Conditionals with the Regular Expressions

The if conditional is implemented as a Painless script, which requires explicit support for regular expressions.

script.painless.regex.enabled: true must be set in elasticsearch.yml to use regular expressions in the if condition.

If regular expressions are enabled, operators such as =~ can be used against a /pattern/ for conditions.

For example:

  1. PUT _ingest/pipeline/check_url
  2. {
  3.   "processors": [
  4.     {
  5.       "set": {
  6.         "if": "ctx.href?.url =~ /^http[^s]/",
  7.         "field": "href.insecure",
  8.         "value": true
  9.       }
  10.     }
  11.   ]
  12. }
  1. POST test/_doc/1?pipeline=check_url
  2. {
  3.   "href": {
  4.     "url": "http://www.elastic.co/"
  5.   }
  6. }

Results in:

  1. {
  2.   "_index": "test",
  3.   "_type": "_doc",
  4.   "_id": "1",
  5.   "_version": 1,
  6.   "_seq_no": 60,
  7.   "_primary_term": 1,
  8.   "found": true,
  9.   "_source": {
  10.     "href": {
  11.       "insecure": true,
  12.       "url": "http://www.elastic.co/"
  13.     }
  14.   }
  15. }

Regular expressions can be expensive and should be avoided if viable alternatives exist.

For example in this case startsWith can be used to get the same result without using a regular expression:

  1. PUT _ingest/pipeline/check_url
  2. {
  3.   "processors": [
  4.     {
  5.       "set": {
  6.         "if": "ctx.href?.url != null && ctx.href.url.startsWith('http://')",
  7.         "field": "href.insecure",
  8.         "value": true
  9.       }
  10.     }
  11.   ]
  12. }