Elastic Stack (ELK Stack) Ingest API
The ingest API from Elastic Stack (ELK Stack) — 12 operation(s) for ingest.
The ingest API from Elastic Stack (ELK Stack) — 12 operation(s) for ingest.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/elk-stack-ingest-api"
curl "https://apis.io/api/v1/apis?limit=25"
Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Elasticsearch Request & Response Specification Ingest API
license:
name: Apache 2.0
url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE
version: ''
tags:
- name: ingest
paths:
/_ingest/geoip/database/{id}:
get:
tags:
- ingest
summary: Get GeoIP database configurations
description: Get information about one or more IP geolocation database configurations.
operationId: ingest-get-geoip-database-1
parameters:
- $ref: '#/components/parameters/ingest.get_geoip_database-id'
responses:
'200':
$ref: '#/components/responses/ingest.get_geoip_database-200'
x-state: Generally available; Added in 8.15.0
x-metaTags:
- content: Elasticsearch
name: product_name
put:
tags:
- ingest
summary: Create or update a GeoIP database configuration
description: Refer to the create or update IP geolocation database configuration API.
operationId: ingest-put-geoip-database
parameters:
- in: path
name: id
description: ID of the database configuration to create or update.
required: true
deprecated: false
schema:
$ref: '#/components/schemas/_types.Id'
style: simple
- in: query
name: master_timeout
description: 'Period to wait for a connection to the master node.
If no response is received before the timeout expires, the request fails and returns an error.'
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
- in: query
name: timeout
description: Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
requestBody:
content:
application/json:
schema:
type: object
properties:
name:
description: The provider-assigned name of the IP geolocation database to download.
allOf:
- $ref: '#/components/schemas/_types.Name'
maxmind:
description: 'The configuration necessary to identify which IP geolocation provider to use to download the database, as well as any provider-specific configuration necessary for such downloading.
At present, the only supported provider is maxmind, and the maxmind provider requires that an account_id (string) is configured.'
allOf:
- $ref: '#/components/schemas/ingest._types.Maxmind'
required:
- name
- maxmind
required: true
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/_types.AcknowledgedResponseBase'
x-state: Generally available; Added in 8.15.0
x-metaTags:
- content: Elasticsearch
name: product_name
delete:
tags:
- ingest
summary: Delete GeoIP database configurations
description: Delete one or more IP geolocation database configurations.
operationId: ingest-delete-geoip-database
parameters:
- in: path
name: id
description: A comma-separated list of geoip database configurations to delete
required: true
deprecated: false
schema:
$ref: '#/components/schemas/_types.Ids'
style: simple
- in: query
name: master_timeout
description: 'The period to wait for a connection to the master node.
If no response is received before the timeout expires, the request fails and returns an error.'
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
- in: query
name: timeout
description: The period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/_types.AcknowledgedResponseBase'
x-state: Generally available; Added in 8.15.0
x-metaTags:
- content: Elasticsearch
name: product_name
/_ingest/ip_location/database/{id}:
get:
tags:
- ingest
summary: Get IP geolocation database configurations
description: '
## Required authorization
* Cluster privileges: `manage`
'
operationId: ingest-get-ip-location-database-1
parameters:
- $ref: '#/components/parameters/ingest.get_ip_location_database-id'
responses:
'200':
$ref: '#/components/responses/ingest.get_ip_location_database-200'
x-state: Generally available; Added in 8.15.0
x-metaTags:
- content: Elasticsearch
name: product_name
put:
tags:
- ingest
summary: Create or update an IP geolocation database configuration
description: '
## Required authorization
* Cluster privileges: `manage`
'
operationId: ingest-put-ip-location-database
parameters:
- in: path
name: id
description: The database configuration identifier.
required: true
deprecated: false
schema:
$ref: '#/components/schemas/_types.Id'
style: simple
- in: query
name: master_timeout
description: 'The period to wait for a connection to the master node.
If no response is received before the timeout expires, the request fails and returns an error.
A value of `-1` indicates that the request should never time out.'
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
- in: query
name: timeout
description: 'The period to wait for a response from all relevant nodes in the cluster after updating the cluster metadata.
If no response is received before the timeout expires, the cluster metadata update still applies but the response indicates that it was not completely acknowledged.
A value of `-1` indicates that the request should never time out.'
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ingest._types.DatabaseConfiguration'
examples:
IngestPutIpLocationDatabaseExample1:
description: An example body for a `PUT _ingest/ip_location/database/my-database-1` request.
value: "{\n \"name\": \"GeoIP2-Domain\",\n \"maxmind\": {\n \"account_id\": \"1234567\"\n }\n}"
required: true
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/_types.AcknowledgedResponseBase'
x-state: Generally available; Added in 8.15.0
x-metaTags:
- content: Elasticsearch
name: product_name
delete:
tags:
- ingest
summary: Delete IP geolocation database configurations
description: '
## Required authorization
* Cluster privileges: `manage`
'
operationId: ingest-delete-ip-location-database
parameters:
- in: path
name: id
description: A comma-separated list of IP location database configurations.
required: true
deprecated: false
schema:
$ref: '#/components/schemas/_types.Ids'
style: simple
- in: query
name: master_timeout
description: 'The period to wait for a connection to the master node.
If no response is received before the timeout expires, the request fails and returns an error.
A value of `-1` indicates that the request should never time out.'
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
- in: query
name: timeout
description: 'The period to wait for a response.
If no response is received before the timeout expires, the request fails and returns an error.
A value of `-1` indicates that the request should never time out.'
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/_types.AcknowledgedResponseBase'
x-state: Generally available; Added in 8.15.0
x-metaTags:
- content: Elasticsearch
name: product_name
/_ingest/pipeline/{id}:
get:
tags:
- ingest
summary: Get pipelines
description: 'Get information about one or more ingest pipelines.
This API returns a local reference of the pipeline.'
externalDocs:
description: About ingest pipelines
url: https://www.elastic.co/docs/manage-data/ingest/transform-enrich/ingest-pipelines
x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/get-pipeline-api.html
operationId: ingest-get-pipeline-1
parameters:
- $ref: '#/components/parameters/ingest.get_pipeline-id'
- $ref: '#/components/parameters/ingest.get_pipeline-master_timeout'
- $ref: '#/components/parameters/ingest.get_pipeline-summary'
responses:
'200':
$ref: '#/components/responses/ingest.get_pipeline-200'
x-state: Generally available; Added in 5.0.0
x-metaTags:
- content: Elasticsearch
name: product_name
put:
tags:
- ingest
summary: Create or update a pipeline
description: Changes made using this API take effect immediately.
externalDocs:
description: About ingest pipelines
url: https://www.elastic.co/docs/manage-data/ingest/transform-enrich/ingest-pipelines
operationId: ingest-put-pipeline
parameters:
- in: path
name: id
description: ID of the ingest pipeline to create or update.
required: true
deprecated: false
schema:
$ref: '#/components/schemas/_types.Id'
style: simple
- in: query
name: master_timeout
description: Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
- in: query
name: timeout
description: Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
- in: query
name: if_version
description: Required version for optimistic concurrency control for pipeline updates
deprecated: false
schema:
type: number
style: form
requestBody:
content:
application/json:
schema:
type: object
properties:
_meta:
description: Optional metadata about the ingest pipeline. May have any contents. This map is not automatically generated by Elasticsearch.
allOf:
- $ref: '#/components/schemas/_types.Metadata'
description:
description: Description of the ingest pipeline.
type: string
on_failure:
description: Processors to run immediately after a processor failure. Each processor supports a processor-level `on_failure` value. If a processor without an `on_failure` value fails, Elasticsearch uses this pipeline-level parameter as a fallback. The processors in this parameter run sequentially in the order specified. Elasticsearch will not attempt to run the pipeline's remaining processors.
type: array
items:
$ref: '#/components/schemas/ingest._types.ProcessorContainer'
processors:
description: Processors used to perform transformations on documents before indexing. Processors run sequentially in the order specified.
type: array
items:
$ref: '#/components/schemas/ingest._types.ProcessorContainer'
version:
description: Version number used by external systems to track ingest pipelines. This parameter is intended for external systems only. Elasticsearch does not use or validate pipeline version numbers.
allOf:
- $ref: '#/components/schemas/_types.VersionNumber'
deprecated:
description: 'Marks this ingest pipeline as deprecated.
When a deprecated ingest pipeline is referenced as the default or final pipeline when creating or updating a non-deprecated index template, Elasticsearch will emit a deprecation warning.'
default: false
type: boolean
field_access_pattern:
description: Controls how processors in this pipeline should read and write data on a document's source.
default: classic
x-state: Generally available; Added in 9.2.0
allOf:
- $ref: '#/components/schemas/ingest._types.FieldAccessPattern'
examples:
PutPipelineRequestExample1:
summary: Create an ingest pipeline.
value: "{\n \"description\" : \"My optional pipeline description\",\n \"processors\" : [\n {\n \"set\" : {\n \"description\" : \"My optional processor description\",\n \"field\": \"my-keyword-field\",\n \"value\": \"foo\"\n }\n }\n ]\n}"
PutPipelineRequestExample2:
summary: Create an ingest pipeline with metadata.
description: You can use the `_meta` parameter to add arbitrary metadata to a pipeline.
value: "{\n \"description\" : \"My optional pipeline description\",\n \"processors\" : [\n {\n \"set\" : {\n \"description\" : \"My optional processor description\",\n \"field\": \"my-keyword-field\",\n \"value\": \"foo\"\n }\n }\n ],\n \"_meta\": {\n \"reason\": \"set my-keyword-field to foo\",\n \"serialization\": {\n \"class\": \"MyPipeline\",\n \"id\": 10\n }\n }\n}"
required: true
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/_types.AcknowledgedResponseBase'
x-state: Generally available; Added in 5.0.0
x-metaTags:
- content: Elasticsearch
name: product_name
delete:
tags:
- ingest
summary: Delete pipelines
description: Delete one or more ingest pipelines.
externalDocs:
description: About ingest pipelines
url: https://www.elastic.co/docs/manage-data/ingest/transform-enrich/ingest-pipelines
x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/delete-pipeline-api.html
operationId: ingest-delete-pipeline
parameters:
- in: path
name: id
description: 'Pipeline ID or wildcard expression of pipeline IDs used to limit the request.
To delete all ingest pipelines in a cluster, use a value of `*`.'
required: true
deprecated: false
schema:
$ref: '#/components/schemas/_types.Id'
style: simple
- in: query
name: master_timeout
description: 'Period to wait for a connection to the master node.
If no response is received before the timeout expires, the request fails and returns an error.'
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
- in: query
name: timeout
description: 'Period to wait for a response.
If no response is received before the timeout expires, the request fails and returns an error.'
deprecated: false
schema:
default: 30s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
responses:
'200':
description: ''
content:
application/json:
schema:
$ref: '#/components/schemas/_types.AcknowledgedResponseBase'
x-state: Generally available; Added in 5.0.0
x-metaTags:
- content: Elasticsearch
name: product_name
/_ingest/geoip/stats:
get:
tags:
- ingest
summary: Get GeoIP statistics
description: Get download statistics for GeoIP2 databases that are used with the GeoIP processor.
externalDocs:
description: More about the GeoIP processor
url: https://www.elastic.co/docs/reference/enrich-processor/geoip-processor
operationId: ingest-geo-ip-stats
responses:
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
stats:
description: Download statistics for all GeoIP2 databases.
allOf:
- $ref: '#/components/schemas/ingest.geo_ip_stats.GeoIpDownloadStatistics'
nodes:
description: Downloaded GeoIP2 databases for each node.
type: object
additionalProperties:
$ref: '#/components/schemas/ingest.geo_ip_stats.GeoIpNodeDatabases'
required:
- stats
- nodes
x-state: Generally available; Added in 7.13.0
x-metaTags:
- content: Elasticsearch
name: product_name
/_ingest/geoip/database:
get:
tags:
- ingest
summary: Get GeoIP database configurations
description: Get information about one or more IP geolocation database configurations.
operationId: ingest-get-geoip-database
responses:
'200':
$ref: '#/components/responses/ingest.get_geoip_database-200'
x-state: Generally available; Added in 8.15.0
x-metaTags:
- content: Elasticsearch
name: product_name
/_ingest/ip_location/database:
get:
tags:
- ingest
summary: Get IP geolocation database configurations
description: '
## Required authorization
* Cluster privileges: `manage`
'
operationId: ingest-get-ip-location-database
responses:
'200':
$ref: '#/components/responses/ingest.get_ip_location_database-200'
x-state: Generally available; Added in 8.15.0
x-metaTags:
- content: Elasticsearch
name: product_name
/_ingest/pipeline:
get:
tags:
- ingest
summary: Get pipelines
description: 'Get information about one or more ingest pipelines.
This API returns a local reference of the pipeline.'
externalDocs:
description: About ingest pipelines
url: https://www.elastic.co/docs/manage-data/ingest/transform-enrich/ingest-pipelines
x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/get-pipeline-api.html
operationId: ingest-get-pipeline
parameters:
- $ref: '#/components/parameters/ingest.get_pipeline-master_timeout'
- $ref: '#/components/parameters/ingest.get_pipeline-summary'
responses:
'200':
$ref: '#/components/responses/ingest.get_pipeline-200'
x-state: Generally available; Added in 5.0.0
x-metaTags:
- content: Elasticsearch
name: product_name
/_ingest/processor/grok:
get:
tags:
- ingest
summary: Run a grok processor
description: 'Extract structured fields out of a single text field within a document.
You must choose which field to extract matched fields from, as well as the grok pattern you expect will match.
A grok pattern is like a regular expression that supports aliased expressions that can be reused.'
externalDocs:
description: More about the Grok processor
url: https://www.elastic.co/docs/reference/enrich-processor/grok-processor
operationId: ingest-processor-grok
responses:
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
patterns:
type: object
additionalProperties:
type: string
required:
- patterns
x-state: Generally available; Added in 6.1.0
x-metaTags:
- content: Elasticsearch
name: product_name
/_ingest/pipeline/_simulate:
get:
tags:
- ingest
summary: Simulate a pipeline
description: 'Run an ingest pipeline against a set of provided documents.
You can either specify an existing pipeline to use with the provided documents or supply a pipeline definition in the body of the request.
## Required authorization
* Cluster privileges: `read_pipeline`
'
operationId: ingest-simulate
parameters:
- $ref: '#/components/parameters/ingest.simulate-verbose'
requestBody:
$ref: '#/components/requestBodies/ingest.simulate'
responses:
'200':
$ref: '#/components/responses/ingest.simulate-200'
x-state: Generally available; Added in 5.0.0
x-metaTags:
- content: Elasticsearch
name: product_name
post:
tags:
- ingest
summary: Simulate a pipeline
description: 'Run an ingest pipeline against a set of provided documents.
You can either specify an existing pipeline to use with the provided documents or supply a pipeline definition in the body of the request.
## Required authorization
* Cluster privileges: `read_pipeline`
'
operationId: ingest-simulate-1
parameters:
- $ref: '#/components/parameters/ingest.simulate-verbose'
requestBody:
$ref: '#/components/requestBodies/ingest.simulate'
responses:
'200':
$ref: '#/components/responses/ingest.simulate-200'
x-state: Generally available; Added in 5.0.0
x-metaTags:
- content: Elasticsearch
name: product_name
/_ingest/pipeline/{id}/_simulate:
get:
tags:
- ingest
summary: Simulate a pipeline
description: 'Run an ingest pipeline against a set of provided documents.
You can either specify an existing pipeline to use with the provided documents or supply a pipeline definition in the body of the request.
## Required authorization
* Cluster privileges: `read_pipeline`
'
operationId: ingest-simulate-2
parameters:
- $ref: '#/components/parameters/ingest.simulate-id'
- $ref: '#/components/parameters/ingest.simulate-verbose'
requestBody:
$ref: '#/components/requestBodies/ingest.simulate'
responses:
'200':
$ref: '#/components/responses/ingest.simulate-200'
x-state: Generally available; Added in 5.0.0
x-metaTags:
- content: Elasticsearch
name: product_name
post:
tags:
- ingest
summary: Simulate a pipeline
description: 'Run an ingest pipeline against a set of provided documents.
You can either specify an existing pipeline to use with the provided documents or supply a pipeline definition in the body of the request.
## Required authorization
* Cluster privileges: `read_pipeline`
'
operationId: ingest-simulate-3
parameters:
- $ref: '#/components/parameters/ingest.simulate-id'
- $ref: '#/components/parameters/ingest.simulate-verbose'
requestBody:
$ref: '#/components/requestBodies/ingest.simulate'
responses:
'200':
$ref: '#/components/responses/ingest.simulate-200'
x-state: Generally available; Added in 5.0.0
x-metaTags:
- content: Elasticsearch
name: product_name
/_ingest/_simulate:
get:
tags:
- ingest
summary: Simulate data ingestion
description: 'Run ingest pipelines against a set of provided documents, optionally with substitute pipeline definitions, to simulate ingesting data into an index.
This API is meant to be used for troubleshooting or pipeline development, as it does not actually index any data into Elasticsearch.
The API runs the default and final pipeline for that index against a set of documents provided in the body of the request.
If a pipeline contains a reroute processor, it follows that reroute processor to the new index, running that index''s pipelines as well the same way that a non-simulated ingest would.
No data is indexed into Elasticsearch.
Instead, the transformed document is returned, along with the list of pipelines that have been run and the name of the index where the document would have been indexed if this were not a simulation.
The transformed document is validated against the mappings that would apply to this index, and any validation error is reported in the result.
This API differs from the simulate pipeline API in that you specify a single pipeline for that API, and it runs only that one pipeline.
The simulate pipeline API is more useful for developing a single pipeline, while the simulate ingest API is more useful for troubleshooting the interaction of the various pipelines that get applied when ingesting into an index.
By default, the pipeline definitions that are currently in the system are used.
However, you can supply substitute pipeline definitions in the body of the request.
These will be used in place of the pipeline definitions that are already in the system. This can be used to replace existing pipeline definitions or to create new ones. The pipeline substitutions are used only within this request.
## Required authorization
* Index privileges: `index`
'
operationId: simulate-ingest
parameters:
- $ref: '#/components/parameters/simulate.ingest-pipeline'
- $ref: '#/components/parameters/simulate.ingest-merge_type'
requestBody:
$ref: '#/components/requestBodies/simulate.ingest'
responses:
'200':
$ref: '#/components/responses/simulate.ingest-200'
x-state: Experimental; Added in 8.12.0
x-metaTags:
- content: Elasticsearch
name: product_name
post:
tags:
- ingest
summary: Simulate data ingestion
description: 'Run ingest pipelines against a set of provided documents, optionally with substitute pipeline definitions, to simulate ingesting data into an index.
This API is meant to be used for troubleshooting or pipeline development, as it does not actually index any data into Elasticsearch.
The API runs the default and final pipeline for that index against a set of documents provided in the body of the request.
If a pipeline contains a reroute processor, it follows that reroute processor to the new index, running that index''s pipelines as well the same way that a non-simulated ingest would.
No data is indexed into Elasticsearch.
Instead, the transformed document is returned, along with the list of pipelines that have been run and the name of the index where the document would have been indexed if this were not a simulation.
The transformed document is validated against the mappings that would apply to this index, and any validation error is reported in the result.
This API differs from the simulate pipeline API in that you specify a single pipeline for that API, and it runs only that one pipeline.
The simulate pipeline API is more useful for developing a single pipeline, while the simulate ingest API is more useful for troubleshooting the interaction of the various pipelines that get applied when ingesting into an index.
By default, the pipeline definitions that are currently in the system are used.
However, you can supply substitute pipeline definitions in the body of the request.
These will be used in place of the pipeline definitions that are already in the system. This can be used to replace existing pipeline definitions or to create new ones. The pipeline substitutions are used only within this request.
## Required authorization
* Index privileges: `index`
'
operationId: simulate-ingest-1
parameters:
- $ref: '#/components/parameters/simulate.ingest-pipeline'
- $ref: '#/components/parameters/simulate.ingest-merge_type'
requestBody:
$ref: '#/components/requestBodies/simulate.ingest'
responses:
'200':
$ref: '#/components/responses/simulate.ingest-200'
x-state: Experimental; Added in 8.12.0
x-metaTags:
- content: Elasticsearch
name: product_name
/_ingest/{index}/_simulate:
get:
tags:
- ingest
summary: Simulate data ingestion
description: 'Run ingest pipelines against a set of provided documents, optionally with substitute pipeline definitions, to simulate ingesting data into an index.
This API is meant to be used for troubleshooting or pipeline development, as it does not actually index any data into Elasticsearch.
The API runs the default and final pipeline for that index against a set of documents provided in the body of the request.
If a pipeline contains a reroute processor, it follows that reroute processor to the new index, running that index''s pipelines as well the same way that a non-simulated ingest would.
No data is indexed into Elasticsearch.
Instead, the transformed document is returned, along with the list of pipelines that have been run and the name of the index where the document would have been indexed if this were not a simulation.
The transformed document is validated against the mappings that would apply to this index, and any validation error is reported in the result.
This API differs from the simulate pipeline API in that you specify a single pipeline for that API, and it runs only that one pipeline.
The simulate pipeline API is more useful for developing a single pipeline, while the simulate ingest API is more useful for troubleshooting the interaction of the various pipelines that get applied when ingesting into an index.
By default, the pipeline definitions that are currently in the system are used.
However, you can supply substitute pipeline definitions in the body of the request.
These will be used in place of the pipeline definitions that are already in the system. This can be used to replace existing pipeline definitions or to create new ones. The pipeline substitutions are used only within this request.
## Required authorization
# --- truncated at 32 KB (683 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-ingest-api-openapi.yml