Elastic Stack (ELK Stack) Text Structure API
The text_structure API from Elastic Stack (ELK Stack) — 4 operation(s) for text_structure.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/elk-stack-text-structure-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Elasticsearch Request & Response Specification Text Structure API
license:
name: Apache 2.0
url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE
version: ''
tags:
- name: text_structure
paths:
/_text_structure/find_field_structure:
get:
tags:
- text_structure
summary: Find the structure of a text field
description: 'Find the structure of a text field in an Elasticsearch index.
This API provides a starting point for extracting further information from log messages already ingested into Elasticsearch.
For example, if you have ingested data into a very simple index that has just `@timestamp` and message fields, you can use this API to see what common structure exists in the message field.
The response from the API contains:
* Sample messages.
* Statistics that reveal the most common values for all fields detected within the text and basic numeric statistics for numeric fields.
* Information about the structure of the text, which is useful when you write ingest configurations to index it or similarly formatted text.
* Appropriate mappings for an Elasticsearch index, which you could use to ingest the text.
All this information can be calculated by the structure finder with no guidance.
However, you can optionally override some of the decisions about the text structure by specifying one or more query parameters.
If the structure finder produces unexpected results, specify the `explain` query parameter and an explanation will appear in the response.
It helps determine why the returned structure was chosen.
## Required authorization
* Cluster privileges: `monitor_text_structure`
'
operationId: text-structure-find-field-structure
parameters:
- in: query
name: column_names
description: 'If `format` is set to `delimited`, you can specify the column names in a comma-separated list.
If this parameter is not specified, the structure finder uses the column names from the header row of the text.
If the text does not have a header row, columns are named "column1", "column2", "column3", for example.'
deprecated: false
schema:
oneOf:
- type: string
- type: array
items:
type: string
style: form
- in: query
name: delimiter
description: 'If you have set `format` to `delimited`, you can specify the character used to delimit the values in each row.
Only a single character is supported; the delimiter cannot have multiple characters.
By default, the API considers the following possibilities: comma, tab, semi-colon, and pipe (`|`).
In this default scenario, all rows must have the same number of fields for the delimited format to be detected.
If you specify a delimiter, up to 10% of the rows can have a different number of columns than the first row.'
deprecated: false
schema:
type: string
style: form
- in: query
name: documents_to_sample
description: 'The number of documents to include in the structural analysis.
The minimum value is 2.'
deprecated: false
schema:
default: 1000.0
allOf:
- $ref: '#/components/schemas/_types.uint'
style: form
- in: query
name: ecs_compatibility
description: 'The mode of compatibility with ECS compliant Grok patterns.
Use this parameter to specify whether to use ECS Grok patterns instead of legacy ones when the structure finder creates a Grok pattern.
This setting primarily has an impact when a whole message Grok pattern such as `%{CATALINALOG}` matches the input.
If the structure finder identifies a common structure but has no idea of the meaning then generic field names such as `path`, `ipaddress`, `field1`, and `field2` are used in the `grok_pattern` output.
The intention in that situation is that a user who knows the meanings will rename the fields before using them.'
deprecated: false
schema:
default: disabled
allOf:
- $ref: '#/components/schemas/text_structure._types.EcsCompatibilityType'
style: form
- in: query
name: explain
description: If `true`, the response includes a field named `explanation`, which is an array of strings that indicate how the structure finder produced its result.
deprecated: false
schema:
default: false
type: boolean
style: form
- in: query
name: field
description: The field that should be analyzed.
required: true
deprecated: false
schema:
$ref: '#/components/schemas/_types.Field'
style: form
- in: query
name: format
description: 'The high level structure of the text.
By default, the API chooses the format.
In this default scenario, all rows must have the same number of fields for a delimited format to be detected.
If the format is set to delimited and the delimiter is not set, however, the API tolerates up to 5% of rows that have a different number of columns than the first row.'
deprecated: false
schema:
$ref: '#/components/schemas/text_structure._types.FormatType'
style: form
- in: query
name: grok_pattern
description: 'If the format is `semi_structured_text`, you can specify a Grok pattern that is used to extract fields from every message in the text.
The name of the timestamp field in the Grok pattern must match what is specified in the `timestamp_field` parameter.
If that parameter is not specified, the name of the timestamp field in the Grok pattern must match "timestamp".
If `grok_pattern` is not specified, the structure finder creates a Grok pattern.'
deprecated: false
schema:
$ref: '#/components/schemas/_types.GrokPattern'
style: form
- in: query
name: index
description: The name of the index that contains the analyzed field.
required: true
deprecated: false
schema:
$ref: '#/components/schemas/_types.IndexName'
style: form
- in: query
name: quote
description: 'If the format is `delimited`, you can specify the character used to quote the values in each row if they contain newlines or the delimiter character.
Only a single character is supported.
If this parameter is not specified, the default value is a double quote (`"`).
If your delimited text format does not use quoting, a workaround is to set this argument to a character that does not appear anywhere in the sample.'
deprecated: false
schema:
type: string
style: form
- in: query
name: should_trim_fields
description: 'If the format is `delimited`, you can specify whether values between delimiters should have whitespace trimmed from them.
If this parameter is not specified and the delimiter is pipe (`|`), the default value is true.
Otherwise, the default value is `false`.'
deprecated: false
schema:
type: boolean
style: form
- in: query
name: should_parse_recursively
description: 'If the format is `ndjson`, you can specify whether to parse nested JSON objects recursively.
The nested objects are parsed to a maximum depth equal to the default value of the `index.mapping.depth.limit` setting.
Anything beyond that depth is parsed as an `object` type field.
For formats other than `ndjson`, this parameter is ignored.'
deprecated: false
schema:
default: false
type: boolean
style: form
- in: query
name: timeout
description: 'The maximum amount of time that the structure analysis can take.
If the analysis is still running when the timeout expires, it will be stopped.'
deprecated: false
schema:
default: 25s
allOf:
- $ref: '#/components/schemas/_types.Duration'
style: form
- in: query
name: timestamp_field
description: 'The name of the field that contains the primary timestamp of each record in the text.
In particular, if the text was ingested into an index, this is the field that would be used to populate the `@timestamp` field.
If the format is `semi_structured_text`, this field must match the name of the appropriate extraction in the `grok_pattern`.
Therefore, for semi-structured text, it is best not to specify this parameter unless `grok_pattern` is also specified.
For structured text, if you specify this parameter, the field must exist within the text.
If this parameter is not specified, the structure finder makes a decision about which field (if any) is the primary timestamp field.
For structured text, it is not compulsory to have a timestamp in the text.'
deprecated: false
schema:
$ref: '#/components/schemas/_types.Field'
style: form
- in: query
name: timestamp_format
description: 'The Java time format of the timestamp field in the text.
Only a subset of Java time format letter groups are supported:
* `a`
* `d`
* `dd`
* `EEE`
* `EEEE`
* `H`
* `HH`
* `h`
* `M`
* `MM`
* `MMM`
* `MMMM`
* `mm`
* `ss`
* `XX`
* `XXX`
* `yy`
* `yyyy`
* `zzz`
Additionally `S` letter groups (fractional seconds) of length one to nine are supported providing they occur after `ss` and are separated from the `ss` by a period (`.`), comma (`,`), or colon (`:`).
Spacing and punctuation is also permitted with the exception a question mark (`?`), newline, and carriage return, together with literal text enclosed in single quotes.
For example, `MM/dd HH.mm.ss,SSSSSS ''in'' yyyy` is a valid override format.
One valuable use case for this parameter is when the format is semi-structured text, there are multiple timestamp formats in the text, and you know which format corresponds to the primary timestamp, but you do not want to specify the full `grok_pattern`.
Another is when the timestamp format is one that the structure finder does not consider by default.
If this parameter is not specified, the structure finder chooses the best format from a built-in set.
If the special value `null` is specified, the structure finder will not look for a primary timestamp in the text.
When the format is semi-structured text, this will result in the structure finder treating the text as single-line messages.'
deprecated: false
schema:
type: string
style: form
responses:
'200':
description: ''
content:
application/json:
schema:
type: object
properties:
charset:
type: string
ecs_compatibility:
allOf:
- $ref: '#/components/schemas/text_structure._types.EcsCompatibilityType'
field_stats:
type: object
additionalProperties:
$ref: '#/components/schemas/text_structure._types.FieldStat'
format:
allOf:
- $ref: '#/components/schemas/text_structure._types.FormatType'
grok_pattern:
allOf:
- $ref: '#/components/schemas/_types.GrokPattern'
java_timestamp_formats:
type: array
items:
type: string
joda_timestamp_formats:
type: array
items:
type: string
ingest_pipeline:
allOf:
- $ref: '#/components/schemas/ingest._types.PipelineConfig'
mappings:
allOf:
- $ref: '#/components/schemas/_types.mapping.TypeMapping'
multiline_start_pattern:
type: string
need_client_timezone:
type: boolean
num_lines_analyzed:
type: number
num_messages_analyzed:
type: number
sample_start:
type: string
timestamp_field:
allOf:
- $ref: '#/components/schemas/_types.Field'
required:
- charset
- field_stats
- format
- ingest_pipeline
- mappings
- need_client_timezone
- num_lines_analyzed
- num_messages_analyzed
- sample_start
examples:
FindFieldStructureResponseExample1:
description: A successful response from `GET _text_structure/find_field_structure?index=test-logs&field=message`.
value: "{\n \"num_lines_analyzed\" : 22,\n \"num_messages_analyzed\" : 22,\n \"sample_start\" : \"[2024-03-05T10:52:36,256][INFO ][o.a.l.u.VectorUtilPanamaProvider] [laptop] Java vector incubator API enabled; uses preferredBitSize=128\\n[2024-03-05T10:52:41,038][INFO ][o.e.p.PluginsService ] [laptop] loaded module [repository-url]\\n\",\n \"charset\" : \"UTF-8\",\n \"format\" : \"semi_structured_text\",\n \"multiline_start_pattern\" : \"^\\\\[\\\\b\\\\d{4}-\\\\d{2}-\\\\d{2}[T ]\\\\d{2}:\\\\d{2}\",\n \"grok_pattern\" : \"\\\\[%{TIMESTAMP_ISO8601:timestamp}\\\\]\\\\[%{LOGLEVEL:loglevel} \\\\]\\\\[.*\",\n \"ecs_compatibility\" : \"disabled\",\n \"timestamp_field\" : \"timestamp\",\n \"joda_timestamp_formats\" : [\n \"ISO8601\"\n ],\n \"java_timestamp_formats\" : [\n \"ISO8601\"\n ],\n \"need_client_timezone\" : true,\n \"mappings\" : {\n \"properties\" : {\n \"@timestamp\" : {\n \"type\" : \"date\"\n },\n \"loglevel\" : {\n \"type\" : \"keyword\"\n },\n \"message\" : {\n \"type\" : \"text\"\n }\n }\n },\n \"ingest_pipeline\" : {\n \"description\" : \"Ingest pipeline created by text structure finder\",\n \"processors\" : [\n {\n \"grok\" : {\n \"field\" : \"message\",\n \"patterns\" : [\n \"\\\\[%{TIMESTAMP_ISO8601:timestamp}\\\\]\\\\[%{LOGLEVEL:loglevel} \\\\]\\\\[.*\"\n ],\n \"ecs_compatibility\" : \"disabled\"\n }\n },\n {\n \"date\" : {\n \"field\" : \"timestamp\",\n \"timezone\" : \"{{ event.timezone }}\",\n \"formats\" : [\n \"ISO8601\"\n ]\n }\n },\n {\n \"remove\" : {\n \"field\" : \"timestamp\"\n }\n }\n ]\n },\n \"field_stats\" : {\n \"loglevel\" : {\n \"count\" : 22,\n \"cardinality\" : 1,\n \"top_hits\" : [\n {\n \"value\" : \"INFO\",\n \"count\" : 22\n }\n ]\n },\n \"message\" : {\n \"count\" : 22,\n \"cardinality\" : 22,\n \"top_hits\" : [\n {\n \"value\" : \"[2024-03-05T10:52:36,256][INFO ][o.a.l.u.VectorUtilPanamaProvider] [laptop] Java vector incubator API enabled; uses preferredBitSize=128\",\n \"count\" : 1\n },\n {\n \"value\" : \"[2024-03-05T10:52:41,038][INFO ][o.e.p.PluginsService ] [laptop] loaded module [repository-url]\",\n \"count\" : 1\n },\n {\n \"value\" : \"[2024-03-05T10:52:41,042][INFO ][o.e.p.PluginsService ] [laptop] loaded module [rest-root]\",\n \"count\" : 1\n },\n {\n \"value\" : \"[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService ] [laptop] loaded module [ingest-user-agent]\",\n \"count\" : 1\n },\n {\n \"value\" : \"[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService ] [laptop] loaded module [x-pack-core]\",\n \"count\" : 1\n },\n {\n \"value\" : \"[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService ] [laptop] loaded module [x-pack-redact]\",\n \"count\" : 1\n },\n {\n \"value\" : \"[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService ] [laptop] loaded module [lang-painless]]\",\n \"count\" : 1\n },\n {\n \"value\" : \"[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService ] [laptop] loaded module [repository-s3]\",\n \"count\" : 1\n },\n {\n \"value\" : \"[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService ] [laptop] loaded module [x-pack-analytics]\",\n \"count\" : 1\n },\n {\n \"value\" : \"[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService ] [laptop] loaded module [x-pack-autoscaling]\",\n \"count\" : 1\n }\n ]\n },\n \"timestamp\" : {\n \"count\" : 22,\n \"cardinality\" : 14,\n \"earliest\" : \"2024-03-05T10:52:36,256\",\n \"latest\" : \"2024-03-05T10:52:49,199\",\n \"top_hits\" : [\n {\n \"value\" : \"2024-03-05T10:52:41,044\",\n \"count\" : 6\n },\n {\n \"value\" : \"2024-03-05T10:52:41,043\",\n \"count\" : 3\n },\n {\n \"value\" : \"2024-03-05T10:52:41,059\",\n \"count\" : 2\n },\n {\n \"value\" : \"2024-03-05T10:52:36,256\",\n \"count\" : 1\n },\n {\n \"value\" : \"2024-03-05T10:52:41,038\",\n \"count\" : 1\n },\n {\n \"value\" : \"2024-03-05T10:52:41,042\",\n \"count\" : 1\n },\n {\n \"value\" : \"2024-03-05T10:52:43,291\",\n \"count\" : 1\n },\n {\n \"value\" : \"2024-03-05T10:52:46,098\",\n \"count\" : 1\n },\n {\n \"value\" : \"2024-03-05T10:52:47,227\",\n \"count\" : 1\n },\n {\n \"value\" : \"2024-03-05T10:52:47,259\",\n \"count\" : 1\n }\n ]\n }\n }\n}"
x-state: Generally available
x-metaTags:
- content: Elasticsearch
name: product_name
/_text_structure/find_message_structure:
get:
tags:
- text_structure
summary: Find the structure of text messages
description: 'Find the structure of a list of text messages.
The messages must contain data that is suitable to be ingested into Elasticsearch.
This API provides a starting point for ingesting data into Elasticsearch in a format that is suitable for subsequent use with other Elastic Stack functionality.
Use this API rather than the find text structure API if your input text has already been split up into separate messages by some other process.
The response from the API contains:
* Sample messages.
* Statistics that reveal the most common values for all fields detected within the text and basic numeric statistics for numeric fields.
* Information about the structure of the text, which is useful when you write ingest configurations to index it or similarly formatted text.
Appropriate mappings for an Elasticsearch index, which you could use to ingest the text.
All this information can be calculated by the structure finder with no guidance.
However, you can optionally override some of the decisions about the text structure by specifying one or more query parameters.
If the structure finder produces unexpected results, specify the `explain` query parameter and an explanation will appear in the response.
It helps determine why the returned structure was chosen.
## Required authorization
* Cluster privileges: `monitor_text_structure`
'
operationId: text-structure-find-message-structure
parameters:
- $ref: '#/components/parameters/text_structure.find_message_structure-column_names'
- $ref: '#/components/parameters/text_structure.find_message_structure-delimiter'
- $ref: '#/components/parameters/text_structure.find_message_structure-ecs_compatibility'
- $ref: '#/components/parameters/text_structure.find_message_structure-explain'
- $ref: '#/components/parameters/text_structure.find_message_structure-format'
- $ref: '#/components/parameters/text_structure.find_message_structure-grok_pattern'
- $ref: '#/components/parameters/text_structure.find_message_structure-quote'
- $ref: '#/components/parameters/text_structure.find_message_structure-should_trim_fields'
- $ref: '#/components/parameters/text_structure.find_message_structure-should_parse_recursively'
- $ref: '#/components/parameters/text_structure.find_message_structure-timeout'
- $ref: '#/components/parameters/text_structure.find_message_structure-timestamp_field'
- $ref: '#/components/parameters/text_structure.find_message_structure-timestamp_format'
requestBody:
$ref: '#/components/requestBodies/text_structure.find_message_structure'
responses:
'200':
$ref: '#/components/responses/text_structure.find_message_structure-200'
x-state: Generally available
x-metaTags:
- content: Elasticsearch
name: product_name
post:
tags:
- text_structure
summary: Find the structure of text messages
description: 'Find the structure of a list of text messages.
The messages must contain data that is suitable to be ingested into Elasticsearch.
This API provides a starting point for ingesting data into Elasticsearch in a format that is suitable for subsequent use with other Elastic Stack functionality.
Use this API rather than the find text structure API if your input text has already been split up into separate messages by some other process.
The response from the API contains:
* Sample messages.
* Statistics that reveal the most common values for all fields detected within the text and basic numeric statistics for numeric fields.
* Information about the structure of the text, which is useful when you write ingest configurations to index it or similarly formatted text.
Appropriate mappings for an Elasticsearch index, which you could use to ingest the text.
All this information can be calculated by the structure finder with no guidance.
However, you can optionally override some of the decisions about the text structure by specifying one or more query parameters.
If the structure finder produces unexpected results, specify the `explain` query parameter and an explanation will appear in the response.
It helps determine why the returned structure was chosen.
## Required authorization
* Cluster privileges: `monitor_text_structure`
'
operationId: text-structure-find-message-structure-1
parameters:
- $ref: '#/components/parameters/text_structure.find_message_structure-column_names'
- $ref: '#/components/parameters/text_structure.find_message_structure-delimiter'
- $ref: '#/components/parameters/text_structure.find_message_structure-ecs_compatibility'
- $ref: '#/components/parameters/text_structure.find_message_structure-explain'
- $ref: '#/components/parameters/text_structure.find_message_structure-format'
- $ref: '#/components/parameters/text_structure.find_message_structure-grok_pattern'
- $ref: '#/components/parameters/text_structure.find_message_structure-quote'
- $ref: '#/components/parameters/text_structure.find_message_structure-should_trim_fields'
- $ref: '#/components/parameters/text_structure.find_message_structure-should_parse_recursively'
- $ref: '#/components/parameters/text_structure.find_message_structure-timeout'
- $ref: '#/components/parameters/text_structure.find_message_structure-timestamp_field'
- $ref: '#/components/parameters/text_structure.find_message_structure-timestamp_format'
requestBody:
$ref: '#/components/requestBodies/text_structure.find_message_structure'
responses:
'200':
$ref: '#/components/responses/text_structure.find_message_structure-200'
x-state: Generally available
x-metaTags:
- content: Elasticsearch
name: product_name
/_text_structure/find_structure:
post:
tags:
- text_structure
summary: Find the structure of a text file
description: 'The text file must contain data that is suitable to be ingested into Elasticsearch.
This API provides a starting point for ingesting data into Elasticsearch in a format that is suitable for subsequent use with other Elastic Stack functionality.
Unlike other Elasticsearch endpoints, the data that is posted to this endpoint does not need to be UTF-8 encoded and in JSON format.
It must, however, be text; binary text formats are not currently supported.
The size is limited to the Elasticsearch HTTP receive buffer size, which defaults to 100 Mb.
The response from the API contains:
* A couple of messages from the beginning of the text.
* Statistics that reveal the most common values for all fields detected within the text and basic numeric statistics for numeric fields.
* Information about the structure of the text, which is useful when you write ingest configurations to index it or similarly formatted text.
* Appropriate mappings for an Elasticsearch index, which you could use to ingest the text.
All this information can be calculated by the structure finder with no guidance.
However, you can optionally override some of the decisions about the text structure by specifying one or more query parameters.
## Required authorization
* Cluster privileges: `monitor_text_structure`
'
externalDocs:
description: About finding text structure API
url: https://www.elastic.co/docs/reference/elasticsearch/rest-apis/find-text-structure-examples
x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/find-structure.html
operationId: text-structure-find-structure
parameters:
- in: query
name: charset
description: 'The text''s character set.
It must be a character set that is supported by the JVM that Elasticsearch uses.
For example, `UTF-8`, `UTF-16LE`, `windows-1252`, or `EUC-JP`.
If this parameter is not specified, the structure finder chooses an appropriate character set.'
deprecated: false
schema:
type: string
style: form
- in: query
name: column_names
description: 'If you have set format to `delimited`, you can specify the column names in a comma-separated list.
If this parameter is not specified, the structure finder uses the column names from the header row of the text.
If the text does not have a header role, columns are named "column1", "column2", "column3", for example.'
deprecated: false
schema:
oneOf:
- type: string
- type: array
items:
type: string
style: form
- in: query
name: delimiter
description: 'If you have set `format` to `delimited`, you can specify the character used to delimit the values in each row.
Only a single character is supported; the delimiter cannot have multiple characters.
By default, the API considers the following possibilities: comma, tab, semi-colon, and pipe (`|`).
In this default scenario, all rows must have the same number of fields for the delimited format to be detected.
If you specify a delimiter, up to 10% of the rows can have a different number of columns than the first row.'
deprecated: false
schema:
type: string
style: form
- in: query
name: ecs_compatibility
description: 'The mode of compatibility with ECS compliant Grok patterns.
Use this parameter to specify whether to use ECS Grok patterns instead of legacy ones when the structure finder creates a Grok pattern.
Valid values are `disabled` and `v1`.
This setting primarily has an impact when a whole message Grok pattern such as `%{CATALINALOG}` matches the input.
If the structure finder identifies a common structure but has no idea of meaning then generic field names such as `path`, `ipaddress`, `field1`, and `field2` are used in the `grok_pattern` output, with the intention that a user who knows the meanings rename these fields before using it.'
deprecated: false
schema:
default: disabled
type: string
style: form
- in: query
name: explain
description: 'If this parameter is set to `true`, the response includes a field named explanation, which is an array of strings that indicate how the structure finder produced its result.
If the structure finder produces unexpected results for some text, use this query parameter to help you determine why the returned structure was chosen.'
deprecated: false
schema:
default: false
type: boolean
style: form
- in: query
name: format
description: 'The high level structure of the text.
Valid values are `ndjson`, `xml`, `delimited`, and `semi_structured_text`.
By default, the API chooses the format.
In this default scenario, all rows must have the same number of fields for a delimited format to be detected.
If the format is set to `delimited` and the delimiter is not set, however, the API tolerates up to 5% of rows that have a different number of columns than the first row.'
deprecated: false
schema:
$ref: '#/components/schemas/text_structure.find_structure.FindStructureFormat'
style: form
- in: query
name: grok_pattern
description: 'If you have set `format` to `semi_structured_text`, you can specify a Grok pattern that is used to extract fields from every message in the text.
The name of the timestamp field in the Grok pattern must match what is specified in the `timestamp_field` parameter.
If that parameter is not specified, the name of the timestamp field in the Grok pattern must match "timestamp".
If `grok_pattern` is not specified, the structure finder creates a Grok pattern.'
deprecated: false
schema:
$ref: '#/components/schemas/_types.GrokPattern'
style: form
- in: query
name: has_header_row
description: 'If you have set `format` to `delimited`, you can use this parameter to indicate whether the column names are in the first row of the text.
If this parameter is not specified, the structure finder guesses based on the similarity of the first row of the text to other rows.'
deprecated: false
schema:
type: boolean
style: form
- in: query
name: line_merge_size_limit
description: 'The maximum number of characters in a message when lines are merged to form messages while analyzing semi-structured text.
If you have extremely long messages you may need to increase this, but be aware that this may lead to very long processing times if the way to group lines into messages is misdetected.'
deprecated: false
schema:
default: 10000.0
allOf:
- $ref: '#/components/schemas/_types.uint'
style: form
- in: query
name: lines_to_sample
descript
# --- truncated at 32 KB (535 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-text-structure-api-openapi.yml