ingest-pipelines

Elasticsearch ingest pipelines can use branching to route documents through sub-pipelines. This Skill provides authoritative patterns for single-path parsing and branching, ensuring consistent ECS mapping and auditable pipeline design across data streams.

Handling on_failure errors in Elasticsearch ingest pipelines requires robust fallback strategies. This Skill enforces standard error-handling patterns, including on_failure blocks for both CEL and non-CEL contexts, to prevent data loss and ensure observability during parsing failures.

Mapping data to ECS fields when building Elastic integrations requires standardized ingest pipeline patterns. This Skill enforces authoritative rules for parsing and ECS mapping, providing a ready-to-apply design plan including default.yml routing to ensure consistent behavior.

Yes, this ingest pipeline guidance applies to both CEL and non-CEL data processing contexts. It enforces standard rules and references processor-cookbook patterns alongside specific CEL patterns to ensure consistent, auditable pipeline design across different data handling methods.

Sub-pipelines are needed when your Elasticsearch ingest pipeline requires branching to handle diverse document structures. This Skill provides guidelines for both single-path parsing and branching with sub-pipelines, allowing you to route data streams dynamically while maintaining consistent ECS mapping.