Ingest pipelines in Elasticsearch - Mini Project: Build & Apply

Create and Use an Elasticsearch Ingest Pipeline

📖 Scenario: You work as a data engineer. You need to preprocess incoming log data before storing it in Elasticsearch. This preprocessing will add a timestamp and convert a field to lowercase.

🎯 Goal: Build an Elasticsearch ingest pipeline that adds a timestamp and converts the user field to lowercase. Then simulate sending a document through this pipeline and see the processed output.

📋 What You'll Learn

Create an ingest pipeline named log_pipeline with two processors: set and lowercase

The set processor must add a field ingest_timestamp with the current timestamp

The lowercase processor must convert the user field to lowercase

Simulate ingesting a document with user field set to JohnDoe through the pipeline

Print the resulting document after processing

💡 Why This Matters

🌍 Real World

Ingest pipelines help preprocess and enrich data before indexing in Elasticsearch, making search and analysis more effective.

💼 Career

Data engineers and Elasticsearch administrators use ingest pipelines to automate data transformations and improve data quality.

1

Create the ingest pipeline with a set processor

Create an ingest pipeline named log_pipeline with a set processor that adds a field called ingest_timestamp with the value {{_ingest.timestamp}}.

Elasticsearch

# Create the ingest pipeline named log_pipeline with a set processor
# Your code here

Hint

Use the PUT _ingest/pipeline/log_pipeline API to create the pipeline. The set processor adds a field with the current ingest timestamp.

2

Add a lowercase processor to the pipeline

Update the log_pipeline to add a lowercase processor that converts the user field to lowercase. Keep the existing set processor.

Elasticsearch

PUT _ingest/pipeline/log_pipeline
{
  "description": "Add ingest timestamp and lowercase user",
  "processors": [
    {
      "set": {
        "field": "ingest_timestamp",
        "value": "{{_ingest.timestamp}}"
      }
    },
    {
      "lowercase": {
        "field": "user"
      }
    }
  ]
}
# Your code here

Hint

Add a second processor object with "lowercase" and specify the user field.

3

Simulate ingesting a document through the pipeline

Use the _ingest/pipeline/log_pipeline/_simulate API to send a document with "user": "JohnDoe" through the pipeline.

Elasticsearch

POST _ingest/pipeline/log_pipeline/_simulate
{
  "docs": [
    {
      "_source": {
        "user": "JohnDoe"
      }
    }
  ]
}
# Your code here

Hint

Use the _simulate API with a document containing the user field set to JohnDoe.

4

Print the processed document output

Print the output of the simulation showing the document after processing by the pipeline.

Elasticsearch

# Print the processed document output
# Your code here

Hint

Look at the docs array in the response. The user field should be lowercase and ingest_timestamp should be present.

Practice

1. What is the main purpose of an ingest pipeline in Elasticsearch?

easy

A. To create visualizations from data

B. To query documents faster

C. To backup Elasticsearch data

D. To modify documents before they are indexed

Solution

1. Step 1: Understand ingest pipeline role

   An ingest pipeline processes documents before they are stored in Elasticsearch.

2. Step 2: Compare options to pipeline purpose

   Only To modify documents before they are indexed matches this role; others describe unrelated tasks.

3. Final Answer:

   To modify documents before they are indexed -> Option D

4. Quick Check:

   Ingest pipeline = modify before indexing [OK]

Hint: Ingest pipelines change data before saving [OK]

Common Mistakes:

• Confusing pipelines with query optimization
• Thinking pipelines create backups
• Assuming pipelines generate reports

2. Which of the following is the correct way to define a processor that adds a field "source": "web" in an ingest pipeline?

easy

A. "processors": [{"add": {"field": "source", "value": "web"}}]

B. "processors": [{"remove": {"field": "source", "value": "web"}}]

C. "processors": [{"set": {"field": "source", "value": "web"}}]

D. "processors": [{"append": {"field": "source", "value": "web"}}]

Solution

1. Step 1: Identify processor to add or set field

   The set processor assigns or adds a field with a value.

2. Step 2: Check syntax correctness

   "processors": [{"set": {"field": "source", "value": "web"}}] uses set with correct JSON structure; add is not a valid processor name.

3. Final Answer:

   "processors": [{"set": {"field": "source", "value": "web"}}] -> Option C

4. Quick Check:

   Use set to add fields [OK]

Hint: Use 'set' processor to add or update fields [OK]

Common Mistakes:

• Using 'add' instead of 'set' processor
• Confusing 'append' with adding new fields
• Trying to remove field when adding

3. Given this ingest pipeline snippet:

{"processors": [{"rename": {"field": "old_name", "target_field": "new_name"}}]}

What happens to a document {"old_name": "value"} when processed?

medium

A. {"old_name": "value", "new_name": "value"}

B. {"new_name": "value"}

C. {"old_name": null}

D. {"old_name": "value"}

Solution

1. Step 1: Understand rename processor effect

   The rename processor moves the value from old_name to new_name, removing the original field.

2. Step 2: Apply to example document

   Input {"old_name": "value"} becomes {"new_name": "value"} after processing.

3. Final Answer:

   {"new_name": "value"} -> Option B

4. Quick Check:

   Rename moves field, removes old [OK]

Hint: Rename moves field value, deletes old field [OK]

Common Mistakes:

• Thinking rename duplicates field
• Assuming old field remains
• Confusing rename with copy

4. You wrote this pipeline processor:

{"processors": [{"convert": {"field": "age", "type": "integer"}}]}

But when simulating, you get an error. What is the likely cause?

medium

A. The field "age" does not exist in the document

B. The "convert" processor does not exist

C. The "type" value "integer" is invalid

D. The pipeline must have a "description" field

Solution

1. Step 1: Check processor and type validity

   The "convert" processor and type "integer" are valid in Elasticsearch ingest pipelines.

2. Step 2: Identify common error cause

   If the field "age" is missing in the document, conversion fails causing error during simulation.

3. Final Answer:

   The field "age" does not exist in the document -> Option A

4. Quick Check:

   Missing field causes convert error [OK]

Hint: Convert errors if field missing in document [OK]

Common Mistakes:

• Assuming convert processor is invalid
• Thinking 'integer' is wrong type
• Believing description is mandatory

5. You want to create an ingest pipeline that adds a field "status": "new" only if the field "priority" exists. Which processor setup achieves this?

hard

A. "processors": [{"set": {"field": "status", "value": "new", "if": "ctx.priority != null"}}]

B. "processors": [{"set": {"field": "status", "value": "new"}}, {"exists": {"field": "priority"}}]

C. "processors": [{"conditional": {"field": "priority", "processor": {"set": {"field": "status", "value": "new"}}}}]

D. "processors": [{"set": {"field": "status", "value": "new"}, "condition": "priority"}]

Solution

1. Step 1: Understand conditional execution in pipelines

   Processors support an "if" condition using painless scripts to run only when true.

2. Step 2: Identify correct syntax for conditional set

   "processors": [{"set": {"field": "status", "value": "new", "if": "ctx.priority != null"}}] uses "if": "ctx.priority != null" which runs set only if "priority" exists.

3. Final Answer:

   "processors": [{"set": {"field": "status", "value": "new", "if": "ctx.priority != null"}}] -> Option A

4. Quick Check:

   Use "if" with painless script for conditions [OK]

Hint: Use 'if' with painless script to conditionally run processor [OK]

Common Mistakes:

• Using non-existent 'conditional' processor
• Placing condition outside processor block
• Misusing 'exists' as processor