \"pipeline-dns\" }}",{"type":44,"tag":373,"props":3615,"children":3616},{"style":380},[3617],{"type":49,"value":458},{"type":44,"tag":373,"props":3619,"children":3620},{"class":375,"line":1158},[3621,3625,3629,3633,3638],{"type":44,"tag":373,"props":3622,"children":3623},{"style":386},[3624],{"type":49,"value":984},{"type":44,"tag":373,"props":3626,"children":3627},{"style":380},[3628],{"type":49,"value":407},{"type":44,"tag":373,"props":3630,"children":3631},{"style":380},[3632],{"type":49,"value":449},{"type":44,"tag":373,"props":3634,"children":3635},{"style":410},[3636],{"type":49,"value":3637},"ctx.event?.original != null && ctx.event.original.contains(\"DNS\")",{"type":44,"tag":373,"props":3639,"children":3640},{"style":380},[3641],{"type":49,"value":458},{"type":44,"tag":373,"props":3643,"children":3644},{"class":375,"line":1175},[3645,3649,3653],{"type":44,"tag":373,"props":3646,"children":3647},{"style":386},[3648],{"type":49,"value":422},{"type":44,"tag":373,"props":3650,"children":3651},{"style":380},[3652],{"type":49,"value":407},{"type":44,"tag":373,"props":3654,"children":3655},{"style":410},[3656],{"type":49,"value":3657}," route_dns\n",{"type":44,"tag":373,"props":3659,"children":3660},{"class":375,"line":1192},[3661,3665],{"type":44,"tag":373,"props":3662,"children":3663},{"style":386},[3664],{"type":49,"value":188},{"type":44,"tag":373,"props":3666,"children":3667},{"style":380},[3668],{"type":49,"value":394},{"type":44,"tag":373,"props":3670,"children":3671},{"class":375,"line":1210},[3672,3676,3680],{"type":44,"tag":373,"props":3673,"children":3674},{"style":380},[3675],{"type":49,"value":383},{"type":44,"tag":373,"props":3677,"children":3678},{"style":386},[3679],{"type":49,"value":1494},{"type":44,"tag":373,"props":3681,"children":3682},{"style":380},[3683],{"type":49,"value":394},{"type":44,"tag":373,"props":3685,"children":3686},{"class":375,"line":1226},[3687,3691,3695],{"type":44,"tag":373,"props":3688,"children":3689},{"style":386},[3690],{"type":49,"value":402},{"type":44,"tag":373,"props":3692,"children":3693},{"style":380},[3694],{"type":49,"value":407},{"type":44,"tag":373,"props":3696,"children":3697},{"style":410},[3698],{"type":49,"value":1620},{"type":44,"tag":373,"props":3700,"children":3701},{"class":375,"line":1243},[3702,3706,3710,3714],{"type":44,"tag":373,"props":3703,"children":3704},{"style":386},[3705],{"type":49,"value":440},{"type":44,"tag":373,"props":3707,"children":3708},{"style":380},[3709],{"type":49,"value":407},{"type":44,"tag":373,"props":3711,"children":3712},{"style":1026},[3713],{"type":49,"value":1029},{"type":44,"tag":373,"props":3715,"children":3716},{"style":1032},[3717],{"type":49,"value":1035},{"type":44,"tag":373,"props":3719,"children":3720},{"class":375,"line":1260},[3721],{"type":44,"tag":373,"props":3722,"children":3723},{"style":410},[3724],{"type":49,"value":1649},{"type":44,"tag":373,"props":3726,"children":3727},{"class":375,"line":1276},[3728],{"type":44,"tag":373,"props":3729,"children":3730},{"style":410},[3731],{"type":49,"value":1658},{"type":44,"tag":373,"props":3733,"children":3734},{"class":375,"line":1292},[3735],{"type":44,"tag":373,"props":3736,"children":3737},{"style":410},[3738],{"type":49,"value":1667},{"type":44,"tag":373,"props":3740,"children":3741},{"class":375,"line":1309},[3742,3746,3750],{"type":44,"tag":373,"props":3743,"children":3744},{"style":380},[3745],{"type":49,"value":383},{"type":44,"tag":373,"props":3747,"children":3748},{"style":386},[3749],{"type":49,"value":389},{"type":44,"tag":373,"props":3751,"children":3752},{"style":380},[3753],{"type":49,"value":394},{"type":44,"tag":373,"props":3755,"children":3756},{"class":375,"line":1325},[3757,3761,3765],{"type":44,"tag":373,"props":3758,"children":3759},{"style":386},[3760],{"type":49,"value":402},{"type":44,"tag":373,"props":3762,"children":3763},{"style":380},[3764],{"type":49,"value":407},{"type":44,"tag":373,"props":3766,"children":3767},{"style":410},[3768],{"type":49,"value":1700},{"type":44,"tag":373,"props":3770,"children":3771},{"class":375,"line":1342},[3772,3776,3780],{"type":44,"tag":373,"props":3773,"children":3774},{"style":386},[3775],{"type":49,"value":422},{"type":44,"tag":373,"props":3777,"children":3778},{"style":380},[3779],{"type":49,"value":407},{"type":44,"tag":373,"props":3781,"children":3782},{"style":410},[3783],{"type":49,"value":1717},{"type":44,"tag":373,"props":3785,"children":3786},{"class":375,"line":1359},[3787,3791,3795],{"type":44,"tag":373,"props":3788,"children":3789},{"style":386},[3790],{"type":49,"value":440},{"type":44,"tag":373,"props":3792,"children":3793},{"style":380},[3794],{"type":49,"value":407},{"type":44,"tag":373,"props":3796,"children":3797},{"style":410},[3798],{"type":49,"value":1734},{"type":44,"tag":373,"props":3800,"children":3801},{"class":375,"line":1367},[3802,3806,3810],{"type":44,"tag":373,"props":3803,"children":3804},{"style":380},[3805],{"type":49,"value":383},{"type":44,"tag":373,"props":3807,"children":3808},{"style":386},[3809],{"type":49,"value":1494},{"type":44,"tag":373,"props":3811,"children":3812},{"style":380},[3813],{"type":49,"value":394},{"type":44,"tag":373,"props":3815,"children":3816},{"class":375,"line":1376},[3817,3821,3825],{"type":44,"tag":373,"props":3818,"children":3819},{"style":386},[3820],{"type":49,"value":402},{"type":44,"tag":373,"props":3822,"children":3823},{"style":380},[3824],{"type":49,"value":407},{"type":44,"tag":373,"props":3826,"children":3827},{"style":410},[3828],{"type":49,"value":1515},{"type":44,"tag":373,"props":3830,"children":3831},{"class":375,"line":1393},[3832,3836,3840],{"type":44,"tag":373,"props":3833,"children":3834},{"style":386},[3835],{"type":49,"value":440},{"type":44,"tag":373,"props":3837,"children":3838},{"style":380},[3839],{"type":49,"value":407},{"type":44,"tag":373,"props":3841,"children":3842},{"style":410},[3843],{"type":49,"value":1532},{"type":44,"tag":373,"props":3845,"children":3846},{"class":375,"line":1409},[3847,3851,3855],{"type":44,"tag":373,"props":3848,"children":3849},{"style":386},[3850],{"type":49,"value":1541},{"type":44,"tag":373,"props":3852,"children":3853},{"style":380},[3854],{"type":49,"value":407},{"type":44,"tag":373,"props":3856,"children":3857},{"style":972},[3858],{"type":49,"value":1550},{"type":44,"tag":3088,"props":3860,"children":3862},{"id":3861},"rules",[3863],{"type":49,"value":3864},"Rules",{"type":44,"tag":99,"props":3866,"children":3867},{},[3868,3892,3897,3909,3930],{"type":44,"tag":103,"props":3869,"children":3870},{},[3871,3876,3878,3883,3885,3890],{"type":44,"tag":72,"props":3872,"children":3874},{"className":3873},[],[3875],{"type":49,"value":282},{"type":49,"value":3877}," must contain ",{"type":44,"tag":64,"props":3879,"children":3880},{},[3881],{"type":49,"value":3882},"only",{"type":49,"value":3884}," routing logic and ",{"type":44,"tag":72,"props":3886,"children":3888},{"className":3887},[],[3889],{"type":49,"value":188},{"type":49,"value":3891}," handling — no field parsing.",{"type":44,"tag":103,"props":3893,"children":3894},{},[3895],{"type":49,"value":3896},"Each sub-pipeline handles parsing, ECS mapping, and categorization for its own log type.",{"type":44,"tag":103,"props":3898,"children":3899},{},[3900,3902,3907],{"type":49,"value":3901},"Each sub-pipeline must have its own ",{"type":44,"tag":72,"props":3903,"children":3905},{"className":3904},[],[3906],{"type":49,"value":188},{"type":49,"value":3908}," block.",{"type":44,"tag":103,"props":3910,"children":3911},{},[3912,3914,3920,3922,3928],{"type":49,"value":3913},"Name sub-pipeline files ",{"type":44,"tag":72,"props":3915,"children":3917},{"className":3916},[],[3918],{"type":49,"value":3919},"pipeline-\u003Ctype>.yml",{"type":49,"value":3921}," where ",{"type":44,"tag":72,"props":3923,"children":3925},{"className":3924},[],[3926],{"type":49,"value":3927},"\u003Ctype>",{"type":49,"value":3929}," matches the log type identifier used in the routing condition.",{"type":44,"tag":103,"props":3931,"children":3932},{},[3933,3935,3941],{"type":49,"value":3934},"Each log type gets its own pipeline test fixture file following the naming convention ",{"type":44,"tag":72,"props":3936,"children":3938},{"className":3937},[],[3939],{"type":49,"value":3940},"test-\u003Cpackage>-\u003Cdatastream>-\u003Ctype>-sample.log",{"type":49,"value":638},{"type":44,"tag":51,"props":3943,"children":3945},{"id":3944},"processor-ordering-and-performance",[3946],{"type":49,"value":3947},"Processor ordering and performance",{"type":44,"tag":99,"props":3949,"children":3950},{},[3951,3956,3961,3980,4082,4102],{"type":44,"tag":103,"props":3952,"children":3953},{},[3954],{"type":49,"value":3955},"run cheap existence checks before expensive operations",{"type":44,"tag":103,"props":3957,"children":3958},{},[3959],{"type":49,"value":3960},"drop early if records are out of scope",{"type":44,"tag":103,"props":3962,"children":3963},{},[3964,3966,3971,3973,3978],{"type":49,"value":3965},"prefer ",{"type":44,"tag":72,"props":3967,"children":3969},{"className":3968},[],[3970],{"type":49,"value":134},{"type":49,"value":3972}," over ",{"type":44,"tag":72,"props":3974,"children":3976},{"className":3975},[],[3977],{"type":49,"value":126},{"type":49,"value":3979}," for stable delimited formats",{"type":44,"tag":103,"props":3981,"children":3982},{},[3983,3996,3998,4003,4004,4009,4010,4015,4016,4021,4022,4027,4028,4033,4034,4039,4040,4046,4047,4053,4054,4060,4061,4067,4069,4075,4076,4081],{"type":44,"tag":64,"props":3984,"children":3985},{},[3986,3988,3994],{"type":49,"value":3987},"never use a ",{"type":44,"tag":72,"props":3989,"children":3991},{"className":3990},[],[3992],{"type":49,"value":3993},"script",{"type":49,"value":3995}," processor when a built-in processor can do the job",{"type":49,"value":3997}," — ",{"type":44,"tag":72,"props":3999,"children":4001},{"className":4000},[],[4002],{"type":49,"value":503},{"type":49,"value":128},{"type":44,"tag":72,"props":4005,"children":4007},{"className":4006},[],[4008],{"type":49,"value":493},{"type":49,"value":128},{"type":44,"tag":72,"props":4011,"children":4013},{"className":4012},[],[4014],{"type":49,"value":598},{"type":49,"value":128},{"type":44,"tag":72,"props":4017,"children":4019},{"className":4018},[],[4020],{"type":49,"value":1853},{"type":49,"value":128},{"type":44,"tag":72,"props":4023,"children":4025},{"className":4024},[],[4026],{"type":49,"value":162},{"type":49,"value":128},{"type":44,"tag":72,"props":4029,"children":4031},{"className":4030},[],[4032],{"type":49,"value":134},{"type":49,"value":128},{"type":44,"tag":72,"props":4035,"children":4037},{"className":4036},[],[4038],{"type":49,"value":126},{"type":49,"value":128},{"type":44,"tag":72,"props":4041,"children":4043},{"className":4042},[],[4044],{"type":49,"value":4045},"gsub",{"type":49,"value":128},{"type":44,"tag":72,"props":4048,"children":4050},{"className":4049},[],[4051],{"type":49,"value":4052},"lowercase",{"type":49,"value":128},{"type":44,"tag":72,"props":4055,"children":4057},{"className":4056},[],[4058],{"type":49,"value":4059},"uppercase",{"type":49,"value":3157},{"type":44,"tag":72,"props":4062,"children":4064},{"className":4063},[],[4065],{"type":49,"value":4066},"trim",{"type":49,"value":4068}," are all faster than Painless and easier to review. See the cost tiers in ",{"type":44,"tag":72,"props":4070,"children":4072},{"className":4071},[],[4073],{"type":49,"value":4074},"references\u002Fprocessor-cookbook.md",{"type":49,"value":244},{"type":44,"tag":64,"props":4077,"children":4078},{},[4079],{"type":49,"value":4080},"Processor performance guide",{"type":49,"value":638},{"type":44,"tag":103,"props":4083,"children":4084},{},[4085,4087,4093,4094,4100],{"type":49,"value":4086},"use enrichment processors (",{"type":44,"tag":72,"props":4088,"children":4090},{"className":4089},[],[4091],{"type":49,"value":4092},"geoip",{"type":49,"value":128},{"type":44,"tag":72,"props":4095,"children":4097},{"className":4096},[],[4098],{"type":49,"value":4099},"user_agent",{"type":49,"value":4101},") only when needed",{"type":44,"tag":103,"props":4103,"children":4104},{},[4105,4107,4112,4114,4120,4121,4127],{"type":49,"value":4106},"always anchor ",{"type":44,"tag":72,"props":4108,"children":4110},{"className":4109},[],[4111],{"type":49,"value":126},{"type":49,"value":4113}," patterns with ",{"type":44,"tag":72,"props":4115,"children":4117},{"className":4116},[],[4118],{"type":49,"value":4119},"^",{"type":49,"value":1842},{"type":44,"tag":72,"props":4122,"children":4124},{"className":4123},[],[4125],{"type":49,"value":4126},"$",{"type":49,"value":4128}," — without anchors the regex engine scans the entire input string looking for a partial match, which is slow and can produce incorrect results on noisy log lines",{"type":44,"tag":51,"props":4130,"children":4132},{"id":4131},"mustache-template-syntax-in-processor-values",[4133],{"type":49,"value":4134},"Mustache template syntax in processor values",{"type":44,"tag":58,"props":4136,"children":4137},{},[4138,4140,4146,4147,4152,4154,4159,4160,4166,4167,4172],{"type":49,"value":4139},"Ingest pipeline processors use Mustache templates to reference field values in ",{"type":44,"tag":72,"props":4141,"children":4143},{"className":4142},[],[4144],{"type":49,"value":4145},"value",{"type":49,"value":128},{"type":44,"tag":72,"props":4148,"children":4150},{"className":4149},[],[4151],{"type":49,"value":574},{"type":49,"value":4153},", and similar string parameters. Use ",{"type":44,"tag":64,"props":4155,"children":4156},{},[4157],{"type":49,"value":4158},"triple braces",{"type":49,"value":3136},{"type":44,"tag":72,"props":4161,"children":4163},{"className":4162},[],[4164],{"type":49,"value":4165},"{{{field}}}",{"type":49,"value":505},{"type":44,"tag":64,"props":4168,"children":4169},{},[4170],{"type":49,"value":4171},"single quotes",{"type":49,"value":4173}," — never double braces or double quotes:",{"type":44,"tag":362,"props":4175,"children":4177},{"className":364,"code":4176,"language":366,"meta":367,"style":367},"# CORRECT — triple braces, single quotes\n- append:\n    field: related.user\n    value: '{{{user.target.email}}}'\n    allow_duplicates: false\n    if: ctx.user?.target?.email != null\n\n# WRONG — double braces HTML-escape the value; double quotes\n- append:\n    field: related.user\n    value: \"{{user.target.email}}\"\n    allow_duplicates: false\n    if: ctx.user?.target?.email != null\n",[4178],{"type":44,"tag":72,"props":4179,"children":4180},{"__ignoreMap":367},[4181,4189,4205,4222,4247,4263,4280,4287,4295,4310,4325,4351,4366],{"type":44,"tag":373,"props":4182,"children":4183},{"class":375,"line":376},[4184],{"type":44,"tag":373,"props":4185,"children":4186},{"style":885},[4187],{"type":49,"value":4188},"# CORRECT — triple braces, single quotes\n",{"type":44,"tag":373,"props":4190,"children":4191},{"class":375,"line":29},[4192,4197,4201],{"type":44,"tag":373,"props":4193,"children":4194},{"style":380},[4195],{"type":49,"value":4196},"-",{"type":44,"tag":373,"props":4198,"children":4199},{"style":386},[4200],{"type":49,"value":1494},{"type":44,"tag":373,"props":4202,"children":4203},{"style":380},[4204],{"type":49,"value":394},{"type":44,"tag":373,"props":4206,"children":4207},{"class":375,"line":416},[4208,4213,4217],{"type":44,"tag":373,"props":4209,"children":4210},{"style":386},[4211],{"type":49,"value":4212},"    field",{"type":44,"tag":373,"props":4214,"children":4215},{"style":380},[4216],{"type":49,"value":407},{"type":44,"tag":373,"props":4218,"children":4219},{"style":410},[4220],{"type":49,"value":4221}," related.user\n",{"type":44,"tag":373,"props":4223,"children":4224},{"class":375,"line":434},[4225,4230,4234,4238,4243],{"type":44,"tag":373,"props":4226,"children":4227},{"style":386},[4228],{"type":49,"value":4229},"    value",{"type":44,"tag":373,"props":4231,"children":4232},{"style":380},[4233],{"type":49,"value":407},{"type":44,"tag":373,"props":4235,"children":4236},{"style":380},[4237],{"type":49,"value":449},{"type":44,"tag":373,"props":4239,"children":4240},{"style":410},[4241],{"type":49,"value":4242},"{{{user.target.email}}}",{"type":44,"tag":373,"props":4244,"children":4245},{"style":380},[4246],{"type":49,"value":458},{"type":44,"tag":373,"props":4248,"children":4249},{"class":375,"line":831},[4250,4255,4259],{"type":44,"tag":373,"props":4251,"children":4252},{"style":386},[4253],{"type":49,"value":4254},"    allow_duplicates",{"type":44,"tag":373,"props":4256,"children":4257},{"style":380},[4258],{"type":49,"value":407},{"type":44,"tag":373,"props":4260,"children":4261},{"style":972},[4262],{"type":49,"value":1550},{"type":44,"tag":373,"props":4264,"children":4265},{"class":375,"line":847},[4266,4271,4275],{"type":44,"tag":373,"props":4267,"children":4268},{"style":386},[4269],{"type":49,"value":4270},"    if",{"type":44,"tag":373,"props":4272,"children":4273},{"style":380},[4274],{"type":49,"value":407},{"type":44,"tag":373,"props":4276,"children":4277},{"style":410},[4278],{"type":49,"value":4279}," ctx.user?.target?.email != null\n",{"type":44,"tag":373,"props":4281,"children":4282},{"class":375,"line":871},[4283],{"type":44,"tag":373,"props":4284,"children":4285},{"emptyLinePlaceholder":875},[4286],{"type":49,"value":878},{"type":44,"tag":373,"props":4288,"children":4289},{"class":375,"line":881},[4290],{"type":44,"tag":373,"props":4291,"children":4292},{"style":885},[4293],{"type":49,"value":4294},"# WRONG — double braces HTML-escape the value; double quotes\n",{"type":44,"tag":373,"props":4296,"children":4297},{"class":375,"line":891},[4298,4302,4306],{"type":44,"tag":373,"props":4299,"children":4300},{"style":380},[4301],{"type":49,"value":4196},{"type":44,"tag":373,"props":4303,"children":4304},{"style":386},[4305],{"type":49,"value":1494},{"type":44,"tag":373,"props":4307,"children":4308},{"style":380},[4309],{"type":49,"value":394},{"type":44,"tag":373,"props":4311,"children":4312},{"class":375,"line":908},[4313,4317,4321],{"type":44,"tag":373,"props":4314,"children":4315},{"style":386},[4316],{"type":49,"value":4212},{"type":44,"tag":373,"props":4318,"children":4319},{"style":380},[4320],{"type":49,"value":407},{"type":44,"tag":373,"props":4322,"children":4323},{"style":410},[4324],{"type":49,"value":4221},{"type":44,"tag":373,"props":4326,"children":4327},{"class":375,"line":25},[4328,4332,4336,4341,4346],{"type":44,"tag":373,"props":4329,"children":4330},{"style":386},[4331],{"type":49,"value":4229},{"type":44,"tag":373,"props":4333,"children":4334},{"style":380},[4335],{"type":49,"value":407},{"type":44,"tag":373,"props":4337,"children":4338},{"style":380},[4339],{"type":49,"value":4340}," \"",{"type":44,"tag":373,"props":4342,"children":4343},{"style":410},[4344],{"type":49,"value":4345},"{{user.target.email}}",{"type":44,"tag":373,"props":4347,"children":4348},{"style":380},[4349],{"type":49,"value":4350},"\"\n",{"type":44,"tag":373,"props":4352,"children":4353},{"class":375,"line":933},[4354,4358,4362],{"type":44,"tag":373,"props":4355,"children":4356},{"style":386},[4357],{"type":49,"value":4254},{"type":44,"tag":373,"props":4359,"children":4360},{"style":380},[4361],{"type":49,"value":407},{"type":44,"tag":373,"props":4363,"children":4364},{"style":972},[4365],{"type":49,"value":1550},{"type":44,"tag":373,"props":4367,"children":4368},{"class":375,"line":946},[4369,4373,4377],{"type":44,"tag":373,"props":4370,"children":4371},{"style":386},[4372],{"type":49,"value":4270},{"type":44,"tag":373,"props":4374,"children":4375},{"style":380},[4376],{"type":49,"value":407},{"type":44,"tag":373,"props":4378,"children":4379},{"style":410},[4380],{"type":49,"value":4279},{"type":44,"tag":58,"props":4382,"children":4383},{},[4384,4386,4392,4394,4400,4402,4408,4410,4416],{"type":49,"value":4385},"Why: Mustache double braces ",{"type":44,"tag":72,"props":4387,"children":4389},{"className":4388},[],[4390],{"type":49,"value":4391},"{{...}}",{"type":49,"value":4393}," HTML-encode the value (e.g., ",{"type":44,"tag":72,"props":4395,"children":4397},{"className":4396},[],[4398],{"type":49,"value":4399},"&",{"type":49,"value":4401}," becomes ",{"type":44,"tag":72,"props":4403,"children":4405},{"className":4404},[],[4406],{"type":49,"value":4407},"&",{"type":49,"value":4409},"), which corrupts data in ingest pipelines. Triple braces ",{"type":44,"tag":72,"props":4411,"children":4413},{"className":4412},[],[4414],{"type":49,"value":4415},"{{{...}}}",{"type":49,"value":4417}," emit the raw value. Single quotes prevent YAML from interpreting braces.",{"type":44,"tag":58,"props":4419,"children":4420},{},[4421,4426,4427,4433,4435,4441],{"type":44,"tag":64,"props":4422,"children":4423},{},[4424],{"type":49,"value":4425},"Exception:",{"type":49,"value":3136},{"type":44,"tag":72,"props":4428,"children":4430},{"className":4429},[],[4431],{"type":49,"value":4432},"{{ IngestPipeline \"...\" }}",{"type":49,"value":4434}," in ",{"type":44,"tag":72,"props":4436,"children":4438},{"className":4437},[],[4439],{"type":49,"value":4440},"pipeline.name",{"type":49,"value":4442}," is a Go template directive processed at build time, not a Mustache template — it correctly uses double braces.",{"type":44,"tag":51,"props":4444,"children":4446},{"id":4445},"error-handling-essentials",[4447],{"type":49,"value":4448},"Error handling essentials",{"type":44,"tag":58,"props":4450,"children":4451},{},[4452,4454,4459],{"type":49,"value":4453},"Use pipeline-level ",{"type":44,"tag":72,"props":4455,"children":4457},{"className":4456},[],[4458],{"type":49,"value":188},{"type":49,"value":4460}," as the main error reporting mechanism.",{"type":44,"tag":58,"props":4462,"children":4463},{},[4464],{"type":49,"value":4465},"Recommended baseline (order matters):",{"type":44,"tag":99,"props":4467,"children":4468},{},[4469,4494,4524,4547],{"type":44,"tag":103,"props":4470,"children":4471},{},[4472,4476,4478,4484,4486,4492],{"type":44,"tag":64,"props":4473,"children":4474},{},[4475],{"type":49,"value":1853},{"type":49,"value":4477}," contextual ",{"type":44,"tag":72,"props":4479,"children":4481},{"className":4480},[],[4482],{"type":49,"value":4483},"error.message",{"type":49,"value":4485}," first using ",{"type":44,"tag":72,"props":4487,"children":4489},{"className":4488},[],[4490],{"type":49,"value":4491},"_ingest.on_failure_*",{"type":49,"value":4493}," variables (full template in the standard opening example)",{"type":44,"tag":103,"props":4495,"children":4496},{},[4497,4501,4502,4508,4510,4515,4517,4522],{"type":44,"tag":64,"props":4498,"children":4499},{},[4500],{"type":49,"value":503},{"type":49,"value":3136},{"type":44,"tag":72,"props":4503,"children":4505},{"className":4504},[],[4506],{"type":49,"value":4507},"event.kind: pipeline_error",{"type":49,"value":4509}," (with a ",{"type":44,"tag":72,"props":4511,"children":4513},{"className":4512},[],[4514],{"type":49,"value":15},{"type":49,"value":4516}," on the ",{"type":44,"tag":72,"props":4518,"children":4520},{"className":4519},[],[4521],{"type":49,"value":503},{"type":49,"value":4523}," processor)",{"type":44,"tag":103,"props":4525,"children":4526},{},[4527,4531,4532,4537,4539,4545],{"type":44,"tag":64,"props":4528,"children":4529},{},[4530],{"type":49,"value":1853},{"type":49,"value":3136},{"type":44,"tag":72,"props":4533,"children":4535},{"className":4534},[],[4536],{"type":49,"value":1861},{"type":49,"value":4538}," to ",{"type":44,"tag":72,"props":4540,"children":4542},{"className":4541},[],[4543],{"type":49,"value":4544},"tags",{"type":49,"value":4546}," when you need to retain the failed document for triage",{"type":44,"tag":103,"props":4548,"children":4549},{},[4550,4552,4557,4559,4564],{"type":49,"value":4551},"give ",{"type":44,"tag":64,"props":4553,"children":4554},{},[4555],{"type":49,"value":4556},"every",{"type":49,"value":4558}," processor a ",{"type":44,"tag":72,"props":4560,"children":4562},{"className":4561},[],[4563],{"type":49,"value":15},{"type":49,"value":4565}," (not only processors that can fail)",{"type":44,"tag":58,"props":4567,"children":4568},{},[4569,4571,4576],{"type":49,"value":4570},"Use processor-level ",{"type":44,"tag":72,"props":4572,"children":4574},{"className":4573},[],[4575],{"type":49,"value":188},{"type":49,"value":4577}," for local cleanup or fallback parsing, not as the primary global error message path.",{"type":44,"tag":58,"props":4579,"children":4580},{},[4581,4582,4588,4590,4596,4597,4603,4605,4610],{"type":49,"value":3041},{"type":44,"tag":72,"props":4583,"children":4585},{"className":4584},[],[4586],{"type":49,"value":4587},"references\u002Ferror-handling-patterns.md",{"type":49,"value":4589}," for full examples and tradeoffs (",{"type":44,"tag":72,"props":4591,"children":4593},{"className":4592},[],[4594],{"type":49,"value":4595},"ignore_failure",{"type":49,"value":128},{"type":44,"tag":72,"props":4598,"children":4600},{"className":4599},[],[4601],{"type":49,"value":4602},"fail",{"type":49,"value":4604},", processor-level ",{"type":44,"tag":72,"props":4606,"children":4608},{"className":4607},[],[4609],{"type":49,"value":188},{"type":49,"value":660},{"type":44,"tag":51,"props":4612,"children":4614},{"id":4613},"eventoriginal-handling-jse00001",[4615],{"type":49,"value":4616},"event.original handling (JSE00001)",{"type":44,"tag":58,"props":4618,"children":4619},{},[4620,4622,4628,4630,4635,4636,4641,4643,4649],{"type":49,"value":4621},"The ",{"type":44,"tag":72,"props":4623,"children":4625},{"className":4624},[],[4626],{"type":49,"value":4627},"elastic-package build",{"type":49,"value":4629}," validator enforces that pipelines correctly handle the ",{"type":44,"tag":72,"props":4631,"children":4633},{"className":4632},[],[4634],{"type":49,"value":574},{"type":49,"value":4538},{"type":44,"tag":72,"props":4637,"children":4639},{"className":4638},[],[4640],{"type":49,"value":581},{"type":49,"value":4642}," rename. This check is known as JSE00001. New packages must comply; some legacy packages exclude it via ",{"type":44,"tag":72,"props":4644,"children":4646},{"className":4645},[],[4647],{"type":49,"value":4648},"validation.yml",{"type":49,"value":638},{"type":44,"tag":3088,"props":4651,"children":4653},{"id":4652},"required-two-processor-pattern",[4654],{"type":49,"value":4655},"Required two-processor pattern",{"type":44,"tag":58,"props":4657,"children":4658},{},[4659,4661,4666,4668,4673,4674,4679,4680,4684,4686,4691,4692,4697],{"type":49,"value":4660},"Every pipeline that consumes a ",{"type":44,"tag":72,"props":4662,"children":4664},{"className":4663},[],[4665],{"type":49,"value":574},{"type":49,"value":4667}," field must include both processors (typically ",{"type":44,"tag":64,"props":4669,"children":4670},{},[4671],{"type":49,"value":4672},"after",{"type":49,"value":3136},{"type":44,"tag":72,"props":4675,"children":4677},{"className":4676},[],[4678],{"type":49,"value":3128},{"type":49,"value":1842},{"type":44,"tag":64,"props":4681,"children":4682},{},[4683],{"type":49,"value":4672},{"type":49,"value":4685}," any CEL-only ",{"type":44,"tag":72,"props":4687,"children":4689},{"className":4688},[],[4690],{"type":49,"value":598},{"type":49,"value":3143},{"type":44,"tag":72,"props":4693,"children":4695},{"className":4694},[],[4696],{"type":49,"value":650},{"type":49,"value":4698}," steps when applicable):",{"type":44,"tag":362,"props":4700,"children":4702},{"className":364,"code":4701,"language":366,"meta":367,"style":367},"- rename:\n    field: message\n    tag: rename_message_to_event_original\n    target_field: event.original\n    ignore_missing: true\n    description: Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.\n    if: ctx.event?.original == null\n- remove:\n    field: message\n    tag: remove_message\n    ignore_missing: true\n    description: The `message` field is no longer required if the document has an `event.original` field.\n    if: ctx.event?.original != null\n",[4703],{"type":44,"tag":72,"props":4704,"children":4705},{"__ignoreMap":367},[4706,4721,4736,4752,4768,4784,4800,4815,4830,4845,4860,4875,4890],{"type":44,"tag":373,"props":4707,"children":4708},{"class":375,"line":376},[4709,4713,4717],{"type":44,"tag":373,"props":4710,"children":4711},{"style":380},[4712],{"type":49,"value":4196},{"type":44,"tag":373,"props":4714,"children":4715},{"style":386},[4716],{"type":49,"value":1151},{"type":44,"tag":373,"props":4718,"children":4719},{"style":380},[4720],{"type":49,"value":394},{"type":44,"tag":373,"props":4722,"children":4723},{"class":375,"line":29},[4724,4728,4732],{"type":44,"tag":373,"props":4725,"children":4726},{"style":386},[4727],{"type":49,"value":4212},{"type":44,"tag":373,"props":4729,"children":4730},{"style":380},[4731],{"type":49,"value":407},{"type":44,"tag":373,"props":4733,"children":4734},{"style":410},[4735],{"type":49,"value":1172},{"type":44,"tag":373,"props":4737,"children":4738},{"class":375,"line":416},[4739,4744,4748],{"type":44,"tag":373,"props":4740,"children":4741},{"style":386},[4742],{"type":49,"value":4743},"    tag",{"type":44,"tag":373,"props":4745,"children":4746},{"style":380},[4747],{"type":49,"value":407},{"type":44,"tag":373,"props":4749,"children":4750},{"style":410},[4751],{"type":49,"value":1189},{"type":44,"tag":373,"props":4753,"children":4754},{"class":375,"line":434},[4755,4760,4764],{"type":44,"tag":373,"props":4756,"children":4757},{"style":386},[4758],{"type":49,"value":4759},"    target_field",{"type":44,"tag":373,"props":4761,"children":4762},{"style":380},[4763],{"type":49,"value":407},{"type":44,"tag":373,"props":4765,"children":4766},{"style":410},[4767],{"type":49,"value":1207},{"type":44,"tag":373,"props":4769,"children":4770},{"class":375,"line":831},[4771,4776,4780],{"type":44,"tag":373,"props":4772,"children":4773},{"style":386},[4774],{"type":49,"value":4775},"    ignore_missing",{"type":44,"tag":373,"props":4777,"children":4778},{"style":380},[4779],{"type":49,"value":407},{"type":44,"tag":373,"props":4781,"children":4782},{"style":972},[4783],{"type":49,"value":975},{"type":44,"tag":373,"props":4785,"children":4786},{"class":375,"line":847},[4787,4792,4796],{"type":44,"tag":373,"props":4788,"children":4789},{"style":386},[4790],{"type":49,"value":4791},"    description",{"type":44,"tag":373,"props":4793,"children":4794},{"style":380},[4795],{"type":49,"value":407},{"type":44,"tag":373,"props":4797,"children":4798},{"style":410},[4799],{"type":49,"value":1240},{"type":44,"tag":373,"props":4801,"children":4802},{"class":375,"line":871},[4803,4807,4811],{"type":44,"tag":373,"props":4804,"children":4805},{"style":386},[4806],{"type":49,"value":4270},{"type":44,"tag":373,"props":4808,"children":4809},{"style":380},[4810],{"type":49,"value":407},{"type":44,"tag":373,"props":4812,"children":4813},{"style":410},[4814],{"type":49,"value":1257},{"type":44,"tag":373,"props":4816,"children":4817},{"class":375,"line":881},[4818,4822,4826],{"type":44,"tag":373,"props":4819,"children":4820},{"style":380},[4821],{"type":49,"value":4196},{"type":44,"tag":373,"props":4823,"children":4824},{"style":386},[4825],{"type":49,"value":901},{"type":44,"tag":373,"props":4827,"children":4828},{"style":380},[4829],{"type":49,"value":394},{"type":44,"tag":373,"props":4831,"children":4832},{"class":375,"line":891},[4833,4837,4841],{"type":44,"tag":373,"props":4834,"children":4835},{"style":386},[4836],{"type":49,"value":4212},{"type":44,"tag":373,"props":4838,"children":4839},{"style":380},[4840],{"type":49,"value":407},{"type":44,"tag":373,"props":4842,"children":4843},{"style":410},[4844],{"type":49,"value":1172},{"type":44,"tag":373,"props":4846,"children":4847},{"class":375,"line":908},[4848,4852,4856],{"type":44,"tag":373,"props":4849,"children":4850},{"style":386},[4851],{"type":49,"value":4743},{"type":44,"tag":373,"props":4853,"children":4854},{"style":380},[4855],{"type":49,"value":407},{"type":44,"tag":373,"props":4857,"children":4858},{"style":410},[4859],{"type":49,"value":1306},{"type":44,"tag":373,"props":4861,"children":4862},{"class":375,"line":25},[4863,4867,4871],{"type":44,"tag":373,"props":4864,"children":4865},{"style":386},[4866],{"type":49,"value":4775},{"type":44,"tag":373,"props":4868,"children":4869},{"style":380},[4870],{"type":49,"value":407},{"type":44,"tag":373,"props":4872,"children":4873},{"style":972},[4874],{"type":49,"value":975},{"type":44,"tag":373,"props":4876,"children":4877},{"class":375,"line":933},[4878,4882,4886],{"type":44,"tag":373,"props":4879,"children":4880},{"style":386},[4881],{"type":49,"value":4791},{"type":44,"tag":373,"props":4883,"children":4884},{"style":380},[4885],{"type":49,"value":407},{"type":44,"tag":373,"props":4887,"children":4888},{"style":410},[4889],{"type":49,"value":1339},{"type":44,"tag":373,"props":4891,"children":4892},{"class":375,"line":946},[4893,4897,4901],{"type":44,"tag":373,"props":4894,"children":4895},{"style":386},[4896],{"type":49,"value":4270},{"type":44,"tag":373,"props":4898,"children":4899},{"style":380},[4900],{"type":49,"value":407},{"type":44,"tag":373,"props":4902,"children":4903},{"style":410},[4904],{"type":49,"value":1356},{"type":44,"tag":58,"props":4906,"children":4907},{},[4908,4910,4915,4917,4922,4924,4929,4931,4936],{"type":49,"value":4909},"Step 1 (",{"type":44,"tag":72,"props":4911,"children":4913},{"className":4912},[],[4914],{"type":49,"value":493},{"type":49,"value":4916},"): moves ",{"type":44,"tag":72,"props":4918,"children":4920},{"className":4919},[],[4921],{"type":49,"value":574},{"type":49,"value":4923}," into ",{"type":44,"tag":72,"props":4925,"children":4927},{"className":4926},[],[4928],{"type":49,"value":581},{"type":49,"value":4930},", but only when ",{"type":44,"tag":72,"props":4932,"children":4934},{"className":4933},[],[4935],{"type":49,"value":581},{"type":49,"value":4937}," is not already populated (idempotent when a prior pipeline or Logstash has already set it).",{"type":44,"tag":58,"props":4939,"children":4940},{},[4941,4943,4948,4950,4955,4957,4962],{"type":49,"value":4942},"Step 2 (",{"type":44,"tag":72,"props":4944,"children":4946},{"className":4945},[],[4947],{"type":49,"value":598},{"type":49,"value":4949},"): removes the redundant ",{"type":44,"tag":72,"props":4951,"children":4953},{"className":4952},[],[4954],{"type":49,"value":574},{"type":49,"value":4956}," field when ",{"type":44,"tag":72,"props":4958,"children":4960},{"className":4959},[],[4961],{"type":49,"value":581},{"type":49,"value":4963}," is present (after rename or from an upstream producer).",{"type":44,"tag":3088,"props":4965,"children":4967},{"id":4966},"do-not-add-an-eventoriginal-removal-processor-at-the-end-of-the-pipeline",[4968,4970,4975],{"type":49,"value":4969},"Do NOT add an ",{"type":44,"tag":72,"props":4971,"children":4973},{"className":4972},[],[4974],{"type":49,"value":581},{"type":49,"value":4976}," removal processor at the end of the pipeline",{"type":44,"tag":58,"props":4978,"children":4979},{},[4980,4982,4987,4989,4994,4996,5001,5003,5008,5009,5014,5016,5021],{"type":49,"value":4981},"Some existing integrations contain a ",{"type":44,"tag":72,"props":4983,"children":4985},{"className":4984},[],[4986],{"type":49,"value":598},{"type":49,"value":4988}," processor that deletes ",{"type":44,"tag":72,"props":4990,"children":4992},{"className":4991},[],[4993],{"type":49,"value":581},{"type":49,"value":4995}," at the end of the pipeline when ",{"type":44,"tag":72,"props":4997,"children":4999},{"className":4998},[],[5000],{"type":49,"value":1861},{"type":49,"value":5002}," is not in ",{"type":44,"tag":72,"props":5004,"children":5006},{"className":5005},[],[5007],{"type":49,"value":4544},{"type":49,"value":738},{"type":44,"tag":64,"props":5010,"children":5011},{},[5012],{"type":49,"value":5013},"This pattern is deprecated and must not be used in new pipelines.",{"type":49,"value":5015}," The removal of ",{"type":44,"tag":72,"props":5017,"children":5019},{"className":5018},[],[5020],{"type":49,"value":581},{"type":49,"value":5022}," for storage optimization is now handled by a separate final pipeline outside the integration. Do not copy this pattern from reference integrations that still have it — it is legacy.",{"type":44,"tag":3088,"props":5024,"children":5026},{"id":5025},"reference",[5027],{"type":49,"value":5028},"Reference",{"type":44,"tag":58,"props":5030,"children":5031},{},[5032,5034,5039,5041,5046],{"type":49,"value":5033},"The two-processor JSE00001 pattern (rename + remove of ",{"type":44,"tag":72,"props":5035,"children":5037},{"className":5036},[],[5038],{"type":49,"value":574},{"type":49,"value":5040},") shown above is required and complete. Do not add any additional ",{"type":44,"tag":72,"props":5042,"children":5044},{"className":5043},[],[5045],{"type":49,"value":581},{"type":49,"value":5047}," processors beyond those two.",{"type":44,"tag":51,"props":5049,"children":5051},{"id":5050},"timezone-handling-tz_offset",[5052,5054,5060],{"type":49,"value":5053},"Timezone handling (",{"type":44,"tag":72,"props":5055,"children":5057},{"className":5056},[],[5058],{"type":49,"value":5059},"tz_offset",{"type":49,"value":164},{"type":44,"tag":58,"props":5062,"children":5063},{},[5064,5066,5071,5073,5079,5081,5087],{"type":49,"value":5065},"For data streams that include the ",{"type":44,"tag":72,"props":5067,"children":5069},{"className":5068},[],[5070],{"type":49,"value":5059},{"type":49,"value":5072}," manifest var (syslog streams where messages lack a timezone), set ",{"type":44,"tag":72,"props":5074,"children":5076},{"className":5075},[],[5077],{"type":49,"value":5078},"event.timezone",{"type":49,"value":5080}," from ",{"type":44,"tag":72,"props":5082,"children":5084},{"className":5083},[],[5085],{"type":49,"value":5086},"_conf.tz_offset",{"type":49,"value":5088}," early in the pipeline, before any date parsing:",{"type":44,"tag":362,"props":5090,"children":5092},{"className":364,"code":5091,"language":366,"meta":367,"style":367},"- set:\n    field: event.timezone\n    tag: set_event_timezone\n    value: '{{{_conf.tz_offset}}}'\n    if: ctx._conf?.tz_offset != null && ctx._conf.tz_offset != ''\n",[5093],{"type":44,"tag":72,"props":5094,"children":5095},{"__ignoreMap":367},[5096,5111,5127,5143,5167],{"type":44,"tag":373,"props":5097,"children":5098},{"class":375,"line":376},[5099,5103,5107],{"type":44,"tag":373,"props":5100,"children":5101},{"style":380},[5102],{"type":49,"value":4196},{"type":44,"tag":373,"props":5104,"children":5105},{"style":386},[5106],{"type":49,"value":389},{"type":44,"tag":373,"props":5108,"children":5109},{"style":380},[5110],{"type":49,"value":394},{"type":44,"tag":373,"props":5112,"children":5113},{"class":375,"line":29},[5114,5118,5122],{"type":44,"tag":373,"props":5115,"children":5116},{"style":386},[5117],{"type":49,"value":4212},{"type":44,"tag":373,"props":5119,"children":5120},{"style":380},[5121],{"type":49,"value":407},{"type":44,"tag":373,"props":5123,"children":5124},{"style":410},[5125],{"type":49,"value":5126}," event.timezone\n",{"type":44,"tag":373,"props":5128,"children":5129},{"class":375,"line":416},[5130,5134,5138],{"type":44,"tag":373,"props":5131,"children":5132},{"style":386},[5133],{"type":49,"value":4743},{"type":44,"tag":373,"props":5135,"children":5136},{"style":380},[5137],{"type":49,"value":407},{"type":44,"tag":373,"props":5139,"children":5140},{"style":410},[5141],{"type":49,"value":5142}," set_event_timezone\n",{"type":44,"tag":373,"props":5144,"children":5145},{"class":375,"line":434},[5146,5150,5154,5158,5163],{"type":44,"tag":373,"props":5147,"children":5148},{"style":386},[5149],{"type":49,"value":4229},{"type":44,"tag":373,"props":5151,"children":5152},{"style":380},[5153],{"type":49,"value":407},{"type":44,"tag":373,"props":5155,"children":5156},{"style":380},[5157],{"type":49,"value":449},{"type":44,"tag":373,"props":5159,"children":5160},{"style":410},[5161],{"type":49,"value":5162},"{{{_conf.tz_offset}}}",{"type":44,"tag":373,"props":5164,"children":5165},{"style":380},[5166],{"type":49,"value":458},{"type":44,"tag":373,"props":5168,"children":5169},{"class":375,"line":831},[5170,5174,5178],{"type":44,"tag":373,"props":5171,"children":5172},{"style":386},[5173],{"type":49,"value":4270},{"type":44,"tag":373,"props":5175,"children":5176},{"style":380},[5177],{"type":49,"value":407},{"type":44,"tag":373,"props":5179,"children":5180},{"style":410},[5181],{"type":49,"value":5182}," ctx._conf?.tz_offset != null && ctx._conf.tz_offset != ''\n",{"type":44,"tag":58,"props":5184,"children":5185},{},[5186],{"type":49,"value":5187},"This ensures date processors can apply the correct timezone when parsing timestamps that have no timezone component.",{"type":44,"tag":51,"props":5189,"children":5191},{"id":5190},"syslog-structured-data-rfc-5424-sd-element-parsing",[5192],{"type":49,"value":5193},"Syslog structured data (RFC 5424 SD-ELEMENT) parsing",{"type":44,"tag":58,"props":5195,"children":5196},{},[5197,5199,5205,5207,5213,5215,5221],{"type":49,"value":5198},"For vendor ",{"type":44,"tag":72,"props":5200,"children":5202},{"className":5201},[],[5203],{"type":49,"value":5204},"key=value",{"type":49,"value":5206}," payloads and RFC 5424 SD-ELEMENT blocks, three strategies are available: KV with ",{"type":44,"tag":72,"props":5208,"children":5210},{"className":5209},[],[5211],{"type":49,"value":5212},"trim_value",{"type":49,"value":5214}," (simplest, Strategy 1), ",{"type":44,"tag":72,"props":5216,"children":5218},{"className":5217},[],[5219],{"type":49,"value":5220},"SYSLOG5424SD",{"type":49,"value":5222}," grok + KV with regex splits (Strategy 2), and Painless for edge cases with embedded equals or mixed quoting (Strategy 3).",{"type":44,"tag":58,"props":5224,"children":5225},{},[5226],{"type":49,"value":5227},"Prefer Strategy 1 or 2; use Painless only when KV edge cases demand it.",{"type":44,"tag":58,"props":5229,"children":5230},{},[5231,5232,5238,5239,5244],{"type":49,"value":3041},{"type":44,"tag":72,"props":5233,"children":5235},{"className":5234},[],[5236],{"type":49,"value":5237},"references\u002Fgrok-recipes.md",{"type":49,"value":244},{"type":44,"tag":64,"props":5240,"children":5241},{},[5242],{"type":49,"value":5243},"Syslog structured data strategies",{"type":49,"value":5245}," for full code examples, key settings, and reference implementations.",{"type":44,"tag":51,"props":5247,"children":5249},{"id":5248},"keyword-fields-delivered-as-numbers",[5250],{"type":49,"value":5251},"Keyword fields delivered as numbers",{"type":44,"tag":58,"props":5253,"children":5254},{},[5255,5257,5263,5264,5270],{"type":49,"value":5256},"Fields that carry identifiers, protocol codes, or other opaque values must be declared as ",{"type":44,"tag":72,"props":5258,"children":5260},{"className":5259},[],[5261],{"type":49,"value":5262},"keyword",{"type":49,"value":4434},{"type":44,"tag":72,"props":5265,"children":5267},{"className":5266},[],[5268],{"type":49,"value":5269},"fields.yml",{"type":49,"value":5271}," — even when the source data delivers them as numbers. Common examples:",{"type":44,"tag":99,"props":5273,"children":5274},{},[5275,5287,5292,5297],{"type":44,"tag":103,"props":5276,"children":5277},{},[5278,5280,5286],{"type":49,"value":5279},"network protocol numbers (",{"type":44,"tag":72,"props":5281,"children":5283},{"className":5282},[],[5284],{"type":49,"value":5285},"network.iana_number",{"type":49,"value":164},{"type":44,"tag":103,"props":5288,"children":5289},{},[5290],{"type":49,"value":5291},"port numbers used as identifiers",{"type":44,"tag":103,"props":5293,"children":5294},{},[5295],{"type":49,"value":5296},"error codes, result codes, status codes",{"type":44,"tag":103,"props":5298,"children":5299},{},[5300],{"type":49,"value":5301},"SNMP OIDs, event IDs, object class codes",{"type":44,"tag":58,"props":5303,"children":5304},{},[5305,5307,5312,5314,5319,5321,5326],{"type":49,"value":5306},"Do ",{"type":44,"tag":64,"props":5308,"children":5309},{},[5310],{"type":49,"value":5311},"not",{"type":49,"value":5313}," add a ",{"type":44,"tag":72,"props":5315,"children":5317},{"className":5316},[],[5318],{"type":49,"value":162},{"type":49,"value":5320}," processor to stringify these values. Elasticsearch silently coerces numbers into ",{"type":44,"tag":72,"props":5322,"children":5324},{"className":5323},[],[5325],{"type":49,"value":5262},{"type":49,"value":5327}," strings at index time, so the pipeline can pass the raw numeric value through unchanged.",{"type":44,"tag":58,"props":5329,"children":5330},{},[5331,5333,5338],{"type":49,"value":5332},"The field declaration in ",{"type":44,"tag":72,"props":5334,"children":5336},{"className":5335},[],[5337],{"type":49,"value":5269},{"type":49,"value":407},{"type":44,"tag":362,"props":5340,"children":5342},{"className":364,"code":5341,"language":366,"meta":367,"style":367},"- name: network.iana_number\n  type: keyword\n  description: IANA protocol number.\n",[5343],{"type":44,"tag":72,"props":5344,"children":5345},{"__ignoreMap":367},[5346,5367,5384],{"type":44,"tag":373,"props":5347,"children":5348},{"class":375,"line":376},[5349,5353,5358,5362],{"type":44,"tag":373,"props":5350,"children":5351},{"style":380},[5352],{"type":49,"value":4196},{"type":44,"tag":373,"props":5354,"children":5355},{"style":386},[5356],{"type":49,"value":5357}," name",{"type":44,"tag":373,"props":5359,"children":5360},{"style":380},[5361],{"type":49,"value":407},{"type":44,"tag":373,"props":5363,"children":5364},{"style":410},[5365],{"type":49,"value":5366}," network.iana_number\n",{"type":44,"tag":373,"props":5368,"children":5369},{"class":375,"line":29},[5370,5375,5379],{"type":44,"tag":373,"props":5371,"children":5372},{"style":386},[5373],{"type":49,"value":5374},"  type",{"type":44,"tag":373,"props":5376,"children":5377},{"style":380},[5378],{"type":49,"value":407},{"type":44,"tag":373,"props":5380,"children":5381},{"style":410},[5382],{"type":49,"value":5383}," keyword\n",{"type":44,"tag":373,"props":5385,"children":5386},{"class":375,"line":416},[5387,5392,5396],{"type":44,"tag":373,"props":5388,"children":5389},{"style":386},[5390],{"type":49,"value":5391},"  description",{"type":44,"tag":373,"props":5393,"children":5394},{"style":380},[5395],{"type":49,"value":407},{"type":44,"tag":373,"props":5397,"children":5398},{"style":410},[5399],{"type":49,"value":5400}," IANA protocol number.\n",{"type":44,"tag":58,"props":5402,"children":5403},{},[5404,5406,5412,5414,5419,5421,5427,5429,5435],{"type":49,"value":5405},"Because the test runner compares raw value types against declared field types, it will flag ",{"type":44,"tag":72,"props":5407,"children":5409},{"className":5408},[],[5410],{"type":49,"value":5411},"6",{"type":49,"value":5413}," (long) as a mismatch for ",{"type":44,"tag":72,"props":5415,"children":5417},{"className":5416},[],[5418],{"type":49,"value":5262},{"type":49,"value":5420},". Declare the field in ",{"type":44,"tag":72,"props":5422,"children":5424},{"className":5423},[],[5425],{"type":49,"value":5426},"numeric_keyword_fields",{"type":49,"value":5428}," in the pipeline test config so the runner accepts the numeric representation without requiring the fixture to artificially stringify the value. See ",{"type":44,"tag":72,"props":5430,"children":5432},{"className":5431},[],[5433],{"type":49,"value":5434},"integration-testing\u002Freferences\u002Fpipeline-testing.md",{"type":49,"value":5436}," for the config syntax.",{"type":44,"tag":51,"props":5438,"children":5440},{"id":5439},"vendor-field-naming",[5441],{"type":49,"value":5442},"Vendor field naming",{"type":44,"tag":58,"props":5444,"children":5445},{},[5446,5448,5454,5455,5461,5463,5469],{"type":49,"value":5447},"Preserve vendor field names exactly as they appear in the source. Do not rename, reformat, or normalize vendor-specific field names — the only permitted renaming is mapping a vendor field to an ECS field (e.g. renaming ",{"type":44,"tag":72,"props":5449,"children":5451},{"className":5450},[],[5452],{"type":49,"value":5453},"src_ip",{"type":49,"value":4538},{"type":44,"tag":72,"props":5456,"children":5458},{"className":5457},[],[5459],{"type":49,"value":5460},"source.ip",{"type":49,"value":5462},"). When a vendor field has no ECS equivalent, keep it under a vendor-namespaced prefix (e.g. ",{"type":44,"tag":72,"props":5464,"children":5466},{"className":5465},[],[5467],{"type":49,"value":5468},"vendor.product.field_name",{"type":49,"value":5470},") using the original name from the source.",{"type":44,"tag":51,"props":5472,"children":5474},{"id":5473},"relatedip-population",[5475],{"type":49,"value":5476},"related.ip population",{"type":44,"tag":58,"props":5478,"children":5479},{},[5480,5492],{"type":44,"tag":64,"props":5481,"children":5482},{},[5483,5485,5491],{"type":49,"value":5484},"Every IP address present in the document must be appended to ",{"type":44,"tag":72,"props":5486,"children":5488},{"className":5487},[],[5489],{"type":49,"value":5490},"related.ip",{"type":49,"value":638},{"type":49,"value":5493}," This includes source, destination, client, server, host, and any other IP fields — whatever applies to the event type.",{"type":44,"tag":58,"props":5495,"children":5496},{},[5497,5499,5504,5506,5511,5513,5518,5519,5524,5526,5531],{"type":49,"value":5498},"Use one ",{"type":44,"tag":72,"props":5500,"children":5502},{"className":5501},[],[5503],{"type":49,"value":1853},{"type":49,"value":5505}," processor per IP field, with ",{"type":44,"tag":72,"props":5507,"children":5509},{"className":5508},[],[5510],{"type":49,"value":628},{"type":49,"value":5512}," so it is a no-op when the field is absent. Place these processors after all IP fields have been set (for example after ",{"type":44,"tag":72,"props":5514,"children":5516},{"className":5515},[],[5517],{"type":49,"value":4092},{"type":49,"value":128},{"type":44,"tag":72,"props":5520,"children":5522},{"className":5521},[],[5523],{"type":49,"value":162},{"type":49,"value":5525},", and any ECS rename steps) and before the cleanup ",{"type":44,"tag":72,"props":5527,"children":5529},{"className":5528},[],[5530],{"type":49,"value":598},{"type":49,"value":5532}," processors.",{"type":44,"tag":362,"props":5534,"children":5536},{"className":364,"code":5535,"language":366,"meta":367,"style":367},"  - append:\n      field: related.ip\n      tag: append_source_ip_to_related\n      value: '{{{source.ip}}}'\n      allow_duplicates: false\n      if: ctx.source?.ip != null\n  - append:\n      field: related.ip\n      tag: append_destination_ip_to_related\n      value: '{{{destination.ip}}}'\n      allow_duplicates: false\n      if: ctx.destination?.ip != null\n  # repeat the same pattern for client.ip, server.ip, host.ip, and any other IP fields the pipeline sets\n",[5537],{"type":44,"tag":72,"props":5538,"children":5539},{"__ignoreMap":367},[5540,5555,5571,5587,5611,5626,5642,5657,5672,5688,5712,5727,5743],{"type":44,"tag":373,"props":5541,"children":5542},{"class":375,"line":376},[5543,5547,5551],{"type":44,"tag":373,"props":5544,"children":5545},{"style":380},[5546],{"type":49,"value":383},{"type":44,"tag":373,"props":5548,"children":5549},{"style":386},[5550],{"type":49,"value":1494},{"type":44,"tag":373,"props":5552,"children":5553},{"style":380},[5554],{"type":49,"value":394},{"type":44,"tag":373,"props":5556,"children":5557},{"class":375,"line":29},[5558,5562,5566],{"type":44,"tag":373,"props":5559,"children":5560},{"style":386},[5561],{"type":49,"value":402},{"type":44,"tag":373,"props":5563,"children":5564},{"style":380},[5565],{"type":49,"value":407},{"type":44,"tag":373,"props":5567,"children":5568},{"style":410},[5569],{"type":49,"value":5570}," related.ip\n",{"type":44,"tag":373,"props":5572,"children":5573},{"class":375,"line":416},[5574,5578,5582],{"type":44,"tag":373,"props":5575,"children":5576},{"style":386},[5577],{"type":49,"value":422},{"type":44,"tag":373,"props":5579,"children":5580},{"style":380},[5581],{"type":49,"value":407},{"type":44,"tag":373,"props":5583,"children":5584},{"style":410},[5585],{"type":49,"value":5586}," append_source_ip_to_related\n",{"type":44,"tag":373,"props":5588,"children":5589},{"class":375,"line":434},[5590,5594,5598,5602,5607],{"type":44,"tag":373,"props":5591,"children":5592},{"style":386},[5593],{"type":49,"value":440},{"type":44,"tag":373,"props":5595,"children":5596},{"style":380},[5597],{"type":49,"value":407},{"type":44,"tag":373,"props":5599,"children":5600},{"style":380},[5601],{"type":49,"value":449},{"type":44,"tag":373,"props":5603,"children":5604},{"style":410},[5605],{"type":49,"value":5606},"{{{source.ip}}}",{"type":44,"tag":373,"props":5608,"children":5609},{"style":380},[5610],{"type":49,"value":458},{"type":44,"tag":373,"props":5612,"children":5613},{"class":375,"line":831},[5614,5618,5622],{"type":44,"tag":373,"props":5615,"children":5616},{"style":386},[5617],{"type":49,"value":1541},{"type":44,"tag":373,"props":5619,"children":5620},{"style":380},[5621],{"type":49,"value":407},{"type":44,"tag":373,"props":5623,"children":5624},{"style":972},[5625],{"type":49,"value":1550},{"type":44,"tag":373,"props":5627,"children":5628},{"class":375,"line":847},[5629,5633,5637],{"type":44,"tag":373,"props":5630,"children":5631},{"style":386},[5632],{"type":49,"value":984},{"type":44,"tag":373,"props":5634,"children":5635},{"style":380},[5636],{"type":49,"value":407},{"type":44,"tag":373,"props":5638,"children":5639},{"style":410},[5640],{"type":49,"value":5641}," ctx.source?.ip != null\n",{"type":44,"tag":373,"props":5643,"children":5644},{"class":375,"line":871},[5645,5649,5653],{"type":44,"tag":373,"props":5646,"children":5647},{"style":380},[5648],{"type":49,"value":383},{"type":44,"tag":373,"props":5650,"children":5651},{"style":386},[5652],{"type":49,"value":1494},{"type":44,"tag":373,"props":5654,"children":5655},{"style":380},[5656],{"type":49,"value":394},{"type":44,"tag":373,"props":5658,"children":5659},{"class":375,"line":881},[5660,5664,5668],{"type":44,"tag":373,"props":5661,"children":5662},{"style":386},[5663],{"type":49,"value":402},{"type":44,"tag":373,"props":5665,"children":5666},{"style":380},[5667],{"type":49,"value":407},{"type":44,"tag":373,"props":5669,"children":5670},{"style":410},[5671],{"type":49,"value":5570},{"type":44,"tag":373,"props":5673,"children":5674},{"class":375,"line":891},[5675,5679,5683],{"type":44,"tag":373,"props":5676,"children":5677},{"style":386},[5678],{"type":49,"value":422},{"type":44,"tag":373,"props":5680,"children":5681},{"style":380},[5682],{"type":49,"value":407},{"type":44,"tag":373,"props":5684,"children":5685},{"style":410},[5686],{"type":49,"value":5687}," append_destination_ip_to_related\n",{"type":44,"tag":373,"props":5689,"children":5690},{"class":375,"line":908},[5691,5695,5699,5703,5708],{"type":44,"tag":373,"props":5692,"children":5693},{"style":386},[5694],{"type":49,"value":440},{"type":44,"tag":373,"props":5696,"children":5697},{"style":380},[5698],{"type":49,"value":407},{"type":44,"tag":373,"props":5700,"children":5701},{"style":380},[5702],{"type":49,"value":449},{"type":44,"tag":373,"props":5704,"children":5705},{"style":410},[5706],{"type":49,"value":5707},"{{{destination.ip}}}",{"type":44,"tag":373,"props":5709,"children":5710},{"style":380},[5711],{"type":49,"value":458},{"type":44,"tag":373,"props":5713,"children":5714},{"class":375,"line":25},[5715,5719,5723],{"type":44,"tag":373,"props":5716,"children":5717},{"style":386},[5718],{"type":49,"value":1541},{"type":44,"tag":373,"props":5720,"children":5721},{"style":380},[5722],{"type":49,"value":407},{"type":44,"tag":373,"props":5724,"children":5725},{"style":972},[5726],{"type":49,"value":1550},{"type":44,"tag":373,"props":5728,"children":5729},{"class":375,"line":933},[5730,5734,5738],{"type":44,"tag":373,"props":5731,"children":5732},{"style":386},[5733],{"type":49,"value":984},{"type":44,"tag":373,"props":5735,"children":5736},{"style":380},[5737],{"type":49,"value":407},{"type":44,"tag":373,"props":5739,"children":5740},{"style":410},[5741],{"type":49,"value":5742}," ctx.destination?.ip != null\n",{"type":44,"tag":373,"props":5744,"children":5745},{"class":375,"line":946},[5746],{"type":44,"tag":373,"props":5747,"children":5748},{"style":885},[5749],{"type":49,"value":5750},"  # repeat the same pattern for client.ip, server.ip, host.ip, and any other IP fields the pipeline sets\n",{"type":44,"tag":58,"props":5752,"children":5753},{},[5754],{"type":49,"value":5755},"Rules:",{"type":44,"tag":99,"props":5757,"children":5758},{},[5759,5771,5783],{"type":44,"tag":103,"props":5760,"children":5761},{},[5762,5763,5769],{"type":49,"value":352},{"type":44,"tag":72,"props":5764,"children":5766},{"className":5765},[],[5767],{"type":49,"value":5768},"allow_duplicates: false",{"type":49,"value":5770}," on every append to avoid repeated values.",{"type":44,"tag":103,"props":5772,"children":5773},{},[5774,5776,5781],{"type":49,"value":5775},"Add an ",{"type":44,"tag":72,"props":5777,"children":5779},{"className":5778},[],[5780],{"type":49,"value":636},{"type":49,"value":5782}," guard on every processor so it skips fields absent in the event.",{"type":44,"tag":103,"props":5784,"children":5785},{},[5786,5788,5793],{"type":49,"value":5787},"Add one ",{"type":44,"tag":72,"props":5789,"children":5791},{"className":5790},[],[5792],{"type":49,"value":1853},{"type":49,"value":5794}," per IP field the pipeline actually writes — do not add processors for fields the pipeline never sets.",{"type":44,"tag":51,"props":5796,"children":5798},{"id":5797},"painless-script-best-practices",[5799],{"type":49,"value":5800},"Painless script best practices",{"type":44,"tag":58,"props":5802,"children":5803},{},[5804,5816,5817,5822],{"type":44,"tag":64,"props":5805,"children":5806},{},[5807,5809,5814],{"type":49,"value":5808},"Before writing any ",{"type":44,"tag":72,"props":5810,"children":5812},{"className":5811},[],[5813],{"type":49,"value":3993},{"type":49,"value":5815}," processor, you MUST check whether a built-in processor can do the same job.",{"type":49,"value":3136},{"type":44,"tag":72,"props":5818,"children":5820},{"className":5819},[],[5821],{"type":49,"value":3993},{"type":49,"value":5823}," is the slowest general-purpose processor (Painless compilation + per-document execution). The following operations have dedicated processors that are cheaper and easier to review:",{"type":44,"tag":5825,"props":5826,"children":5827},"table",{},[5828,5852],{"type":44,"tag":5829,"props":5830,"children":5831},"thead",{},[5832],{"type":44,"tag":5833,"props":5834,"children":5835},"tr",{},[5836,5842],{"type":44,"tag":5837,"props":5838,"children":5839},"th",{},[5840],{"type":49,"value":5841},"If you need to …",{"type":44,"tag":5837,"props":5843,"children":5844},{},[5845,5847],{"type":49,"value":5846},"Use this processor, not ",{"type":44,"tag":72,"props":5848,"children":5850},{"className":5849},[],[5851],{"type":49,"value":3993},{"type":44,"tag":5853,"props":5854,"children":5855},"tbody",{},[5856,5886,5902,5918,5934,5950,5966,5982],{"type":44,"tag":5833,"props":5857,"children":5858},{},[5859,5865],{"type":44,"tag":5860,"props":5861,"children":5862},"td",{},[5863],{"type":49,"value":5864},"Copy, move, or rename a field",{"type":44,"tag":5860,"props":5866,"children":5867},{},[5868,5873,5875,5880,5881],{"type":44,"tag":72,"props":5869,"children":5871},{"className":5870},[],[5872],{"type":49,"value":493},{"type":49,"value":5874}," or ",{"type":44,"tag":72,"props":5876,"children":5878},{"className":5877},[],[5879],{"type":49,"value":503},{"type":49,"value":505},{"type":44,"tag":72,"props":5882,"children":5884},{"className":5883},[],[5885],{"type":49,"value":511},{"type":44,"tag":5833,"props":5887,"children":5888},{},[5889,5894],{"type":44,"tag":5860,"props":5890,"children":5891},{},[5892],{"type":49,"value":5893},"Set a constant or derived value",{"type":44,"tag":5860,"props":5895,"children":5896},{},[5897],{"type":44,"tag":72,"props":5898,"children":5900},{"className":5899},[],[5901],{"type":49,"value":503},{"type":44,"tag":5833,"props":5903,"children":5904},{},[5905,5910],{"type":44,"tag":5860,"props":5906,"children":5907},{},[5908],{"type":49,"value":5909},"Add a value to a list",{"type":44,"tag":5860,"props":5911,"children":5912},{},[5913],{"type":44,"tag":72,"props":5914,"children":5916},{"className":5915},[],[5917],{"type":49,"value":1853},{"type":44,"tag":5833,"props":5919,"children":5920},{},[5921,5926],{"type":44,"tag":5860,"props":5922,"children":5923},{},[5924],{"type":49,"value":5925},"Change a field's type",{"type":44,"tag":5860,"props":5927,"children":5928},{},[5929],{"type":44,"tag":72,"props":5930,"children":5932},{"className":5931},[],[5933],{"type":49,"value":162},{"type":44,"tag":5833,"props":5935,"children":5936},{},[5937,5942],{"type":44,"tag":5860,"props":5938,"children":5939},{},[5940],{"type":49,"value":5941},"Extract a substring from a delimited string",{"type":44,"tag":5860,"props":5943,"children":5944},{},[5945],{"type":44,"tag":72,"props":5946,"children":5948},{"className":5947},[],[5949],{"type":49,"value":134},{"type":44,"tag":5833,"props":5951,"children":5952},{},[5953,5958],{"type":44,"tag":5860,"props":5954,"children":5955},{},[5956],{"type":49,"value":5957},"Extract a substring with regex",{"type":44,"tag":5860,"props":5959,"children":5960},{},[5961],{"type":44,"tag":72,"props":5962,"children":5964},{"className":5963},[],[5965],{"type":49,"value":126},{"type":44,"tag":5833,"props":5967,"children":5968},{},[5969,5974],{"type":44,"tag":5860,"props":5970,"children":5971},{},[5972],{"type":49,"value":5973},"Replace characters in a string",{"type":44,"tag":5860,"props":5975,"children":5976},{},[5977],{"type":44,"tag":72,"props":5978,"children":5980},{"className":5979},[],[5981],{"type":49,"value":4045},{"type":44,"tag":5833,"props":5983,"children":5984},{},[5985,5990],{"type":44,"tag":5860,"props":5986,"children":5987},{},[5988],{"type":49,"value":5989},"Normalize case",{"type":44,"tag":5860,"props":5991,"children":5992},{},[5993,5998,6000],{"type":44,"tag":72,"props":5994,"children":5996},{"className":5995},[],[5997],{"type":49,"value":4052},{"type":49,"value":5999}," \u002F ",{"type":44,"tag":72,"props":6001,"children":6003},{"className":6002},[],[6004],{"type":49,"value":4059},{"type":44,"tag":58,"props":6006,"children":6007},{},[6008,6010,6015,6017,6022,6023,6028],{"type":49,"value":6009},"Only reach for ",{"type":44,"tag":72,"props":6011,"children":6013},{"className":6012},[],[6014],{"type":49,"value":3993},{"type":49,"value":6016}," when no combination of built-in processors can express the logic — for example, ECS categorization lookup tables with 5+ entries (Pattern A), complex conditional arithmetic, or edge-case string parsing that ",{"type":44,"tag":72,"props":6018,"children":6020},{"className":6019},[],[6021],{"type":49,"value":134},{"type":49,"value":1842},{"type":44,"tag":72,"props":6024,"children":6026},{"className":6025},[],[6027],{"type":49,"value":126},{"type":49,"value":6029}," genuinely cannot handle.",{"type":44,"tag":58,"props":6031,"children":6032},{},[6033],{"type":44,"tag":64,"props":6034,"children":6035},{},[6036,6038,6044],{"type":49,"value":6037},"Case-insensitive comparisons — use ",{"type":44,"tag":72,"props":6039,"children":6041},{"className":6040},[],[6042],{"type":49,"value":6043},"equalsIgnoreCase()",{"type":49,"value":6045}," when casing is unpredictable",{"type":44,"tag":58,"props":6047,"children":6048},{},[6049,6051,6056,6058,6064,6066],{"type":49,"value":6050},"Syslog and vendor devices are often inconsistent about casing, so Painless scripts comparing vendor-specific free-text fields should use ",{"type":44,"tag":72,"props":6052,"children":6054},{"className":6053},[],[6055],{"type":49,"value":6043},{"type":49,"value":6057}," rather than ",{"type":44,"tag":72,"props":6059,"children":6061},{"className":6060},[],[6062],{"type":49,"value":6063},"==",{"type":49,"value":6065},". However, ",{"type":44,"tag":64,"props":6067,"children":6068},{},[6069],{"type":49,"value":6070},"apply this judgement contextually, not blanket:",{"type":44,"tag":99,"props":6072,"children":6073},{},[6074,6096],{"type":44,"tag":103,"props":6075,"children":6076},{},[6077,6086,6088,6094],{"type":44,"tag":64,"props":6078,"children":6079},{},[6080,6081],{"type":49,"value":352},{"type":44,"tag":72,"props":6082,"children":6084},{"className":6083},[],[6085],{"type":49,"value":6043},{"type":49,"value":6087}," when the vendor field value may vary in casing between devices, firmware versions, or log sources (e.g. action fields like ",{"type":44,"tag":72,"props":6089,"children":6091},{"className":6090},[],[6092],{"type":49,"value":6093},"allow\u002FAllow\u002FALLOW",{"type":49,"value":6095},", severity strings, free-text status fields).",{"type":44,"tag":103,"props":6097,"children":6098},{},[6099,6108,6110,6115],{"type":44,"tag":64,"props":6100,"children":6101},{},[6102,6103],{"type":49,"value":352},{"type":44,"tag":72,"props":6104,"children":6106},{"className":6105},[],[6107],{"type":49,"value":6063},{"type":49,"value":6109}," when the API or spec defines a fixed lowercase enum and the values are always delivered as-specified (e.g. ECS categorization fields, API response fields documented as lowercase-only enums). Adding ",{"type":44,"tag":72,"props":6111,"children":6113},{"className":6112},[],[6114],{"type":49,"value":6043},{"type":49,"value":6116}," to fixed-enum fields adds noise without value.",{"type":44,"tag":362,"props":6118,"children":6122},{"className":6119,"code":6120,"language":6121,"meta":367,"style":367},"language-painless shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F Correct for unpredictable vendor casing\nif (ctx.vendor?.action?.equalsIgnoreCase('allow')) { ... }\n\n\u002F\u002F Correct for a fixed lowercase API enum — == is appropriate here\nif (ctx.json?.event_type == 'login') { ... }\n\n\u002F\u002F Incorrect for unpredictable casing — breaks on \"Allow\", \"ALLOW\"\nif (ctx.vendor?.action == 'allow') { ... }\n","painless",[6123],{"type":44,"tag":72,"props":6124,"children":6125},{"__ignoreMap":367},[6126,6134,6142,6149,6157,6165,6172,6180],{"type":44,"tag":373,"props":6127,"children":6128},{"class":375,"line":376},[6129],{"type":44,"tag":373,"props":6130,"children":6131},{},[6132],{"type":49,"value":6133},"\u002F\u002F Correct for unpredictable vendor casing\n",{"type":44,"tag":373,"props":6135,"children":6136},{"class":375,"line":29},[6137],{"type":44,"tag":373,"props":6138,"children":6139},{},[6140],{"type":49,"value":6141},"if (ctx.vendor?.action?.equalsIgnoreCase('allow')) { ... }\n",{"type":44,"tag":373,"props":6143,"children":6144},{"class":375,"line":416},[6145],{"type":44,"tag":373,"props":6146,"children":6147},{"emptyLinePlaceholder":875},[6148],{"type":49,"value":878},{"type":44,"tag":373,"props":6150,"children":6151},{"class":375,"line":434},[6152],{"type":44,"tag":373,"props":6153,"children":6154},{},[6155],{"type":49,"value":6156},"\u002F\u002F Correct for a fixed lowercase API enum — == is appropriate here\n",{"type":44,"tag":373,"props":6158,"children":6159},{"class":375,"line":831},[6160],{"type":44,"tag":373,"props":6161,"children":6162},{},[6163],{"type":49,"value":6164},"if (ctx.json?.event_type == 'login') { ... }\n",{"type":44,"tag":373,"props":6166,"children":6167},{"class":375,"line":847},[6168],{"type":44,"tag":373,"props":6169,"children":6170},{"emptyLinePlaceholder":875},[6171],{"type":49,"value":878},{"type":44,"tag":373,"props":6173,"children":6174},{"class":375,"line":871},[6175],{"type":44,"tag":373,"props":6176,"children":6177},{},[6178],{"type":49,"value":6179},"\u002F\u002F Incorrect for unpredictable casing — breaks on \"Allow\", \"ALLOW\"\n",{"type":44,"tag":373,"props":6181,"children":6182},{"class":375,"line":881},[6183],{"type":44,"tag":373,"props":6184,"children":6185},{},[6186],{"type":49,"value":6187},"if (ctx.vendor?.action == 'allow') { ... }\n",{"type":44,"tag":58,"props":6189,"children":6190},{},[6191],{"type":44,"tag":64,"props":6192,"children":6193},{},[6194,6196,6202],{"type":49,"value":6195},"Access ",{"type":44,"tag":72,"props":6197,"children":6199},{"className":6198},[],[6200],{"type":49,"value":6201},"ctx",{"type":49,"value":6203}," directly in script bodies — no null-safe operators",{"type":44,"tag":58,"props":6205,"children":6206},{},[6207,6209,6214,6216,6222,6224,6229,6231,6237],{"type":49,"value":6208},"In ",{"type":44,"tag":72,"props":6210,"children":6212},{"className":6211},[],[6213],{"type":49,"value":3993},{"type":49,"value":6215}," processor ",{"type":44,"tag":72,"props":6217,"children":6219},{"className":6218},[],[6220],{"type":49,"value":6221},"source",{"type":49,"value":6223}," blocks, access ",{"type":44,"tag":72,"props":6225,"children":6227},{"className":6226},[],[6228],{"type":49,"value":6201},{"type":49,"value":6230}," fields directly. Use explicit null checks instead of the null-safe ",{"type":44,"tag":72,"props":6232,"children":6234},{"className":6233},[],[6235],{"type":49,"value":6236},"?.",{"type":49,"value":6238}," operator.",{"type":44,"tag":362,"props":6240,"children":6242},{"className":6119,"code":6241,"language":6121,"meta":367,"style":367},"\u002F\u002F Correct — direct access with explicit null check\nif (ctx.source != null && ctx.source.ip != null) { ... }\n\n\u002F\u002F Incorrect — null-safe operator in a script body\nif (ctx.source?.ip != null) { ... }\n",[6243],{"type":44,"tag":72,"props":6244,"children":6245},{"__ignoreMap":367},[6246,6254,6262,6269,6277],{"type":44,"tag":373,"props":6247,"children":6248},{"class":375,"line":376},[6249],{"type":44,"tag":373,"props":6250,"children":6251},{},[6252],{"type":49,"value":6253},"\u002F\u002F Correct — direct access with explicit null check\n",{"type":44,"tag":373,"props":6255,"children":6256},{"class":375,"line":29},[6257],{"type":44,"tag":373,"props":6258,"children":6259},{},[6260],{"type":49,"value":6261},"if (ctx.source != null && ctx.source.ip != null) { ... }\n",{"type":44,"tag":373,"props":6263,"children":6264},{"class":375,"line":416},[6265],{"type":44,"tag":373,"props":6266,"children":6267},{"emptyLinePlaceholder":875},[6268],{"type":49,"value":878},{"type":44,"tag":373,"props":6270,"children":6271},{"class":375,"line":434},[6272],{"type":44,"tag":373,"props":6273,"children":6274},{},[6275],{"type":49,"value":6276},"\u002F\u002F Incorrect — null-safe operator in a script body\n",{"type":44,"tag":373,"props":6278,"children":6279},{"class":375,"line":831},[6280],{"type":44,"tag":373,"props":6281,"children":6282},{},[6283],{"type":49,"value":6284},"if (ctx.source?.ip != null) { ... }\n",{"type":44,"tag":58,"props":6286,"children":6287},{},[6288,6290,6295,6297,6302],{"type":49,"value":6289},"Note: null-safe ",{"type":44,"tag":72,"props":6291,"children":6293},{"className":6292},[],[6294],{"type":49,"value":6236},{"type":49,"value":6296}," is acceptable in processor ",{"type":44,"tag":72,"props":6298,"children":6300},{"className":6299},[],[6301],{"type":49,"value":636},{"type":49,"value":6303}," conditions (YAML), which are a different Painless execution context:",{"type":44,"tag":362,"props":6305,"children":6307},{"className":364,"code":6306,"language":366,"meta":367,"style":367},"- append:\n    field: related.ip\n    value: '{{{source.ip}}}'\n    if: ctx.source?.ip != null\n",[6308],{"type":44,"tag":72,"props":6309,"children":6310},{"__ignoreMap":367},[6311,6326,6341,6364],{"type":44,"tag":373,"props":6312,"children":6313},{"class":375,"line":376},[6314,6318,6322],{"type":44,"tag":373,"props":6315,"children":6316},{"style":380},[6317],{"type":49,"value":4196},{"type":44,"tag":373,"props":6319,"children":6320},{"style":386},[6321],{"type":49,"value":1494},{"type":44,"tag":373,"props":6323,"children":6324},{"style":380},[6325],{"type":49,"value":394},{"type":44,"tag":373,"props":6327,"children":6328},{"class":375,"line":29},[6329,6333,6337],{"type":44,"tag":373,"props":6330,"children":6331},{"style":386},[6332],{"type":49,"value":4212},{"type":44,"tag":373,"props":6334,"children":6335},{"style":380},[6336],{"type":49,"value":407},{"type":44,"tag":373,"props":6338,"children":6339},{"style":410},[6340],{"type":49,"value":5570},{"type":44,"tag":373,"props":6342,"children":6343},{"class":375,"line":416},[6344,6348,6352,6356,6360],{"type":44,"tag":373,"props":6345,"children":6346},{"style":386},[6347],{"type":49,"value":4229},{"type":44,"tag":373,"props":6349,"children":6350},{"style":380},[6351],{"type":49,"value":407},{"type":44,"tag":373,"props":6353,"children":6354},{"style":380},[6355],{"type":49,"value":449},{"type":44,"tag":373,"props":6357,"children":6358},{"style":410},[6359],{"type":49,"value":5606},{"type":44,"tag":373,"props":6361,"children":6362},{"style":380},[6363],{"type":49,"value":458},{"type":44,"tag":373,"props":6365,"children":6366},{"class":375,"line":434},[6367,6371,6375],{"type":44,"tag":373,"props":6368,"children":6369},{"style":386},[6370],{"type":49,"value":4270},{"type":44,"tag":373,"props":6372,"children":6373},{"style":380},[6374],{"type":49,"value":407},{"type":44,"tag":373,"props":6376,"children":6377},{"style":410},[6378],{"type":49,"value":5641},{"type":44,"tag":58,"props":6380,"children":6381},{},[6382],{"type":44,"tag":64,"props":6383,"children":6384},{},[6385],{"type":49,"value":6386},"Other rules",{"type":44,"tag":99,"props":6388,"children":6389},{},[6390,6415,6420],{"type":44,"tag":103,"props":6391,"children":6392},{},[6393,6395,6400,6402,6407,6409,6414],{"type":49,"value":6394},"Every ",{"type":44,"tag":72,"props":6396,"children":6398},{"className":6397},[],[6399],{"type":49,"value":3993},{"type":49,"value":6401}," processor must have a ",{"type":44,"tag":72,"props":6403,"children":6405},{"className":6404},[],[6406],{"type":49,"value":15},{"type":49,"value":6408}," and a ",{"type":44,"tag":72,"props":6410,"children":6412},{"className":6411},[],[6413],{"type":49,"value":296},{"type":49,"value":638},{"type":44,"tag":103,"props":6416,"children":6417},{},[6418],{"type":49,"value":6419},"Keep scripts short and scoped — move complex logic into helper variables inside the script, not across multiple script processors.",{"type":44,"tag":103,"props":6421,"children":6422},{},[6423,6435],{"type":44,"tag":64,"props":6424,"children":6425},{},[6426,6428,6433],{"type":49,"value":6427},"Do not use ",{"type":44,"tag":72,"props":6429,"children":6431},{"className":6430},[],[6432],{"type":49,"value":3993},{"type":49,"value":6434}," when built-in processors suffice",{"type":49,"value":6436}," — see the mandatory checklist table at the top of this section.",{"type":44,"tag":51,"props":6438,"children":6440},{"id":6439},"ecs-categorization-mapping",[6441],{"type":49,"value":6442},"ECS categorization mapping",{"type":44,"tag":58,"props":6444,"children":6445},{},[6446,6448,6454,6455,6461,6462,6468,6469,6475,6477,6482,6483,6488],{"type":49,"value":6447},"When mapping source event types or actions to ",{"type":44,"tag":72,"props":6449,"children":6451},{"className":6450},[],[6452],{"type":49,"value":6453},"event.category",{"type":49,"value":128},{"type":44,"tag":72,"props":6456,"children":6458},{"className":6457},[],[6459],{"type":49,"value":6460},"event.type",{"type":49,"value":128},{"type":44,"tag":72,"props":6463,"children":6465},{"className":6464},[],[6466],{"type":49,"value":6467},"event.outcome",{"type":49,"value":3157},{"type":44,"tag":72,"props":6470,"children":6472},{"className":6471},[],[6473],{"type":49,"value":6474},"event.action",{"type":49,"value":6476},", use the patterns in ",{"type":44,"tag":72,"props":6478,"children":6480},{"className":6479},[],[6481],{"type":49,"value":4074},{"type":49,"value":244},{"type":44,"tag":64,"props":6484,"children":6485},{},[6486],{"type":49,"value":6487},"ECS categorization mapping patterns",{"type":49,"value":407},{"type":44,"tag":99,"props":6490,"children":6491},{},[6492,6524,6547],{"type":44,"tag":103,"props":6493,"children":6494},{},[6495,6500,6502,6508,6510,6515,6517,6522],{"type":44,"tag":64,"props":6496,"children":6497},{},[6498],{"type":49,"value":6499},"Pattern A",{"type":49,"value":6501}," (script with ",{"type":44,"tag":72,"props":6503,"children":6505},{"className":6504},[],[6506],{"type":49,"value":6507},"params",{"type":49,"value":6509}," lookup table): recommended for ",{"type":44,"tag":64,"props":6511,"children":6512},{},[6513],{"type":49,"value":6514},"5+ mappings",{"type":49,"value":6516},". Mapping data in ",{"type":44,"tag":72,"props":6518,"children":6520},{"className":6519},[],[6521],{"type":49,"value":6507},{"type":49,"value":6523}," enables Painless compilation caching and keeps the script body generic.",{"type":44,"tag":103,"props":6525,"children":6526},{},[6527,6532,6533,6538,6540,6545],{"type":44,"tag":64,"props":6528,"children":6529},{},[6530],{"type":49,"value":6531},"Pattern B",{"type":49,"value":708},{"type":44,"tag":72,"props":6534,"children":6536},{"className":6535},[],[6537],{"type":49,"value":503},{"type":49,"value":6539}," processors with conditionals): for ",{"type":44,"tag":64,"props":6541,"children":6542},{},[6543],{"type":49,"value":6544},"fewer than 5 mappings",{"type":49,"value":6546}," where a script is overkill.",{"type":44,"tag":103,"props":6548,"children":6549},{},[6550,6555,6557,6562],{"type":44,"tag":64,"props":6551,"children":6552},{},[6553],{"type":49,"value":6554},"Pattern C",{"type":49,"value":6556}," (sub-pipeline): for ",{"type":44,"tag":64,"props":6558,"children":6559},{},[6560],{"type":49,"value":6561},"100+ mappings",{"type":49,"value":6563},", extract the categorization into a dedicated sub-pipeline file.",{"type":44,"tag":58,"props":6565,"children":6566},{},[6567,6572,6574,6579,6581,6586,6587,6593,6595,6600],{"type":44,"tag":64,"props":6568,"children":6569},{},[6570],{"type":49,"value":6571},"Do NOT",{"type":49,"value":6573}," use bulk ",{"type":44,"tag":72,"props":6575,"children":6577},{"className":6576},[],[6578],{"type":49,"value":1853},{"type":49,"value":6580}," processors (2 per event type = 50+ processors for 25 types) or inline Painless ",{"type":44,"tag":72,"props":6582,"children":6584},{"className":6583},[],[6585],{"type":49,"value":636},{"type":49,"value":3143},{"type":44,"tag":72,"props":6588,"children":6590},{"className":6589},[],[6591],{"type":49,"value":6592},"else",{"type":49,"value":6594}," chains without ",{"type":44,"tag":72,"props":6596,"children":6598},{"className":6597},[],[6599],{"type":49,"value":6507},{"type":49,"value":6601}," (defeats compilation caching). These are explicit anti-patterns — see the cookbook for details.",{"type":44,"tag":51,"props":6603,"children":6605},{"id":6604},"grok-best-practices",[6606],{"type":49,"value":6607},"Grok best practices",{"type":44,"tag":99,"props":6609,"children":6610},{},[6611,6622,6627,6737,6742],{"type":44,"tag":103,"props":6612,"children":6613},{},[6614,6615,6620],{"type":49,"value":3965},{"type":44,"tag":72,"props":6616,"children":6618},{"className":6617},[],[6619],{"type":49,"value":134},{"type":49,"value":6621}," when structure is fixed",{"type":44,"tag":103,"props":6623,"children":6624},{},[6625],{"type":49,"value":6626},"use simpler grok patterns where possible",{"type":44,"tag":103,"props":6628,"children":6629},{},[6630,6632,6637,6638,6643,6644],{"type":49,"value":6631},"always anchor grok patterns with ",{"type":44,"tag":72,"props":6633,"children":6635},{"className":6634},[],[6636],{"type":49,"value":4119},{"type":49,"value":1842},{"type":44,"tag":72,"props":6639,"children":6641},{"className":6640},[],[6642],{"type":49,"value":4126},{"type":49,"value":394},{"type":44,"tag":362,"props":6645,"children":6647},{"className":364,"code":6646,"language":366,"meta":367,"style":367},"# Correct — anchored, fails fast on non-matching lines\npatterns:\n  - '^%{IPORHOST:source.ip} %{USER:user.name} %{DATA:message}$'\n\n# Incorrect — unanchored, scans the whole string for a partial match\npatterns:\n  - '%{IPORHOST:source.ip} %{USER:user.name} %{DATA:message}'\n",[6648],{"type":44,"tag":72,"props":6649,"children":6650},{"__ignoreMap":367},[6651,6659,6671,6691,6698,6706,6717],{"type":44,"tag":373,"props":6652,"children":6653},{"class":375,"line":376},[6654],{"type":44,"tag":373,"props":6655,"children":6656},{"style":885},[6657],{"type":49,"value":6658},"# Correct — anchored, fails fast on non-matching lines\n",{"type":44,"tag":373,"props":6660,"children":6661},{"class":375,"line":29},[6662,6667],{"type":44,"tag":373,"props":6663,"children":6664},{"style":386},[6665],{"type":49,"value":6666},"patterns",{"type":44,"tag":373,"props":6668,"children":6669},{"style":380},[6670],{"type":49,"value":394},{"type":44,"tag":373,"props":6672,"children":6673},{"class":375,"line":416},[6674,6678,6682,6687],{"type":44,"tag":373,"props":6675,"children":6676},{"style":380},[6677],{"type":49,"value":383},{"type":44,"tag":373,"props":6679,"children":6680},{"style":380},[6681],{"type":49,"value":449},{"type":44,"tag":373,"props":6683,"children":6684},{"style":410},[6685],{"type":49,"value":6686},"^%{IPORHOST:source.ip} %{USER:user.name} %{DATA:message}$",{"type":44,"tag":373,"props":6688,"children":6689},{"style":380},[6690],{"type":49,"value":458},{"type":44,"tag":373,"props":6692,"children":6693},{"class":375,"line":434},[6694],{"type":44,"tag":373,"props":6695,"children":6696},{"emptyLinePlaceholder":875},[6697],{"type":49,"value":878},{"type":44,"tag":373,"props":6699,"children":6700},{"class":375,"line":831},[6701],{"type":44,"tag":373,"props":6702,"children":6703},{"style":885},[6704],{"type":49,"value":6705},"# Incorrect — unanchored, scans the whole string for a partial match\n",{"type":44,"tag":373,"props":6707,"children":6708},{"class":375,"line":847},[6709,6713],{"type":44,"tag":373,"props":6710,"children":6711},{"style":386},[6712],{"type":49,"value":6666},{"type":44,"tag":373,"props":6714,"children":6715},{"style":380},[6716],{"type":49,"value":394},{"type":44,"tag":373,"props":6718,"children":6719},{"class":375,"line":871},[6720,6724,6728,6733],{"type":44,"tag":373,"props":6721,"children":6722},{"style":380},[6723],{"type":49,"value":383},{"type":44,"tag":373,"props":6725,"children":6726},{"style":380},[6727],{"type":49,"value":449},{"type":44,"tag":373,"props":6729,"children":6730},{"style":410},[6731],{"type":49,"value":6732},"%{IPORHOST:source.ip} %{USER:user.name} %{DATA:message}",{"type":44,"tag":373,"props":6734,"children":6735},{"style":380},[6736],{"type":49,"value":458},{"type":44,"tag":103,"props":6738,"children":6739},{},[6740],{"type":49,"value":6741},"avoid unnecessary backtracking-heavy custom regex",{"type":44,"tag":103,"props":6743,"children":6744},{},[6745,6747,6752],{"type":49,"value":6746},"add a ",{"type":44,"tag":72,"props":6748,"children":6750},{"className":6749},[],[6751],{"type":49,"value":15},{"type":49,"value":6753}," to every grok (and every other) processor",{"type":44,"tag":58,"props":6755,"children":6756},{},[6757,6759,6765,6767,6772],{"type":49,"value":6758},"For grok syntax (three expression forms, inline regex, type coercion, ",{"type":44,"tag":72,"props":6760,"children":6762},{"className":6761},[],[6763],{"type":49,"value":6764},"pattern_definitions",{"type":49,"value":6766},"), syslog header splitting recipes, and common mistakes, see ",{"type":44,"tag":72,"props":6768,"children":6770},{"className":6769},[],[6771],{"type":49,"value":5237},{"type":49,"value":638},{"type":44,"tag":51,"props":6774,"children":6776},{"id":6775},"prohibited-patterns",[6777],{"type":49,"value":6778},"Prohibited patterns",{"type":44,"tag":58,"props":6780,"children":6781},{},[6782,6784,6788],{"type":49,"value":6783},"These patterns exist in many legacy integrations but ",{"type":44,"tag":64,"props":6785,"children":6786},{},[6787],{"type":49,"value":675},{"type":49,"value":6789}," be used in new or updated pipelines. Do not copy them from reference integrations.",{"type":44,"tag":3088,"props":6791,"children":6793},{"id":6792},"never-set-eventingested",[6794,6796],{"type":49,"value":6795},"Never set ",{"type":44,"tag":72,"props":6797,"children":6799},{"className":6798},[],[6800],{"type":49,"value":6801},"event.ingested",{"type":44,"tag":58,"props":6803,"children":6804},{},[6805,6806,6811,6813,6818,6819,6824,6826,6831],{"type":49,"value":4621},{"type":44,"tag":72,"props":6807,"children":6809},{"className":6808},[],[6810],{"type":49,"value":6801},{"type":49,"value":6812}," field is managed by Elasticsearch outside the integration pipeline. ",{"type":44,"tag":64,"props":6814,"children":6815},{},[6816],{"type":49,"value":6817},"Do not",{"type":49,"value":5313},{"type":44,"tag":72,"props":6820,"children":6822},{"className":6821},[],[6823],{"type":49,"value":503},{"type":49,"value":6825}," processor for ",{"type":44,"tag":72,"props":6827,"children":6829},{"className":6828},[],[6830],{"type":49,"value":6801},{"type":49,"value":6832}," in any integration pipeline. This includes patterns like:",{"type":44,"tag":362,"props":6834,"children":6836},{"className":364,"code":6835,"language":366,"meta":367,"style":367},"# PROHIBITED — do not use\n- set:\n    field: event.ingested\n    value: '{{{_ingest.timestamp}}}'\n",[6837],{"type":44,"tag":72,"props":6838,"children":6839},{"__ignoreMap":367},[6840,6848,6863,6879],{"type":44,"tag":373,"props":6841,"children":6842},{"class":375,"line":376},[6843],{"type":44,"tag":373,"props":6844,"children":6845},{"style":885},[6846],{"type":49,"value":6847},"# PROHIBITED — do not use\n",{"type":44,"tag":373,"props":6849,"children":6850},{"class":375,"line":29},[6851,6855,6859],{"type":44,"tag":373,"props":6852,"children":6853},{"style":380},[6854],{"type":49,"value":4196},{"type":44,"tag":373,"props":6856,"children":6857},{"style":386},[6858],{"type":49,"value":389},{"type":44,"tag":373,"props":6860,"children":6861},{"style":380},[6862],{"type":49,"value":394},{"type":44,"tag":373,"props":6864,"children":6865},{"class":375,"line":416},[6866,6870,6874],{"type":44,"tag":373,"props":6867,"children":6868},{"style":386},[6869],{"type":49,"value":4212},{"type":44,"tag":373,"props":6871,"children":6872},{"style":380},[6873],{"type":49,"value":407},{"type":44,"tag":373,"props":6875,"children":6876},{"style":410},[6877],{"type":49,"value":6878}," event.ingested\n",{"type":44,"tag":373,"props":6880,"children":6881},{"class":375,"line":434},[6882,6886,6890,6894,6899],{"type":44,"tag":373,"props":6883,"children":6884},{"style":386},[6885],{"type":49,"value":4229},{"type":44,"tag":373,"props":6887,"children":6888},{"style":380},[6889],{"type":49,"value":407},{"type":44,"tag":373,"props":6891,"children":6892},{"style":380},[6893],{"type":49,"value":449},{"type":44,"tag":373,"props":6895,"children":6896},{"style":410},[6897],{"type":49,"value":6898},"{{{_ingest.timestamp}}}",{"type":44,"tag":373,"props":6900,"children":6901},{"style":380},[6902],{"type":49,"value":458},{"type":44,"tag":58,"props":6904,"children":6905},{},[6906,6908,6913,6915,6920],{"type":49,"value":6907},"The pipeline ",{"type":44,"tag":64,"props":6909,"children":6910},{},[6911],{"type":49,"value":6912},"should",{"type":49,"value":6914}," set ",{"type":44,"tag":72,"props":6916,"children":6918},{"className":6917},[],[6919],{"type":49,"value":2013},{"type":49,"value":6921}," from the original event's timestamp. When the source data contains multiple timestamps, map them as follows:",{"type":44,"tag":99,"props":6923,"children":6924},{},[6925,6938,6958,6972],{"type":44,"tag":103,"props":6926,"children":6927},{},[6928,6936],{"type":44,"tag":64,"props":6929,"children":6930},{},[6931],{"type":44,"tag":72,"props":6932,"children":6934},{"className":6933},[],[6935],{"type":49,"value":2013},{"type":49,"value":6937},": the primary event timestamp parsed from the source data. This is required.",{"type":44,"tag":103,"props":6939,"children":6940},{},[6941,6950,6952,6957],{"type":44,"tag":64,"props":6942,"children":6943},{},[6944],{"type":44,"tag":72,"props":6945,"children":6947},{"className":6946},[],[6948],{"type":49,"value":6949},"event.created",{"type":49,"value":6951},": when the event was first created or recorded by the source system (if different from ",{"type":44,"tag":72,"props":6953,"children":6955},{"className":6954},[],[6956],{"type":49,"value":2013},{"type":49,"value":660},{"type":44,"tag":103,"props":6959,"children":6960},{},[6961,6970],{"type":44,"tag":64,"props":6962,"children":6963},{},[6964],{"type":44,"tag":72,"props":6965,"children":6967},{"className":6966},[],[6968],{"type":49,"value":6969},"event.start",{"type":49,"value":6971},": when an activity or period began (e.g., session start, connection start).",{"type":44,"tag":103,"props":6973,"children":6974},{},[6975,6984],{"type":44,"tag":64,"props":6976,"children":6977},{},[6978],{"type":44,"tag":72,"props":6979,"children":6981},{"className":6980},[],[6982],{"type":49,"value":6983},"event.end",{"type":49,"value":6985},": when an activity or period ended (e.g., session end, connection close).",{"type":44,"tag":58,"props":6987,"children":6988},{},[6989,6991,6996,6997,7002,7004,7009,7011,7017,7018,7023,7025,7030,7032,7038],{"type":49,"value":6990},"If a source timestamp does not match the semantics of ",{"type":44,"tag":72,"props":6992,"children":6994},{"className":6993},[],[6995],{"type":49,"value":6949},{"type":49,"value":128},{"type":44,"tag":72,"props":6998,"children":7000},{"className":6999},[],[7001],{"type":49,"value":6969},{"type":49,"value":7003},", or ",{"type":44,"tag":72,"props":7005,"children":7007},{"className":7006},[],[7008],{"type":49,"value":6983},{"type":49,"value":7010},", map it to a custom field under the vendor namespace with ",{"type":44,"tag":72,"props":7012,"children":7014},{"className":7013},[],[7015],{"type":49,"value":7016},"type: date",{"type":49,"value":4434},{"type":44,"tag":72,"props":7019,"children":7021},{"className":7020},[],[7022],{"type":49,"value":5269},{"type":49,"value":7024}," and use a ",{"type":44,"tag":72,"props":7026,"children":7028},{"className":7027},[],[7029],{"type":49,"value":155},{"type":49,"value":7031}," processor with the appropriate ",{"type":44,"tag":72,"props":7033,"children":7035},{"className":7034},[],[7036],{"type":49,"value":7037},"target_field",{"type":49,"value":638},{"type":44,"tag":3088,"props":7040,"children":7042},{"id":7041},"never-use-preserve_duplicate_custom_fields",[7043,7045],{"type":49,"value":7044},"Never use ",{"type":44,"tag":72,"props":7046,"children":7048},{"className":7047},[],[7049],{"type":49,"value":7050},"preserve_duplicate_custom_fields",{"type":44,"tag":58,"props":7052,"children":7053},{},[7054,7055,7060,7062,7067,7068,7073,7075,7080,7082,7087],{"type":49,"value":4621},{"type":44,"tag":72,"props":7056,"children":7058},{"className":7057},[],[7059],{"type":49,"value":7050},{"type":49,"value":7061}," tag pattern — where source fields are copied to ECS fields using ",{"type":44,"tag":72,"props":7063,"children":7065},{"className":7064},[],[7066],{"type":49,"value":503},{"type":49,"value":505},{"type":44,"tag":72,"props":7069,"children":7071},{"className":7070},[],[7072],{"type":49,"value":511},{"type":49,"value":7074}," and the originals are conditionally retained — is a legacy anti-pattern. ",{"type":44,"tag":64,"props":7076,"children":7077},{},[7078],{"type":49,"value":7079},"Do not use it in any new or updated pipeline.",{"type":49,"value":7081}," Do not add a ",{"type":44,"tag":72,"props":7083,"children":7085},{"className":7084},[],[7086],{"type":49,"value":7050},{"type":49,"value":7088}," manifest variable, tag, or conditional logic.",{"type":44,"tag":58,"props":7090,"children":7091},{},[7092],{"type":49,"value":7093},"Instead, follow these field mapping rules:",{"type":44,"tag":99,"props":7095,"children":7096},{},[7097,7109,7146],{"type":44,"tag":103,"props":7098,"children":7099},{},[7100,7102,7107],{"type":49,"value":7101},"When a source field maps to an ECS field, use ",{"type":44,"tag":72,"props":7103,"children":7105},{"className":7104},[],[7106],{"type":49,"value":493},{"type":49,"value":7108}," to move it directly. The source field is removed and no duplicate exists.",{"type":44,"tag":103,"props":7110,"children":7111},{},[7112,7114,7119,7120,7125,7126,7131,7132,7137,7139,7144],{"type":49,"value":7113},"When a type conversion is needed (e.g., string to date, string to long), use the appropriate processor (",{"type":44,"tag":72,"props":7115,"children":7117},{"className":7116},[],[7118],{"type":49,"value":155},{"type":49,"value":128},{"type":44,"tag":72,"props":7121,"children":7123},{"className":7122},[],[7124],{"type":49,"value":162},{"type":49,"value":128},{"type":44,"tag":72,"props":7127,"children":7129},{"className":7128},[],[7130],{"type":49,"value":503},{"type":49,"value":505},{"type":44,"tag":72,"props":7133,"children":7135},{"className":7134},[],[7136],{"type":49,"value":511},{"type":49,"value":7138},") to populate the ECS target field, then ",{"type":44,"tag":72,"props":7140,"children":7142},{"className":7141},[],[7143],{"type":49,"value":598},{"type":49,"value":7145}," the source field in the cleanup section at the end of the pipeline.",{"type":44,"tag":103,"props":7147,"children":7148},{},[7149,7154],{"type":44,"tag":64,"props":7150,"children":7151},{},[7152],{"type":49,"value":7153},"Never design a pipeline that needs to preserve both the original vendor field and the ECS copy.",{"type":49,"value":7155}," The ECS field is the canonical location.",{"type":44,"tag":58,"props":7157,"children":7158},{},[7159],{"type":49,"value":7160},"If you encounter this pattern in a reference integration, ignore it — it is legacy.",{"type":44,"tag":3088,"props":7162,"children":7164},{"id":7163},"never-add-an-eventoriginal-removal-processor-at-the-end",[7165,7167,7172],{"type":49,"value":7166},"Never add an ",{"type":44,"tag":72,"props":7168,"children":7170},{"className":7169},[],[7171],{"type":49,"value":581},{"type":49,"value":7173}," removal processor at the end",{"type":44,"tag":58,"props":7175,"children":7176},{},[7177,7179,7184,7185,7190],{"type":49,"value":7178},"As documented in the JSE00001 section above: do not add a ",{"type":44,"tag":72,"props":7180,"children":7182},{"className":7181},[],[7183],{"type":49,"value":598},{"type":49,"value":6825},{"type":44,"tag":72,"props":7186,"children":7188},{"className":7187},[],[7189],{"type":49,"value":581},{"type":49,"value":7191}," at the end of the pipeline. This is handled by a separate final pipeline.",{"type":44,"tag":51,"props":7193,"children":7195},{"id":7194},"references",[7196],{"type":49,"value":7197},"References",{"type":44,"tag":99,"props":7199,"children":7200},{},[7201,7211,7219,7227,7237],{"type":44,"tag":103,"props":7202,"children":7203},{},[7204,7209],{"type":44,"tag":72,"props":7205,"children":7207},{"className":7206},[],[7208],{"type":49,"value":4074},{"type":49,"value":7210}," — processor selection, parsing\u002Fnormalization\u002Fenrichment examples, ECS categorization mapping patterns (Pattern A\u002FB\u002FC + anti-patterns)",{"type":44,"tag":103,"props":7212,"children":7213},{},[7214],{"type":44,"tag":72,"props":7215,"children":7217},{"className":7216},[],[7218],{"type":49,"value":3047},{"type":44,"tag":103,"props":7220,"children":7221},{},[7222],{"type":44,"tag":72,"props":7223,"children":7225},{"className":7224},[],[7226],{"type":49,"value":4587},{"type":44,"tag":103,"props":7228,"children":7229},{},[7230,7235],{"type":44,"tag":72,"props":7231,"children":7233},{"className":7232},[],[7234],{"type":49,"value":5237},{"type":49,"value":7236}," — grok syntax, type coercion, syslog header recipes, common mistakes, pattern library link",{"type":44,"tag":103,"props":7238,"children":7239},{},[7240,7246,7248,7253],{"type":44,"tag":72,"props":7241,"children":7243},{"className":7242},[],[7244],{"type":49,"value":7245},"references\u002Fbuilder-subagent-guidance.md",{"type":49,"value":7247}," — subagent operating manual: scope boundaries, skill-load sequence, input data paths (CEL-first vs Direct), 9-step pipeline build workflow, \"review generated output, never hand-edit expected JSON\", reporting contract. The orchestrator dispatches subagents by passing this file's ",{"type":44,"tag":64,"props":7249,"children":7250},{},[7251],{"type":49,"value":7252},"path",{"type":49,"value":7254}," in the task prompt; the subagent reads it itself in its own fresh context. Do NOT embed\u002Fpaste its contents into the task prompt.",{"type":44,"tag":7256,"props":7257,"children":7258},"style",{},[7259],{"type":49,"value":7260},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":7262,"total":7432},[7263,7282,7299,7312,7331,7343,7353,7368,7380,7395,7406,7419],{"slug":7264,"name":7264,"fn":7265,"description":7266,"org":7267,"tags":7268,"stars":7279,"repoUrl":7280,"updatedAt":7281},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7269,7272,7275,7276],{"name":7270,"slug":7271,"type":15},"Analytics","analytics",{"name":7273,"slug":7274,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":7277,"slug":7278,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":7283,"name":7283,"fn":7284,"description":7285,"org":7286,"tags":7287,"stars":7279,"repoUrl":7280,"updatedAt":7298},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7288,7291,7292,7295],{"name":7289,"slug":7290,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":7293,"slug":7294,"type":15},"Engineering","engineering",{"name":7296,"slug":7297,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":7300,"name":7300,"fn":7301,"description":7302,"org":7303,"tags":7304,"stars":7279,"repoUrl":7280,"updatedAt":7311},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7305,7306,7307,7308],{"name":9,"slug":8,"type":15},{"name":23,"slug":24,"type":15},{"name":7277,"slug":7278,"type":15},{"name":7309,"slug":7310,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":7313,"name":7313,"fn":7314,"description":7315,"org":7316,"tags":7317,"stars":7328,"repoUrl":7329,"updatedAt":7330},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7318,7321,7322,7325],{"name":7319,"slug":7320,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":7323,"slug":7324,"type":15},"Operations","operations",{"name":7326,"slug":7327,"type":15},"Permissions","permissions",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:44.946285",{"slug":7332,"name":7332,"fn":7333,"description":7334,"org":7335,"tags":7336,"stars":7328,"repoUrl":7329,"updatedAt":7342},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7337,7338,7341],{"name":7319,"slug":7320,"type":15},{"name":7339,"slug":7340,"type":15},"Deployment","deployment",{"name":23,"slug":24,"type":15},"2026-07-12T07:46:42.353362",{"slug":7344,"name":7344,"fn":7345,"description":7346,"org":7347,"tags":7348,"stars":7328,"repoUrl":7329,"updatedAt":7352},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7349,7350,7351],{"name":7319,"slug":7320,"type":15},{"name":23,"slug":24,"type":15},{"name":7323,"slug":7324,"type":15},"2026-07-12T07:46:41.097412",{"slug":7354,"name":7354,"fn":7355,"description":7356,"org":7357,"tags":7358,"stars":7328,"repoUrl":7329,"updatedAt":7367},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7359,7360,7361,7364],{"name":7319,"slug":7320,"type":15},{"name":23,"slug":24,"type":15},{"name":7362,"slug":7363,"type":15},"Networking","networking",{"name":7365,"slug":7366,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":7369,"name":7369,"fn":7370,"description":7371,"org":7372,"tags":7373,"stars":7328,"repoUrl":7329,"updatedAt":7379},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7374,7377,7378],{"name":7375,"slug":7376,"type":15},"Authentication","authentication",{"name":7319,"slug":7320,"type":15},{"name":23,"slug":24,"type":15},"2026-07-12T07:46:39.783105",{"slug":7381,"name":7381,"fn":7382,"description":7383,"org":7384,"tags":7385,"stars":7328,"repoUrl":7329,"updatedAt":7394},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7386,7389,7390,7393],{"name":7387,"slug":7388,"type":15},"Audit","audit",{"name":23,"slug":24,"type":15},{"name":7391,"slug":7392,"type":15},"Logs","logs",{"name":7365,"slug":7366,"type":15},"2026-07-12T07:47:35.092599",{"slug":7396,"name":7396,"fn":7397,"description":7398,"org":7399,"tags":7400,"stars":7328,"repoUrl":7329,"updatedAt":7405},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7401,7402,7403,7404],{"name":7375,"slug":7376,"type":15},{"name":9,"slug":8,"type":15},{"name":23,"slug":24,"type":15},{"name":7365,"slug":7366,"type":15},"2026-07-12T07:47:41.474547",{"slug":7407,"name":7407,"fn":7408,"description":7409,"org":7410,"tags":7411,"stars":7328,"repoUrl":7329,"updatedAt":7418},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7412,7413,7414,7417],{"name":9,"slug":8,"type":15},{"name":23,"slug":24,"type":15},{"name":7415,"slug":7416,"type":15},"RBAC","rbac",{"name":7365,"slug":7366,"type":15},"2026-07-12T07:47:36.394177",{"slug":7420,"name":7420,"fn":7421,"description":7422,"org":7423,"tags":7424,"stars":7328,"repoUrl":7329,"updatedAt":7431},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7425,7426,7427,7428],{"name":7270,"slug":7271,"type":15},{"name":7273,"slug":7274,"type":15},{"name":23,"slug":24,"type":15},{"name":7429,"slug":7430,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":7434,"total":959},[7435,7450,7465,7473,7490,7503,7517],{"slug":7436,"name":7436,"fn":7437,"description":7438,"org":7439,"tags":7440,"stars":25,"repoUrl":26,"updatedAt":7449},"anonymize-logs","anonymize sensitive log data","Anonymize and sanitize customer-provided log files before they are committed as pipeline test fixtures or sample events. Performs a line-by-line review and replaces all sensitive values inline, preserving log structure and format exactly — never reformats, re-indents, or restructures content. Invoke manually with \u002Fanonymize-logs.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7441,7444,7445,7448],{"name":7442,"slug":7443,"type":15},"Data Cleaning","data-cleaning",{"name":7391,"slug":7392,"type":15},{"name":7446,"slug":7447,"type":15},"Privacy","privacy",{"name":7365,"slug":7366,"type":15},"2026-07-18T05:13:04.420121",{"slug":7451,"name":7451,"fn":7452,"description":7453,"org":7454,"tags":7455,"stars":25,"repoUrl":26,"updatedAt":7464},"cel-programs","write CEL programs for data collection","Use for all CEL and mito work on integrations that collect from APIs — writing CEL programs, cel.yml.hbs templates, manifest configuration, mock-first development with the mito CLI, system test mock setup, and answering CEL\u002Fmito questions. Load this skill whenever any data stream uses the cel input type.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7456,7459,7460,7461],{"name":7457,"slug":7458,"type":15},"API Development","api-development",{"name":13,"slug":14,"type":15},{"name":9,"slug":8,"type":15},{"name":7462,"slug":7463,"type":15},"Integrations","integrations","2026-07-12T07:47:10.207064",{"slug":683,"name":683,"fn":7466,"description":7467,"org":7468,"tags":7469,"stars":25,"repoUrl":26,"updatedAt":7472},"create Elastic integration packages","Use when creating a new Elastic integration package, scaffolding data streams, answering package layout or structure questions, or running the end-to-end integration build workflow. Covers package topology, scaffold commands, post-scaffold edits, and full orchestration of CEL\u002Fpipeline\u002Ftest subagents.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7470,7471],{"name":23,"slug":24,"type":15},{"name":7462,"slug":7463,"type":15},"2026-07-12T07:46:56.318866",{"slug":7474,"name":7474,"fn":7475,"description":7476,"org":7477,"tags":7478,"stars":25,"repoUrl":26,"updatedAt":7489},"dashboard-guidelines","create and review Kibana dashboard assets","Use when creating or reviewing Kibana assets in packages, including dashboard export structure, naming, and data stream alignment.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7479,7482,7483,7486],{"name":7480,"slug":7481,"type":15},"Dashboards","dashboards",{"name":23,"slug":24,"type":15},{"name":7484,"slug":7485,"type":15},"Kibana","kibana",{"name":7487,"slug":7488,"type":15},"UI Components","ui-components","2026-07-12T07:47:07.702332",{"slug":7491,"name":7491,"fn":7492,"description":7493,"org":7494,"tags":7495,"stars":25,"repoUrl":26,"updatedAt":7502},"dashboard-review","review Elastic dashboard JSON changes","Use when reviewing dashboard JSON changes in a PR or branch. Extracts structured descriptions with kbdash, compares before\u002Fafter, and checks guideline compliance.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7496,7499,7500,7501],{"name":7497,"slug":7498,"type":15},"Code Review","code-review",{"name":7480,"slug":7481,"type":15},{"name":9,"slug":8,"type":15},{"name":7484,"slug":7485,"type":15},"2026-07-12T07:47:06.493988",{"slug":218,"name":218,"fn":7504,"description":7505,"org":7506,"tags":7507,"stars":25,"repoUrl":26,"updatedAt":7516},"define ECS field mappings for integrations","Use when defining field mappings for data streams, populating ecs.yml with ECS field references, selecting ECS categorization values, choosing custom field types, or troubleshooting mapping validation failures.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7508,7511,7514,7515],{"name":7509,"slug":7510,"type":15},"Data Modeling","data-modeling",{"name":7512,"slug":7513,"type":15},"Data Quality","data-quality",{"name":9,"slug":8,"type":15},{"name":7462,"slug":7463,"type":15},"2026-07-12T07:47:13.472534",{"slug":230,"name":230,"fn":7518,"description":7519,"org":7520,"tags":7521,"stars":25,"repoUrl":26,"updatedAt":7528},"develop and validate Elastic integrations","Use when developing or validating Elastic integrations with elastic-package commands such as build, check, lint, format, test, stack, service, install, profiles, and benchmark.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[7522,7525,7526,7527],{"name":7523,"slug":7524,"type":15},"CLI","cli",{"name":9,"slug":8,"type":15},{"name":7462,"slug":7463,"type":15},{"name":7309,"slug":7310,"type":15},"2026-07-12T07:46:57.647395"]