The if conditional is implemented as a Painless script, which requires explicit support for regular expressions.

script.painless.regex.enabled: true must be set in elasticsearch.yml to use regular expressions in the if condition.

If regular expressions are enabled, operators such as =~ can be used against a /pattern/ for conditions.

For example:

PUT _ingest/pipeline/check_url
{
  "processors": [
    {
      "set": {
        "if": "ctx.href?.url =~ /^http[^s]/",
        "field": "href.insecure",
        "value": true
      }
    }
  ]
}

POST test/_doc/1?pipeline=check_url
{
  "href": {
    "url": "http://www.elastic.co/"
  }
}

Results in:

{
  "_index": "test",
  "_type": "_doc",
  "_id": "1",
  "_version": 1,
  "_seq_no": 60,
  "_primary_term": 1,
  "found": true,
  "_source": {
    "href": {
      "insecure": true,
      "url": "http://www.elastic.co/"
    }
  }
}

Regular expressions can be expensive and should be avoided if viable alternatives exist.

For example in this case startsWith can be used to get the same result without using a regular expression:

PUT _ingest/pipeline/check_url
{
  "processors": [
    {
      "set": {
        "if": "ctx.href?.url != null && ctx.href.url.startsWith('http://')",
        "field": "href.insecure",
        "value": true
      }
    }
  ]
}