Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Elasticstack Provider
  3. API Docs
  4. getElasticsearchIngestProcessorDissect
elasticstack 0.11.14 published on Monday, Apr 14, 2025 by elastic
elastic/terraform-provider-elasticstack

elasticstack.getElasticsearchIngestProcessorDissect

Explore with Pulumi AI

elasticstack logo
elasticstack 0.11.14 published on Monday, Apr 14, 2025 by elastic
elastic/terraform-provider-elasticstack

    Similar to the Grok Processor, dissect also extracts structured fields out of a single text field within a document. However unlike the Grok Processor, dissect does not use Regular Expressions. This allows dissect’s syntax to be simple and for some cases faster than the Grok Processor.

    Dissect matches a single text field against a defined pattern.

    See: https://www.elastic.co/guide/en/elasticsearch/reference/current/dissect-processor.html

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as elasticstack from "@pulumi/elasticstack";

const dissect = elasticstack.getElasticsearchIngestProcessorDissect({
    field: "message",
    pattern: "%{clientip} %{ident} %{auth} [%{@timestamp}] \"%{verb} %{request} HTTP/%{httpversion}\" %{status} %{size}",
});
const myIngestPipeline = new elasticstack.ElasticsearchIngestPipeline("myIngestPipeline", {processors: [dissect.then(dissect => dissect.json)]});

    import pulumi
import pulumi_elasticstack as elasticstack

dissect = elasticstack.get_elasticsearch_ingest_processor_dissect(field="message",
    pattern="%{clientip} %{ident} %{auth} [%{@timestamp}] \"%{verb} %{request} HTTP/%{httpversion}\" %{status} %{size}")
my_ingest_pipeline = elasticstack.ElasticsearchIngestPipeline("myIngestPipeline", processors=[dissect.json])

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/elasticstack/elasticstack"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		dissect, err := elasticstack.GetElasticsearchIngestProcessorDissect(ctx, &elasticstack.GetElasticsearchIngestProcessorDissectArgs{
			Field:   "message",
			Pattern: "%{clientip} %{ident} %{auth} [%{@timestamp}] \"%{verb} %{request} HTTP/%{httpversion}\" %{status} %{size}",
		}, nil)
		if err != nil {
			return err
		}
		_, err = elasticstack.NewElasticsearchIngestPipeline(ctx, "myIngestPipeline", &elasticstack.ElasticsearchIngestPipelineArgs{
			Processors: pulumi.StringArray{
				pulumi.String(dissect.Json),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Elasticstack = Pulumi.Elasticstack;

return await Deployment.RunAsync(() => 
{
    var dissect = Elasticstack.GetElasticsearchIngestProcessorDissect.Invoke(new()
    {
        Field = "message",
        Pattern = "%{clientip} %{ident} %{auth} [%{@timestamp}] \"%{verb} %{request} HTTP/%{httpversion}\" %{status} %{size}",
    });

    var myIngestPipeline = new Elasticstack.ElasticsearchIngestPipeline("myIngestPipeline", new()
    {
        Processors = new[]
        {
            dissect.Apply(getElasticsearchIngestProcessorDissectResult => getElasticsearchIngestProcessorDissectResult.Json),
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.elasticstack.ElasticstackFunctions;
import com.pulumi.elasticstack.inputs.GetElasticsearchIngestProcessorDissectArgs;
import com.pulumi.elasticstack.ElasticsearchIngestPipeline;
import com.pulumi.elasticstack.ElasticsearchIngestPipelineArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var dissect = ElasticstackFunctions.getElasticsearchIngestProcessorDissect(GetElasticsearchIngestProcessorDissectArgs.builder()
            .field("message")
            .pattern("%{clientip} %{ident} %{auth} [%{@timestamp}] \"%{verb} %{request} HTTP/%{httpversion}\" %{status} %{size}")
            .build());

        var myIngestPipeline = new ElasticsearchIngestPipeline("myIngestPipeline", ElasticsearchIngestPipelineArgs.builder()
            .processors(dissect.applyValue(getElasticsearchIngestProcessorDissectResult -> getElasticsearchIngestProcessorDissectResult.json()))
            .build());

    }
}

    resources:
  myIngestPipeline:
    type: elasticstack:ElasticsearchIngestPipeline
    properties:
      processors:
        - ${dissect.json}
variables:
  dissect:
    fn::invoke:
      function: elasticstack:getElasticsearchIngestProcessorDissect
      arguments:
        field: message
        pattern: '%{clientip} %{ident} %{auth} [%{@timestamp}] "%{verb} %{request} HTTP/%{httpversion}" %{status} %{size}'

    Using getElasticsearchIngestProcessorDissect

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getElasticsearchIngestProcessorDissect(args: GetElasticsearchIngestProcessorDissectArgs, opts?: InvokeOptions): Promise<GetElasticsearchIngestProcessorDissectResult>
function getElasticsearchIngestProcessorDissectOutput(args: GetElasticsearchIngestProcessorDissectOutputArgs, opts?: InvokeOptions): Output<GetElasticsearchIngestProcessorDissectResult>
    def get_elasticsearch_ingest_processor_dissect(append_separator: Optional[str] = None,
                                               description: Optional[str] = None,
                                               field: Optional[str] = None,
                                               if_: Optional[str] = None,
                                               ignore_failure: Optional[bool] = None,
                                               ignore_missing: Optional[bool] = None,
                                               on_failures: Optional[Sequence[str]] = None,
                                               pattern: Optional[str] = None,
                                               tag: Optional[str] = None,
                                               opts: Optional[InvokeOptions] = None) -> GetElasticsearchIngestProcessorDissectResult
def get_elasticsearch_ingest_processor_dissect_output(append_separator: Optional[pulumi.Input[str]] = None,
                                               description: Optional[pulumi.Input[str]] = None,
                                               field: Optional[pulumi.Input[str]] = None,
                                               if_: Optional[pulumi.Input[str]] = None,
                                               ignore_failure: Optional[pulumi.Input[bool]] = None,
                                               ignore_missing: Optional[pulumi.Input[bool]] = None,
                                               on_failures: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
                                               pattern: Optional[pulumi.Input[str]] = None,
                                               tag: Optional[pulumi.Input[str]] = None,
                                               opts: Optional[InvokeOptions] = None) -> Output[GetElasticsearchIngestProcessorDissectResult]
    func GetElasticsearchIngestProcessorDissect(ctx *Context, args *GetElasticsearchIngestProcessorDissectArgs, opts ...InvokeOption) (*GetElasticsearchIngestProcessorDissectResult, error)
func GetElasticsearchIngestProcessorDissectOutput(ctx *Context, args *GetElasticsearchIngestProcessorDissectOutputArgs, opts ...InvokeOption) GetElasticsearchIngestProcessorDissectResultOutput

    > Note: This function is named GetElasticsearchIngestProcessorDissect in the Go SDK.

    public static class GetElasticsearchIngestProcessorDissect 
{
    public static Task<GetElasticsearchIngestProcessorDissectResult> InvokeAsync(GetElasticsearchIngestProcessorDissectArgs args, InvokeOptions? opts = null)
    public static Output<GetElasticsearchIngestProcessorDissectResult> Invoke(GetElasticsearchIngestProcessorDissectInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetElasticsearchIngestProcessorDissectResult> getElasticsearchIngestProcessorDissect(GetElasticsearchIngestProcessorDissectArgs args, InvokeOptions options)
public static Output<GetElasticsearchIngestProcessorDissectResult> getElasticsearchIngestProcessorDissect(GetElasticsearchIngestProcessorDissectArgs args, InvokeOptions options)

    fn::invoke:
  function: elasticstack:index/getElasticsearchIngestProcessorDissect:getElasticsearchIngestProcessorDissect
  arguments:
    # arguments dictionary

    The following arguments are supported:

    Field string
    The field to dissect.
    Pattern string
    The pattern to apply to the field.
    AppendSeparator string
    The character(s) that separate the appended fields.
    Description string
    Description of the processor.
    If string
    Conditionally execute the processor
    IgnoreFailure bool
    Ignore failures for the processor.
    IgnoreMissing bool
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    OnFailures List<string>
    Handle failures for the processor.
    Tag string
    Identifier for the processor.
    Field string
    The field to dissect.
    Pattern string
    The pattern to apply to the field.
    AppendSeparator string
    The character(s) that separate the appended fields.
    Description string
    Description of the processor.
    If string
    Conditionally execute the processor
    IgnoreFailure bool
    Ignore failures for the processor.
    IgnoreMissing bool
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    OnFailures []string
    Handle failures for the processor.
    Tag string
    Identifier for the processor.
    field String
    The field to dissect.
    pattern String
    The pattern to apply to the field.
    appendSeparator String
    The character(s) that separate the appended fields.
    description String
    Description of the processor.
    if_ String
    Conditionally execute the processor
    ignoreFailure Boolean
    Ignore failures for the processor.
    ignoreMissing Boolean
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    onFailures List<String>
    Handle failures for the processor.
    tag String
    Identifier for the processor.
    field string
    The field to dissect.
    pattern string
    The pattern to apply to the field.
    appendSeparator string
    The character(s) that separate the appended fields.
    description string
    Description of the processor.
    if string
    Conditionally execute the processor
    ignoreFailure boolean
    Ignore failures for the processor.
    ignoreMissing boolean
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    onFailures string[]
    Handle failures for the processor.
    tag string
    Identifier for the processor.
    field str
    The field to dissect.
    pattern str
    The pattern to apply to the field.
    append_separator str
    The character(s) that separate the appended fields.
    description str
    Description of the processor.
    if_ str
    Conditionally execute the processor
    ignore_failure bool
    Ignore failures for the processor.
    ignore_missing bool
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    on_failures Sequence[str]
    Handle failures for the processor.
    tag str
    Identifier for the processor.
    field String
    The field to dissect.
    pattern String
    The pattern to apply to the field.
    appendSeparator String
    The character(s) that separate the appended fields.
    description String
    Description of the processor.
    if String
    Conditionally execute the processor
    ignoreFailure Boolean
    Ignore failures for the processor.
    ignoreMissing Boolean
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    onFailures List<String>
    Handle failures for the processor.
    tag String
    Identifier for the processor.

    getElasticsearchIngestProcessorDissect Result

    The following output properties are available:

    Field string
    The field to dissect.
    Id string
    Internal identifier of the resource
    Json string
    JSON representation of this data source.
    Pattern string
    The pattern to apply to the field.
    AppendSeparator string
    The character(s) that separate the appended fields.
    Description string
    Description of the processor.
    If string
    Conditionally execute the processor
    IgnoreFailure bool
    Ignore failures for the processor.
    IgnoreMissing bool
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    OnFailures List<string>
    Handle failures for the processor.
    Tag string
    Identifier for the processor.
    Field string
    The field to dissect.
    Id string
    Internal identifier of the resource
    Json string
    JSON representation of this data source.
    Pattern string
    The pattern to apply to the field.
    AppendSeparator string
    The character(s) that separate the appended fields.
    Description string
    Description of the processor.
    If string
    Conditionally execute the processor
    IgnoreFailure bool
    Ignore failures for the processor.
    IgnoreMissing bool
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    OnFailures []string
    Handle failures for the processor.
    Tag string
    Identifier for the processor.
    field String
    The field to dissect.
    id String
    Internal identifier of the resource
    json String
    JSON representation of this data source.
    pattern String
    The pattern to apply to the field.
    appendSeparator String
    The character(s) that separate the appended fields.
    description String
    Description of the processor.
    if_ String
    Conditionally execute the processor
    ignoreFailure Boolean
    Ignore failures for the processor.
    ignoreMissing Boolean
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    onFailures List<String>
    Handle failures for the processor.
    tag String
    Identifier for the processor.
    field string
    The field to dissect.
    id string
    Internal identifier of the resource
    json string
    JSON representation of this data source.
    pattern string
    The pattern to apply to the field.
    appendSeparator string
    The character(s) that separate the appended fields.
    description string
    Description of the processor.
    if string
    Conditionally execute the processor
    ignoreFailure boolean
    Ignore failures for the processor.
    ignoreMissing boolean
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    onFailures string[]
    Handle failures for the processor.
    tag string
    Identifier for the processor.
    field str
    The field to dissect.
    id str
    Internal identifier of the resource
    json str
    JSON representation of this data source.
    pattern str
    The pattern to apply to the field.
    append_separator str
    The character(s) that separate the appended fields.
    description str
    Description of the processor.
    if_ str
    Conditionally execute the processor
    ignore_failure bool
    Ignore failures for the processor.
    ignore_missing bool
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    on_failures Sequence[str]
    Handle failures for the processor.
    tag str
    Identifier for the processor.
    field String
    The field to dissect.
    id String
    Internal identifier of the resource
    json String
    JSON representation of this data source.
    pattern String
    The pattern to apply to the field.
    appendSeparator String
    The character(s) that separate the appended fields.
    description String
    Description of the processor.
    if String
    Conditionally execute the processor
    ignoreFailure Boolean
    Ignore failures for the processor.
    ignoreMissing Boolean
    If true and field does not exist or is null, the processor quietly exits without modifying the document.
    onFailures List<String>
    Handle failures for the processor.
    tag String
    Identifier for the processor.

    Package Details

    Repository
    elasticstack elastic/terraform-provider-elasticstack
    License
    Notes
    This Pulumi package is based on the elasticstack Terraform Provider.
    elasticstack logo
    elasticstack 0.11.14 published on Monday, Apr 14, 2025 by elastic
    elastic/terraform-provider-elasticstack