Elastic Stack

Elastic Stack (ELK Stack) Ingest API

The ingest API from Elastic Stack (ELK Stack) — 12 operation(s) for ingest.

GitHub OpenAPI

Operations 22

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /_ingest/geoip/database/{id} Get a specific GeoIP database configuration · Get GeoIP database configurations #
Ask an LLM
“How do I see the settings of one GeoIP database configuration by ID?”
“Can I look up several GeoIP database configs with a comma-separated list of IDs?”
Tell an agent
Get GeoIP database configuration {id}.
Show the MaxMind settings for GeoIP config {id}.
PUT /_ingest/geoip/database/{id} Create or update a GeoIP database configuration · Create or update a GeoIP database configuration #
Ask an LLM
“How do I register a MaxMind GeoIP database for the geoip processor to download?”
“Can I replace an existing GeoIP database configuration with a new database name?”
Tell an agent
Create GeoIP database config {id} for database {name} with MaxMind settings {maxmind}.
Update GeoIP configuration {id} to use database {name}.
DELETE /_ingest/geoip/database/{id} Delete a GeoIP database configuration · Delete GeoIP database configurations #
Ask an LLM
“How do I remove a GeoIP database configuration I no longer need?”
“Can I delete multiple GeoIP database configurations in one call?”
Tell an agent destructive · confirm first
Delete GeoIP database configuration {id}.
Remove GeoIP database configs {id} with a master timeout of {master_timeout}.
GET /_ingest/ip_location/database/{id} Get a specific IP location database configuration · Get IP geolocation database configurations #
Ask an LLM
“How do I view one IP location database configuration by its ID?”
“Which provider does a given IP location database config point at?”
Tell an agent
Get IP location database configuration {id}.
Show the ip_location database config named {id}.
PUT /_ingest/ip_location/database/{id} Create or update an IP location database config · Create or update an IP geolocation database configuration #
Ask an LLM
“How do I add an IPinfo or MaxMind database for the ip_location processor?”
“Can I change which database an IP location configuration downloads?”
Tell an agent
Create IP location database config {id} for database {name} from IPinfo {ipinfo}.
Set ip_location configuration {id} to MaxMind database {name} with {maxmind}.
DELETE /_ingest/ip_location/database/{id} Delete an IP location database configuration · Delete IP geolocation database configurations #
Ask an LLM
“How do I remove an IP location database configuration?”
“Can I delete ip_location database configs by listing their IDs?”
Tell an agent destructive · confirm first
Delete IP location database configuration {id}.
Remove the ip_location database configs {id}, waiting up to {timeout}.
GET /_ingest/pipeline/{id} Get a specific ingest pipeline · Get pipelines #
Ask an LLM
“How do I see the processors defined in one ingest pipeline?”
“Can I fetch pipelines matching a wildcard ID in summary form only?”
Tell an agent
Get ingest pipeline {id}.
Show pipelines matching {id} with summary {summary}.
PUT /_ingest/pipeline/{id} Create or update an ingest pipeline · Create or update a pipeline #
Ask an LLM
“How do I create an ingest pipeline that transforms documents before they are indexed?”
“Can I only overwrite a pipeline if it's still at the version I expect?”
Tell an agent
Create ingest pipeline {id} with processors {processors}.
Update pipeline {id} with processors {processors} only if its version is {if_version}.
DELETE /_ingest/pipeline/{id} Delete an ingest pipeline · Delete pipelines #
Ask an LLM
“How do I delete an ingest pipeline I no longer use?”
“Can I remove several pipelines at once with a wildcard?”
Tell an agent destructive · confirm first
Delete ingest pipeline {id}.
Remove all pipelines matching {id}.
GET /_ingest/geoip/stats Get GeoIP database download statistics · Get GeoIP statistics #
Ask an LLM
“Have my GeoIP2 databases downloaded successfully on every node?”
“How many GeoIP database downloads have failed?”
Tell an agent
Show GeoIP download statistics.
Report which nodes have the GeoIP databases cached.
GET /_ingest/geoip/database List all GeoIP database configurations · Get GeoIP database configurations #
Ask an LLM
“Which GeoIP database configurations exist on my cluster?”
“What are all the GeoIP databases the geoip processor is set up to use?”
Tell an agent
List all GeoIP database configurations.
Show every configured geoip database.
GET /_ingest/ip_location/database List all IP location database configurations · Get IP geolocation database configurations #
Ask an LLM
“Which IP location databases are configured in my cluster?”
“What ip_location database configurations have been registered so far?”
Tell an agent
List all IP location database configurations.
Show every ip_location database config.
GET /_ingest/pipeline List all ingest pipelines · Get pipelines #
Ask an LLM
“What ingest pipelines are defined on this cluster?”
“Can I list all pipelines without their full processor definitions?”
Tell an agent
List all ingest pipelines.
Show every pipeline with summary set to {summary}.
GET /_ingest/processor/grok List built-in grok patterns · Run a grok processor #
Ask an LLM
“Which grok patterns are built in for parsing log lines?”
“Where can I see the pattern library the grok processor ships with?”
Tell an agent
List the built-in grok patterns.
Show the grok processor's pattern library.
GET /_ingest/pipeline/_simulate Test an inline pipeline on sample documents · Simulate a pipeline #
Ask an LLM
“How do I try out a pipeline definition on sample docs before saving it?”
“Can I see what each processor did to a document during a simulation?”
Tell an agent
Simulate inline pipeline {pipeline} against documents {docs}.
Dry-run unsaved pipeline {pipeline} on {docs} with verbose per-processor output.
POST /_ingest/pipeline/_simulate Test an inline pipeline on sample docs (POST) · Simulate a pipeline #
Ask an LLM
“Can I POST a draft pipeline and some documents to preview the transformed output?”
“Is there a POST route for pipeline simulation when my client can't send a GET body?”
Tell an agent
POST a pipeline simulation of {pipeline} over sample docs {docs}.
Using POST, preview how definition {pipeline} rewrites {docs}, verbose {verbose}.
GET /_ingest/pipeline/{id}/_simulate Test a saved pipeline on sample documents · Simulate a pipeline #
Ask an LLM
“How do I check what an existing pipeline would do to a document without indexing it?”
“Can I debug a saved pipeline step by step against test data?”
Tell an agent
Simulate saved pipeline {id} against documents {docs}.
Run existing pipeline {id} over {docs} verbosely without indexing.
POST /_ingest/pipeline/{id}/_simulate Test a saved pipeline on sample docs (POST) · Simulate a pipeline #
Ask an LLM
“Can I POST test documents to a stored pipeline's simulate endpoint?”
“Is there a POST form of simulating an existing pipeline by ID?”
Tell an agent
POST documents {docs} to simulate stored pipeline {id}.
Using POST, test pipeline {id} on {docs} with verbose {verbose}.
GET /_ingest/_simulate Simulate full ingestion of documents · Simulate data ingestion #
Ask an LLM
“How do I preview the final indexed form of documents, including default and final pipelines?”
“Can I simulate ingestion with substitute templates or mappings before changing them?”
Tell an agent
Simulate ingesting documents {docs} using pipeline substitutions {pipeline_substitutions}.
Preview ingest of {docs} with index template substitutions {index_template_substitutions}.
POST /_ingest/_simulate Simulate full ingestion of documents (POST) · Simulate data ingestion #
Ask an LLM
“Can I POST documents to the ingest simulator to check mappings and pipelines end to end?”
“Is there a POST form of simulating ingestion with a mapping addition?”
Tell an agent
POST an ingest simulation for {docs} with mapping addition {mapping_addition}.
Using POST, simulate ingesting {docs} through default pipeline {pipeline}.
GET /_ingest/{index}/_simulate Simulate ingesting documents into a given index · Simulate data ingestion #
Ask an LLM
“How do I see what would happen if I indexed these docs into a specific index?”
“Can I test ingest into one index with component template substitutions?”
Tell an agent
Simulate ingesting {docs} into index {index}.
Preview {docs} landing in {index} with component template substitutions {component_template_substitutions}.
POST /_ingest/{index}/_simulate Simulate ingesting into a given index (POST) · Simulate data ingestion #
Ask an LLM
“Can I POST sample docs to one index's ingest simulator to validate mappings?”
“Is there a POST route for index-targeted ingest simulation with a merge type?”
Tell an agent
POST documents {docs} to simulate ingestion into {index}.
Using POST, simulate {docs} into {index} with mapping merge type {merge_type}.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-ingest-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-ingest-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-ingest-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Elk Stack Ingest API
  version: '1.0'
  description: 'Operations tagged ingest across 2 of this provider''s published API definitions: elk-stack-elasticsearch-openapi.json, elk-stack-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: http://localhost:9200
  description: Default local Elasticsearch endpoint
- url: https://{host}:{port}
  description: Self-hosted or Elastic Cloud cluster endpoint
  variables:
    host:
      default: localhost
    port:
      default: '9200'
tags:


# --- truncated at 32 KB (683 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-ingest-api-openapi.yml