Skip to content

[Ingest Pipeline] Ability to split documents #56769

@m-adams

Description

@m-adams

It is common for tools to output data in a combined format where one document may contain several entities.
For example, a tool that scans several hosts for compliance or vulnerabilities or an API that provides an update to every train/bus etc.
We really want to split all entities out to separate docs while copying some high-level information.
This is possible using Logstash and the Split filter but not possible with Ingest Pipelines.

The feature would allow this kind of document to be processed and split without having to include Logstash in the ingest chain.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions