Open jakelandis opened 2 years ago
Pinging @elastic/es-data-management (Team:Data Management)
Pinging @elastic/es-core-infra (Team:Core/Infra)
@jakelandis runtime fields supporting grok in scripts now: https://www.elastic.co/guide/en/elasticsearch/painless/master/painless-runtime-fields.html
Is that something we can easily leverage in the context of processor conditions?
The ability to grok a log message inside an "if" condition could help to make better decisions about which index/data stream to route a document without addinging additional information to the source document. This is likely most useful in combination with Runtime fields and source only indexes.
Runtime fields already supports grok via painless, so this is in large part an effort to expose grok via the ingest node context for use in an "if" or script processor.
related: #73468, #63798