Split Processor | Elasticsearch Guide [7.7]

原文地址: https://www.elastic.co/guide/en/elasticsearch/reference/7.7/split-processor.html, 原文档版权归 www.elastic.co 所有

IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

» » »

« Set Security User Processor Sort Processor »

Split Processoredit

Splits a field into an array using a separator character. Only works on string fields.

Table 63. Split Options

Name	Required	Default	Description
`field`	yes	-	The field to split
`separator`	yes	-	A regex which matches the separator, eg `,` or `\s+`
`target_field`	no	`field`	The field to assign the split value to, by default `field` is updated in-place
`ignore_missing`	no	`false`	If `true` and `field` does not exist, the processor quietly exits without modifying the document
`preserve_trailing`	no	`false`	Preserves empty trailing fields, if any.
`if`	no	-	Conditionally execute this processor.
`on_failure`	no	-	Handle failures for this processor. See Handling Failures in Pipelines.
`ignore_failure`	no	`false`	Ignore failures for this processor. See Handling Failures in Pipelines.
`tag`	no	-	An identifier for this processor. Useful for debugging and metrics.

{
  "split": {
    "field": "my_field",
    "separator": "\\s+" 
  }
}

Treat all consecutive whitespace characters as a single separator

If the preserve_trailing option is enabled, any trailing empty fields in the input will be preserved. For example, in the configuration below, a value of A,,B,, in the my_field property will be split into an array of five elements ["A", "", "B", "", ""] with two empty trailing fields. If the preserve_trailing property were not enabled, the two empty trailing fields would be discarded resulting in the three-element array ["A", "", "B"].

{
  "split": {
    "field": "my_field",
    "separator": ",",
    "preserve_trailing": true
  }
}

« Set Security User Processor Sort Processor »