-
Notifications
You must be signed in to change notification settings - Fork 25.6k
Description
Describe the feature: Would like the ability to append a processor/pipeline to existing pipelines and have the appended processor/pipeline persist for any new indices that match an index pattern - IOW the appended processors/pipelines would not get ignored when say, filebeat pushes a new daily index. Changing the location of where modules reside may address this, but a pipeline_append endpoint would still be generally useful.
One scenario I'm thinking of is to add additional geoip enrichment to ECS fields found in incoming Beats data streams. Some of the modules already have ingest pipelines (including geoip processors) and I don't want to override that processing by manually setting the index.default_pipeline - I just want to add a few more fields that get geoip enriched (so I can create "pew-pew" maps, of course!).