The if
conditional is implemented as a Painless script, which requires
explicit support for regular expressions.
script.painless.regex.enabled: true
must be set in elasticsearch.yml
to use regular
expressions in the if
condition.
If regular expressions are enabled, operators such as =~
can be used against a /pattern/
for conditions.
For example:
PUT _ingest/pipeline/check_url { "processors": [ { "set": { "if": "ctx.href?.url =~ /^http[^s]/", "field": "href.insecure", "value": true } } ] }
POST test/_doc/1?pipeline=check_url { "href": { "url": "http://www.elastic.co/" } }
Results in:
{ "_index": "test", "_type": "_doc", "_id": "1", "_version": 1, "_seq_no": 60, "_primary_term": 1, "found": true, "_source": { "href": { "insecure": true, "url": "http://www.elastic.co/" } } }
Regular expressions can be expensive and should be avoided if viable alternatives exist.
For example in this case startsWith
can be used to get the same result
without using a regular expression:
PUT _ingest/pipeline/check_url { "processors": [ { "set": { "if": "ctx.href?.url != null && ctx.href.url.startsWith('http://')", "field": "href.insecure", "value": true } } ] }