Remove_by_pattern processor

The remove_by_pattern processor removes the root-level fields from a document by using specified wildcard patterns.

Syntax

The following is the syntax for the remove_by_pattern processor:

  1. {
  2.     "remove_by_pattern": {
  3.         "field_pattern": "field_name_prefix*"
  4.     }
  5. }

copy

Configuration parameters

The following table lists the required and optional parameters for the remove_by_pattern processor.

ParameterRequired/OptionalDescription
field_patternOptionalRemoves fields that match the specified pattern. All of the metadata fields, such as _index, _version, _version_type, and _id, are ignored if they match the pattern. This option only supports the root-level fields in the document.
exclude_field_patternOptionalRemoves fields that do not match the specified pattern. All of the metadata fields, such as _index, _version, _version_type, and _id, are ignored if they do not match the pattern. This option only supports the root-level fields in the document. The field_pattern and exclude_field_pattern options are mutually exclusive.
descriptionOptionalA brief description of the processor.
ifOptionalA condition for running the processor.
ignore_failureOptionalSpecifies whether the processor continues execution even if it encounters errors. If set to true, the failure is ignored. Default is false.
on_failureOptionalA list of processors to run if the processor fails.
tagOptionalAn identifier tag for the processor. Useful for debugging in order to distinguish between processors of the same type.

Using the processor

Follow these steps to use the processor in a pipeline.

Step 1: Create a pipeline

The following query creates a pipeline named remove_fields_by_pattern that removes the fields that match the pattern foo*:

  1. PUT /_ingest/pipeline/remove_fields_by_pattern
  2. {
  3.   "description": "Pipeline that removes the fields by patterns.",
  4.   "processors": [
  5.     {
  6.       "remove_by_pattern": {
  7.         "field_pattern": "foo*"
  8.       }
  9.     }
  10.   ]
  11. }

copy

Step 2 (Optional): Test the pipeline

It is recommended that you test your pipeline before you ingest documents.

To test the pipeline, run the following query:

  1. POST _ingest/pipeline/remove_fields_by_pattern/_simulate
  2. {
  3.   "docs": [
  4.     {
  5.       "_index": "testindex1",
  6.       "_id": "1",
  7.       "_source":{
  8.          "foo1": "foo1",
  9.          "foo2": "foo2",
  10.          "bar": "bar"
  11.       }
  12.     }
  13.   ]
  14. }

copy

Response

The following example response confirms that the pipeline is working as expected:

  1. {
  2.   "docs": [
  3.     {
  4.       "doc": {
  5.         "_index": "testindex1",
  6.         "_id": "1",
  7.         "_source": {
  8.           "bar": "bar"
  9.         },
  10.         "_ingest": {
  11.           "timestamp": "2023-08-24T18:02:13.218986756Z"
  12.         }
  13.       }
  14.     }
  15.   ]
  16. }

Step 3: Ingest a document

The following query ingests a document into an index named testindex1:

  1. PUT testindex1/_doc/1?pipeline=remove_fields_by_pattern
  2. {
  3.   "foo1": "foo1",
  4.   "foo2": "foo2",
  5.   "bar": "bar"
  6. }

copy

Step 4 (Optional): Retrieve the document

To retrieve the document, run the following query:

  1. GET testindex1/_doc/1

copy