Ingest pipelines in Elasticsearch - Step-by-Step Execution

Concept Flow - Ingest pipelines

Document arrives

↓

Ingest Pipeline starts

↓

Processor 1: Modify or enrich document

↓

Processor 2: Modify or enrich document

↓

... more processors ...

↓

Pipeline ends

↓

Document indexed or error handled

The document flows through a series of processors in the ingest pipeline, each modifying or enriching it before final indexing.

Execution Sample

Elasticsearch

PUT _ingest/pipeline/my_pipeline
{
  "processors": [
    {"set": {"field": "field1", "value": "value1"}},
    {"rename": {"field": "field1", "target_field": "field2"}}
  ]
}

Defines an ingest pipeline that sets a field and then renames it.

Execution Table

Step	Processor	Document State Before	Processor Action	Document State After
1	set	{}	Set field1 to 'value1'	{"field1": "value1"}
2	rename	{"field1": "value1"}	Rename field1 to field2	{"field2": "value1"}
3	end	{"field2": "value1"}	Pipeline ends, document ready for indexing	{"field2": "value1"}

💡 All processors applied; document is ready for indexing.

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
document	{}	{"field1": "value1"}	{"field2": "value1"}	{"field2": "value1"}

Key Moments - 3 Insights

Why does the document state change after each processor?

Each processor modifies the document by adding, changing, or removing fields as shown in the execution_table rows 1 and 2.

What happens if a processor fails?

If a processor fails, the pipeline stops and the document is not indexed; this is why the exit_note confirms all processors succeeded.

Can processors be reordered?

Yes, the order matters because each processor works on the document state left by the previous one, as seen in the step-by-step changes.

Visual Quiz - 3 Questions

Look at the execution_table, what is the document state after Step 1?

A {}

B {"field1": "value1"}

C {"field2": "value1"}

D {"field1": "value2"}

💡 Hint

Check the 'Document State After' column for Step 1 in the execution_table.

At which step does the field get renamed?

A Step 1

B Step 3

C Step 2

D No renaming happens

💡 Hint

Look at the 'Processor' and 'Processor Action' columns in the execution_table.

If the 'set' processor was removed, what would be the document state after Step 2?

A Error because field1 does not exist

B {}

C {"field2": "value1"}

D {"field1": "value1"}

💡 Hint

Consider that the rename processor needs 'field1' to exist before renaming, as shown in the variable_tracker.

Concept Snapshot

Ingest pipelines process documents step-by-step before indexing.
Each processor modifies or enriches the document.
Processors run in order; output of one is input to next.
If any processor fails, indexing stops.
Use pipelines to clean or transform data automatically.

Full Transcript

An ingest pipeline in Elasticsearch takes a document and passes it through a series of processors. Each processor changes the document by adding, renaming, or modifying fields. For example, a 'set' processor adds a field, and a 'rename' processor changes a field's name. The document state updates after each processor. If all processors succeed, the document is indexed. If any processor fails, the pipeline stops and the document is not indexed. The order of processors matters because each depends on the previous state. This process helps prepare data automatically before storing it.