Find the structure of text messages

GET /_text_structure/find_message_structure

Find the structure of a list of text messages. The messages must contain data that is suitable to be ingested into Elasticsearch.

This API provides a starting point for ingesting data into Elasticsearch in a format that is suitable for subsequent use with other Elastic Stack functionality. Use this API rather than the find text structure API if your input text has already been split up into separate messages by some other process.

The response from the API contains:

Sample messages.
Statistics that reveal the most common values for all fields detected within the text and basic numeric statistics for numeric fields.
Information about the structure of the text, which is useful when you write ingest configurations to index it or similarly formatted text. Appropriate mappings for an Elasticsearch index, which you could use to ingest the text.

All this information can be calculated by the structure finder with no guidance. However, you can optionally override some of the decisions about the text structure by specifying one or more query parameters.

If the structure finder produces unexpected results, specify the explain query parameter and an explanation will appear in the response. It helps determine why the returned structure was chosen.

Query parameters

column_namesstring
If the format is delimited, you can specify the column names in a comma-separated list. If this parameter is not specified, the structure finder uses the column names from the header row of the text. If the text does not have a header role, columns are named "column1", "column2", "column3", for example.
delimiterstring
If you the format is delimited, you can specify the character used to delimit the values in each row. Only a single character is supported; the delimiter cannot have multiple characters. By default, the API considers the following possibilities: comma, tab, semi-colon, and pipe (|). In this default scenario, all rows must have the same number of fields for the delimited format to be detected. If you specify a delimiter, up to 10% of the rows can have a different number of columns than the first row.
ecs_compatibilitystring
The mode of compatibility with ECS compliant Grok patterns. Use this parameter to specify whether to use ECS Grok patterns instead of legacy ones when the structure finder creates a Grok pattern. This setting primarily has an impact when a whole message Grok pattern such as %{CATALINALOG} matches the input. If the structure finder identifies a common structure but has no idea of meaning then generic field names such as path, ipaddress, field1, and field2 are used in the grok_pattern output, with the intention that a user who knows the meanings rename these fields before using it.
Values are disabled or v1.
explainboolean
If this parameter is set to true, the response includes a field named explanation, which is an array of strings that indicate how the structure finder produced its result.
formatstring
The high level structure of the text. By default, the API chooses the format. In this default scenario, all rows must have the same number of fields for a delimited format to be detected. If the format is delimited and the delimiter is not set, however, the API tolerates up to 5% of rows that have a different number of columns than the first row.
Values are delimited, ndjson, semi_structured_text, or xml.
grok_patternstring
If the format is semi_structured_text, you can specify a Grok pattern that is used to extract fields from every message in the text. The name of the timestamp field in the Grok pattern must match what is specified in the timestamp_field parameter. If that parameter is not specified, the name of the timestamp field in the Grok pattern must match "timestamp". If grok_pattern is not specified, the structure finder creates a Grok pattern.
quotestring
If the format is delimited, you can specify the character used to quote the values in each row if they contain newlines or the delimiter character. Only a single character is supported. If this parameter is not specified, the default value is a double quote ("). If your delimited text format does not use quoting, a workaround is to set this argument to a character that does not appear anywhere in the sample.
should_trim_fieldsboolean
If the format is delimited, you can specify whether values between delimiters should have whitespace trimmed from them. If this parameter is not specified and the delimiter is pipe (|), the default value is true. Otherwise, the default value is false.
timeoutstring
The maximum amount of time that the structure analysis can take. If the analysis is still running when the timeout expires, it will be stopped.
timestamp_fieldstring
The name of the field that contains the primary timestamp of each record in the text. In particular, if the text was ingested into an index, this is the field that would be used to populate the @timestamp field.
If the format is semi_structured_text, this field must match the name of the appropriate extraction in the grok_pattern. Therefore, for semi-structured text, it is best not to specify this parameter unless grok_pattern is also specified.
For structured text, if you specify this parameter, the field must exist within the text.
If this parameter is not specified, the structure finder makes a decision about which field (if any) is the primary timestamp field. For structured text, it is not compulsory to have a timestamp in the text.
timestamp_formatstring
The Java time format of the timestamp field in the text. Only a subset of Java time format letter groups are supported:
- a
- d
- dd
- EEE
- EEEE
- H
- HH
- h
- M
- MM
- MMM
- MMMM
- mm
- ss
- XX
- XXX
- yy
- yyyy
- zzz
Additionally S letter groups (fractional seconds) of length one to nine are supported providing they occur after ss and are separated from the ss by a period (.), comma (,), or colon (:). Spacing and punctuation is also permitted with the exception a question mark (?), newline, and carriage return, together with literal text enclosed in single quotes. For example, MM/dd HH.mm.ss,SSSSSS 'in' yyyy is a valid override format.
One valuable use case for this parameter is when the format is semi-structured text, there are multiple timestamp formats in the text, and you know which format corresponds to the primary timestamp, but you do not want to specify the full grok_pattern. Another is when the timestamp format is one that the structure finder does not consider by default.
If this parameter is not specified, the structure finder chooses the best format from a built-in set.
If the special value null is specified, the structure finder will not look for a primary timestamp in the text. When the format is semi-structured text, this will result in the structure finder treating the text as single-line messages.

application/json

BodyRequired

messagesarray[string] Required
The list of messages you want to analyze.

Responses

200 application/json
Hide response attributes Show response attributes object
- charsetstring Required
- ecs_compatibilitystring
  Values are disabled or v1.
- field_statsobject Required
  Hide field_stats attribute Show field_stats attribute object
  *object Additional properties
  Hide * attributes Show * attributes object
  countnumber Required
  cardinalitynumber Required
  top_hitsarray[object] Required
  Hide top_hits attributes Show top_hits attributes object
  countnumber Required
  valueobject Required
  mean_valuenumber
  median_valuenumber
  max_valuenumber
  min_valuenumber
  earlieststring
  lateststring
- formatstring Required
  Values are delimited, ndjson, semi_structured_text, or xml.
- grok_patternstring
- java_timestamp_formatsarray[string]
- joda_timestamp_formatsarray[string]
- ingest_pipelineobject Required
  Hide ingest_pipeline attributes Show ingest_pipeline attributes object
  descriptionstring
  Description of the ingest pipeline.
  versionnumber
  processorsarray[object] Required
  Processors used to perform transformations on documents before indexing. Processors run sequentially in the order specified.
  Hide processors attributes Show processors attributes object
  appendobject
  Hide append attributes Show append attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  value
  allow_duplicatesboolean
  If false, the processor does not append values already present in the field.
  attachmentobject
  Hide attachment attributes Show attachment attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  indexed_charsnumber
  The number of chars being used for extraction to prevent huge fields. Use -1 for no limit.
  indexed_chars_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Array of properties to select to be stored. Can be content, title, name, author, keywords, date, content_type, content_length, language.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  remove_binaryboolean
  If true, the binary field will be removed from the document
  resource_namestring
  Field containing the name of the resource to decode. If specified, the processor passes this resource name to the underlying Tika library to enable Resource Name Based Detection.
  bytesobject
  Hide bytes attributes Show bytes attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  circleobject
  Hide circle attributes Show circle attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  error_distancenumber Required
  The difference between the resulting inscribed distance from center to side and the circle’s radius (measured in meters for geo_shape, unit-less for shape).
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  shape_typestring Required
  Values are geo_shape or shape.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  community_idobject
  Hide community_id attributes Show community_id attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  source_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  source_portstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_portstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  iana_numberstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  icmp_typestring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  icmp_codestring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  transportstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  seednumber
  Seed for the community ID hash. Must be between 0 and 65535 (inclusive). The seed can prevent hash collisions between network domains, such as a staging and production network that use the same addressing scheme.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  convertobject
  Hide convert attributes Show convert attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  typestring Required
  Values are integer, long, double, float, boolean, ip, string, or auto.
  csvobject
  Hide csv attributes Show csv attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  empty_valueobject
  Value used to fill empty fields. Empty fields are skipped if this is not provided. An empty field is one with no value (2 consecutive separators) or empty quotes ("").
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  quotestring
  Quote used in CSV, has to be single character string.
  separatorstring
  Separator used in CSV, has to be single character string.
  target_fieldsstring | array[string] Required
  trimboolean
  Trim whitespaces in unquoted fields.
  dateobject
  Hide date attributes Show date attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  formatsarray[string] Required
  An array of the expected date formats. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  localestring
  The locale to use when parsing the date, relevant when parsing month names or week days. Supports template snippets.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  timezonestring
  The timezone to use when parsing the date. Supports template snippets.
  output_formatstring
  The format to use when writing the date to target_field. Must be a valid java time pattern.
  date_index_nameobject
  Hide date_index_name attributes Show date_index_name attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  date_formatsarray[string]
  An array of the expected date formats for parsing dates / timestamps in the document being preprocessed. Can be a java time pattern or one of the following formats: ISO8601, UNIX, UNIX_MS, or TAI64N.
  date_roundingstring Required
  How to round the date when formatting the date into the index name. Valid values are: y (year), M (month), w (week), d (day), h (hour), m (minute) and s (second). Supports template snippets.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  index_name_formatstring
  The format to be used when printing the parsed date into the index name. A valid java time pattern is expected here. Supports template snippets.
  index_name_prefixstring
  A prefix of the index name to be prepended before the printed date. Supports template snippets.
  localestring
  The locale to use when parsing the date from the document being preprocessed, relevant when parsing month names or week days.
  timezonestring
  The timezone to use when parsing the date and when date math index supports resolves expressions into concrete index names.
  dissectobject
  Hide dissect attributes Show dissect attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  append_separatorstring
  The character(s) that separate the appended fields.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  patternstring Required
  The pattern to apply to the field.
  dot_expanderobject
  Hide dot_expander attributes Show dot_expander attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  overrideboolean
  Controls the behavior when there is already an existing nested object that conflicts with the expanded field. When false, the processor will merge conflicts by combining the old and the new values into an array. When true, the value from the expanded field will overwrite the existing value.
  pathstring
  The field that contains the field to expand. Only required if the field to expand is part another object field, because the field option can only understand leaf fields.
  dropobject
  Hide drop attributes Show drop attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  enrichobject
  Hide enrich attributes Show enrich attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  max_matchesnumber
  The maximum number of matched documents to include under the configured target field. The target_field will be turned into a json array if max_matches is higher than 1, otherwise target_field will become a json object. In order to avoid documents getting too large, the maximum allowed value is 128.
  overrideboolean
  If processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
  policy_namestring Required
  The name of the enrich policy to use.
  shape_relationstring
  Values are intersects, disjoint, within, or contains.
  target_fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  failobject
  Hide fail attributes Show fail attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  messagestring Required
  The error message thrown by the processor. Supports template snippets.
  fingerprintobject
  Hide fingerprint attributes Show fingerprint attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldsstring | array[string] Required
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  saltstring
  Salt value for the hash function.
  methodstring
  Values are MD5, SHA-1, SHA-256, SHA-512, or MurmurHash3.
  ignore_missingboolean
  If true, the processor ignores any missing fields. If all fields are missing, the processor silently exits without modifying the document.
  foreachobject
  Hide foreach attributes Show foreach attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true, the processor silently exits without changing the document if the field is null or missing.
  processorobject Required
  ip_locationobject
  Hide ip_location attributes Show ip_location attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  database_filestring
  The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  first_onlyboolean
  If true, only the first found IP location data will be returned, even if the field contains an array.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  propertiesarray[string]
  Controls what properties are added to the target_field based on the IP location lookup.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  download_database_on_pipeline_creationboolean
  If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
  geo_gridobject
  Hide geo_grid attributes Show geo_grid attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  The field to interpret as a geo-tile.= The field format is determined by the tile_type.
  tile_typestring Required
  Values are geotile, geohex, or geohash.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  parent_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  children_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  non_children_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  precision_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_formatstring
  Values are geojson or wkt.
  geoipobject
  Hide geoip attributes Show geoip attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  database_filestring
  The database filename referring to a database the module ships with (GeoLite2-City.mmdb, GeoLite2-Country.mmdb, or GeoLite2-ASN.mmdb) or a custom database in the ingest-geoip config directory.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  first_onlyboolean
  If true, only the first found geoip data will be returned, even if the field contains an array.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  propertiesarray[string]
  Controls what properties are added to the target_field based on the geoip lookup.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  download_database_on_pipeline_creationboolean
  If true (and if ingest.geoip.downloader.eager.download is false), the missing database is downloaded when the pipeline is created. Else, the download is triggered by when the pipeline is used as the default_pipeline or final_pipeline in an index.
  grokobject
  Hide grok attributes Show grok attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  ecs_compatibilitystring
  Must be disabled or v1. If v1, the processor uses patterns with Elastic Common Schema (ECS) field names.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  pattern_definitionsobject
  A map of pattern-name and pattern tuples defining custom patterns to be used by the current processor. Patterns matching existing names will override the pre-existing definition.
  patternsarray[string] Required
  An ordered list of grok expression to match and extract named captures with. Returns on the first expression in the list that matches.
  trace_matchboolean
  When true, _ingest._grok_match_index will be inserted into your matched document’s metadata with the index into the pattern found in patterns that matched.
  gsubobject
  Hide gsub attributes Show gsub attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  patternstring Required
  The pattern to be replaced.
  replacementstring Required
  The string to replace the matching patterns with.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  html_stripobject
  Hide html_strip attributes Show html_strip attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document,
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  inferenceobject
  Hide inference attributes Show inference attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  model_idstring Required
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  field_mapobject
  Maps the document field names to the known field names of the model. This mapping takes precedence over any default mappings provided in the model configuration.
  inference_configobject
  input_output
  ignore_missingboolean
  If true and any of the input fields defined in input_ouput are missing then those missing fields are quietly ignored, otherwise a missing field causes a failure. Only applies when using input_output configurations to explicitly list the input fields.
  joinobject
  Hide join attributes Show join attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  separatorstring Required
  The separator character.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  jsonobject
  Hide json attributes Show json attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  add_to_rootboolean
  Flag that forces the parsed JSON to be added at the top level of the document. target_field must not be set when this option is chosen.
  add_to_root_conflict_strategystring
  Values are replace or merge.
  allow_duplicate_keysboolean
  When set to true, the JSON parser will not fail if the JSON contains duplicate keys. Instead, the last encountered value for any duplicate key wins.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  kvobject
  Hide kv attributes Show kv attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  exclude_keysarray[string]
  List of keys to exclude from document.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  field_splitstring Required
  Regex pattern to use for splitting key-value pairs.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  include_keysarray[string]
  List of keys to filter and insert into document. Defaults to including all keys.
  prefixstring
  Prefix to be added to extracted keys.
  strip_bracketsboolean
  If true. strip brackets (), <>, [] as well as quotes ' and " from extracted values.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  trim_keystring
  String of characters to trim from extracted keys.
  trim_valuestring
  String of characters to trim from extracted values.
  value_splitstring Required
  Regex pattern to use for splitting the key from the value within a key-value pair.
  lowercaseobject
  Hide lowercase attributes Show lowercase attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  network_directionobject
  Hide network_direction attributes Show network_direction attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  source_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  destination_ipstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  internal_networksarray[string]
  List of internal networks. Supports IPv4 and IPv6 addresses and ranges in CIDR notation. Also supports the named ranges listed below. These may be constructed with template snippets. Must specify only one of internal_networks or internal_networks_field.
  internal_networks_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  pipelineobject
  Hide pipeline attributes Show pipeline attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  namestring Required
  ignore_missing_pipelineboolean
  Whether to ignore missing pipelines instead of failing.
  redactobject
  Hide redact attributes Show redact attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  patternsarray[string] Required
  A list of grok expressions to match and redact named captures with
  pattern_definitionsobject
  prefixstring
  Start a redacted section with this token
  suffixstring
  End a redacted section with this token
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  skip_if_unlicensedboolean
  If true and the current license does not support running redact processors, then the processor quietly exits without modifying the document
  trace_redactboolean
  If true then ingest metadata _ingest._redact._is_redacted is set to true if the document has been redacted
  registered_domainobject
  Hide registered_domain attributes Show registered_domain attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and any required fields are missing, the processor quietly exits without modifying the document.
  removeobject
  Hide remove attributes Show remove attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring | array[string] Required
  keepstring | array[string]
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  renameobject
  Hide rename attributes Show rename attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  rerouteobject
  Hide reroute attributes Show reroute attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  destinationstring
  A static value for the target. Can’t be set when the dataset or namespace option is set.
  dataset
  namespace
  scriptobject
  Hide script attributes Show script attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  idstring
  lang
  paramsobject
  Object containing parameters for the script.
  source
  setobject
  Hide set attributes Show set attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  copy_fromstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_empty_valueboolean
  If true and value is a template snippet that evaluates to null or the empty string, the processor quietly exits without modifying the document.
  media_typestring
  The media type for encoding value. Applies only when value is a template snippet. Must be one of application/json, text/plain, or application/x-www-form-urlencoded.
  overrideboolean
  If true processor will update fields with pre-existing non-null-valued field. When set to false, such fields will not be touched.
  valueobject
  The value to be set for the field. Supports template snippets. May specify only one of value or copy_from.
  set_security_userobject
  Hide set_security_user attributes Show set_security_user attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Controls what user related properties are added to the field.
  sortobject
  Hide sort attributes Show sort attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  orderstring
  Values are asc or desc.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  splitobject
  Hide split attributes Show split attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  preserve_trailingboolean
  Preserves empty trailing fields, if any.
  separatorstring Required
  A regex which matches the separator, for example, , or \s+.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  terminateobject
  Hide terminate attributes Show terminate attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  trimobject
  Hide trim attributes Show trim attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  uppercaseobject
  Hide uppercase attributes Show uppercase attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  urldecodeobject
  Hide urldecode attributes Show urldecode attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist or is null, the processor quietly exits without modifying the document.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  uri_partsobject
  Hide uri_parts attributes Show uri_parts attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  keep_originalboolean
  If true, the processor copies the unparsed URI to <target_field>.original.
  remove_if_successfulboolean
  If true, the processor removes the field after parsing the URI string. If parsing fails, the processor does not remove the field.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  user_agentobject
  Hide user_agent attributes Show user_agent attributes object
  descriptionstring
  Description of the processor. Useful for describing the purpose of the processor or its configuration.
  ifobject
  ignore_failureboolean
  Ignore failures for the processor.
  on_failurearray[object]
  Handle failures for the processor.
  tagstring
  Identifier for the processor. Useful for debugging and metrics.
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  ignore_missingboolean
  If true and field does not exist, the processor quietly exits without modifying the document.
  regex_filestring
  The name of the file in the config/ingest-user-agent directory containing the regular expressions for parsing the user agent string. Both the directory and the file have to be created before starting Elasticsearch. If not specified, ingest-user-agent will use the regexes.yaml from uap-core it ships with.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  propertiesarray[string]
  Controls what properties are added to target_field.
  Values are name, os, device, original, or version.
  extract_device_typeboolean Beta
  Extracts device type from the user agent string on a best-effort basis.
- mappingsobject Required
  Hide mappings attributes Show mappings attributes object
  all_fieldobject
  Hide all_field attributes Show all_field attributes object
  analyzerstring Required
  enabledboolean Required
  omit_normsboolean Required
  search_analyzerstring Required
  similaritystring Required
  storeboolean Required
  store_term_vector_offsetsboolean Required
  store_term_vector_payloadsboolean Required
  store_term_vector_positionsboolean Required
  store_term_vectorsboolean Required
  date_detectionboolean
  dynamicstring
  Values are strict, runtime, true, or false.
  dynamic_date_formatsarray[string]
  dynamic_templatesarray[object]
  _field_namesobject
  Hide _field_names attribute Show _field_names attribute object
  enabledboolean Required
  index_fieldobject
  Hide index_field attribute Show index_field attribute object
  enabledboolean Required
  _metaobject
  Hide _meta attribute Show _meta attribute object
  *object Additional properties
  numeric_detectionboolean
  propertiesobject
  _routingobject
  Hide _routing attribute Show _routing attribute object
  requiredboolean Required
  _sizeobject
  Hide _size attribute Show _size attribute object
  enabledboolean Required
  _sourceobject
  Hide _source attributes Show _source attributes object
  compressboolean
  compress_thresholdstring
  enabledboolean
  excludesarray[string]
  includesarray[string]
  modestring
  Values are disabled, stored, or synthetic.
  runtimeobject
  Hide runtime attribute Show runtime attribute object
  *object Additional properties
  Hide * attributes Show * attributes object
  fieldsobject
  For type composite
  Hide fields attribute Show fields attribute object
  *object Additional properties
  Hide * attribute Show * attribute object
  typestring Required
  Values are boolean, composite, date, double, geo_point, geo_shape, ip, keyword, long, or lookup.
  fetch_fieldsarray[object]
  For type lookup
  Hide fetch_fields attributes Show fetch_fields attributes object
  fieldstring Required
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  formatstring
  formatstring
  A custom format for date type runtime fields.
  input_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.
  target_indexstring
  scriptobject
  Hide script attributes Show script attributes object
  sourcestring | object
  One of:
  ScriptSourcestring SearchRequestBodyobject
  idstring
  paramsobject
  Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.
  Hide params attribute Show params attribute object
  *object Additional properties
  langstring
  Any of:
  ScriptLanguagestring ScriptLanguagestring
  Values are painless, expression, mustache, or java.
  optionsobject
  Hide options attribute Show options attribute object
  *string Additional properties
  typestring Required
  Values are boolean, composite, date, double, geo_point, geo_shape, ip, keyword, long, or lookup.
  enabledboolean
  subobjectsstring
  Values are true or false.
  _data_stream_timestampobject
  Hide _data_stream_timestamp attribute Show _data_stream_timestamp attribute object
  enabledboolean Required
- multiline_start_patternstring
- need_client_timezoneboolean Required
- num_lines_analyzednumber Required
- num_messages_analyzednumber Required
- sample_startstring Required
- timestamp_fieldstring
  Path to field or array of paths. Some API's support wildcards in the path to select multiple fields.

GET /_text_structure/find_message_structure

curl \
 --request GET 'http://api.example.com/_text_structure/find_message_structure' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '"{\n  \"messages\": [\n    \"[2024-03-05T10:52:36,256][INFO ][o.a.l.u.VectorUtilPanamaProvider] [laptop] Java vector incubator API enabled; uses preferredBitSize=128\",\n    \"[2024-03-05T10:52:41,038][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [repository-url]\",\n    \"[2024-03-05T10:52:41,042][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [rest-root]\",\n    \"[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-core]\",\n    \"[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-redact]\",\n    \"[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [ingest-user-agent]\",\n    \"[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-monitoring]\",\n    \"[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [repository-s3]\",\n    \"[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-analytics]\",\n    \"[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-ent-search]\",\n    \"[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-autoscaling]\",\n    \"[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [lang-painless]]\",\n    \"[2024-03-05T10:52:41,059][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [lang-expression]\",\n    \"[2024-03-05T10:52:41,059][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-eql]\",\n    \"[2024-03-05T10:52:43,291][INFO ][o.e.e.NodeEnvironment    ] [laptop] heap size [16gb], compressed ordinary object pointers [true]\",\n    \"[2024-03-05T10:52:46,098][INFO ][o.e.x.s.Security         ] [laptop] Security is enabled\",\n    \"[2024-03-05T10:52:47,227][INFO ][o.e.x.p.ProfilingPlugin  ] [laptop] Profiling is enabled\",\n    \"[2024-03-05T10:52:47,259][INFO ][o.e.x.p.ProfilingPlugin  ] [laptop] profiling index templates will not be installed or reinstalled\",\n    \"[2024-03-05T10:52:47,755][INFO ][o.e.i.r.RecoverySettings ] [laptop] using rate limit [40mb] with [default=40mb, read=0b, write=0b, max=0b]\",\n    \"[2024-03-05T10:52:47,787][INFO ][o.e.d.DiscoveryModule    ] [laptop] using discovery type [multi-node] and seed hosts providers [settings]\",\n    \"[2024-03-05T10:52:49,188][INFO ][o.e.n.Node               ] [laptop] initialized\",\n    \"[2024-03-05T10:52:49,199][INFO ][o.e.n.Node               ] [laptop] starting ...\"\n  ]\n}"'

Request example

Run `POST _text_structure/find_message_structure` to analyze Elasticsearch log files.

{
  "messages": [
    "[2024-03-05T10:52:36,256][INFO ][o.a.l.u.VectorUtilPanamaProvider] [laptop] Java vector incubator API enabled; uses preferredBitSize=128",
    "[2024-03-05T10:52:41,038][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [repository-url]",
    "[2024-03-05T10:52:41,042][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [rest-root]",
    "[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-core]",
    "[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-redact]",
    "[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [ingest-user-agent]",
    "[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-monitoring]",
    "[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [repository-s3]",
    "[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-analytics]",
    "[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-ent-search]",
    "[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-autoscaling]",
    "[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [lang-painless]]",
    "[2024-03-05T10:52:41,059][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [lang-expression]",
    "[2024-03-05T10:52:41,059][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-eql]",
    "[2024-03-05T10:52:43,291][INFO ][o.e.e.NodeEnvironment    ] [laptop] heap size [16gb], compressed ordinary object pointers [true]",
    "[2024-03-05T10:52:46,098][INFO ][o.e.x.s.Security         ] [laptop] Security is enabled",
    "[2024-03-05T10:52:47,227][INFO ][o.e.x.p.ProfilingPlugin  ] [laptop] Profiling is enabled",
    "[2024-03-05T10:52:47,259][INFO ][o.e.x.p.ProfilingPlugin  ] [laptop] profiling index templates will not be installed or reinstalled",
    "[2024-03-05T10:52:47,755][INFO ][o.e.i.r.RecoverySettings ] [laptop] using rate limit [40mb] with [default=40mb, read=0b, write=0b, max=0b]",
    "[2024-03-05T10:52:47,787][INFO ][o.e.d.DiscoveryModule    ] [laptop] using discovery type [multi-node] and seed hosts providers [settings]",
    "[2024-03-05T10:52:49,188][INFO ][o.e.n.Node               ] [laptop] initialized",
    "[2024-03-05T10:52:49,199][INFO ][o.e.n.Node               ] [laptop] starting ..."
  ]
}

Response examples (200)

A successful response from `POST _text_structure/find_message_structure`.

{
  "num_lines_analyzed" : 22,
  "num_messages_analyzed" : 22,
  "sample_start" : "[2024-03-05T10:52:36,256][INFO ][o.a.l.u.VectorUtilPanamaProvider] [laptop] Java vector incubator API enabled; uses preferredBitSize=128\n[2024-03-05T10:52:41,038][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [repository-url]\n",
  "charset" : "UTF-8",
  "format" : "semi_structured_text",
  "multiline_start_pattern" : "^\\[\\b\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}",
  "grok_pattern" : "\\[%{TIMESTAMP_ISO8601:timestamp}\\]\\[%{LOGLEVEL:loglevel} \\]\\[.*",
  "ecs_compatibility" : "disabled",
  "timestamp_field" : "timestamp",
  "joda_timestamp_formats" : [
    "ISO8601"
  ],
  "java_timestamp_formats" : [
    "ISO8601"
  ],
  "need_client_timezone" : true,
  "mappings" : {
    "properties" : {
      "@timestamp" : {
        "type" : "date"
      },
      "loglevel" : {
        "type" : "keyword"
      },
      "message" : {
        "type" : "text"
      }
    }
  },
  "ingest_pipeline" : {
    "description" : "Ingest pipeline created by text structure finder",
    "processors" : [
      {
        "grok" : {
          "field" : "message",
          "patterns" : [
            "\\[%{TIMESTAMP_ISO8601:timestamp}\\]\\[%{LOGLEVEL:loglevel} \\]\\[.*"
          ],
          "ecs_compatibility" : "disabled"
        }
      },
      {
        "date" : {
          "field" : "timestamp",
          "timezone" : "{{ event.timezone }}",
          "formats" : [
            "ISO8601"
          ]
        }
      },
      {
        "remove" : {
          "field" : "timestamp"
        }
      }
    ]
  },
  "field_stats" : {
    "loglevel" : {
      "count" : 22,
      "cardinality" : 1,
      "top_hits" : [
        {
          "value" : "INFO",
          "count" : 22
        }
      ]
    },
    "message" : {
      "count" : 22,
      "cardinality" : 22,
      "top_hits" : [
        {
          "value" : "[2024-03-05T10:52:36,256][INFO ][o.a.l.u.VectorUtilPanamaProvider] [laptop] Java vector incubator API enabled; uses preferredBitSize=128",
          "count" : 1
        },
        {
          "value" : "[2024-03-05T10:52:41,038][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [repository-url]",
          "count" : 1
        },
        {
          "value" : "[2024-03-05T10:52:41,042][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [rest-root]",
          "count" : 1
        },
        {
          "value" : "[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [ingest-user-agent]",
          "count" : 1
        },
        {
          "value" : "[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-core]",
          "count" : 1
        },
        {
          "value" : "[2024-03-05T10:52:41,043][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-redact]",
          "count" : 1
        },
        {
          "value" : "[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [lang-painless]]",
          "count" : 1
        },
        {
          "value" : "[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [repository-s3]",
          "count" : 1
        },
        {
          "value" : "[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-analytics]",
          "count" : 1
        },
        {
          "value" : "[2024-03-05T10:52:41,044][INFO ][o.e.p.PluginsService     ] [laptop] loaded module [x-pack-autoscaling]",
          "count" : 1
        }
      ]
    },
    "timestamp" : {
      "count" : 22,
      "cardinality" : 14,
      "earliest" : "2024-03-05T10:52:36,256",
      "latest" : "2024-03-05T10:52:49,199",
      "top_hits" : [
        {
          "value" : "2024-03-05T10:52:41,044",
          "count" : 6
        },
        {
          "value" : "2024-03-05T10:52:41,043",
          "count" : 3
        },
        {
          "value" : "2024-03-05T10:52:41,059",
          "count" : 2
        },
        {
          "value" : "2024-03-05T10:52:36,256",
          "count" : 1
        },
        {
          "value" : "2024-03-05T10:52:41,038",
          "count" : 1
        },
        {
          "value" : "2024-03-05T10:52:41,042",
          "count" : 1
        },
        {
          "value" : "2024-03-05T10:52:43,291",
          "count" : 1
        },
        {
          "value" : "2024-03-05T10:52:46,098",
          "count" : 1
        },
        {
          "value" : "2024-03-05T10:52:47,227",
          "count" : 1
        },
        {
          "value" : "2024-03-05T10:52:47,259",
          "count" : 1
        }
      ]
    }
  }
}