openapi: 3.2.0
info:
  title: Elasticsearch Logstash API
  description: 'Elasticsearch provides REST APIs that are used by the UI components and can be called directly to configure and access Elasticsearch features.

    ## Documentation source and versions

    This documentation is derived from the main branch of the elasticsearch-specification repository. It is provided under license Attribution-NonCommercial-NoDerivatives 4.0 International.

    This documentation contains work-in-progress information for future Elastic Stack releases.'
  license:
    name: Apache 2.0
    url: https://github.com/elastic/elasticsearch-specification/blob/main/LICENSE
  version: ''
security:
- apiKeyAuth: []
- basicAuth: []
- bearerAuth: []
tags:
- name: logstash
  description: Logstash APIs enable you to manage pipelines that are used by Logstash Central Management.
  externalDocs:
    description: Learn more.
    url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
  x-displayName: Logstash
paths:
  /_logstash/pipeline/{id}:
    get:
      tags:
      - logstash
      summary: Get Logstash pipelines
      description: Get pipelines that are used for Logstash Central Management.
      externalDocs:
        description: Centralized pipeline management
        url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-get-pipeline.html
      operationId: logstash-get-pipeline-1
      parameters:
      - in: path
        name: id
        description: A comma-separated list of pipeline identifiers.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Ids'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/logstash._types.Pipeline'
              examples:
                LogstashGetPipelineResponseExample1:
                  description: 'A successful response from `GET _logstash/pipeline/my_pipeline`.

                    '
                  value: "{\n  \"my_pipeline\": {\n    \"description\": \"Sample pipeline for illustration purposes\",\n    \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n    \"pipeline_metadata\": {\n      \"type\": \"logstash_pipeline\",\n      \"version\": \"1\"\n    },\n    \"username\": \"elastic\",\n    \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n    \"pipeline_settings\": {\n      \"pipeline.workers\": 1,\n      \"pipeline.batch.size\": 125,\n      \"pipeline.batch.delay\": 50,\n      \"queue.type\": \"memory\",\n      \"queue.max_bytes\": \"1gb\",\n      \"queue.checkpoint.writes\": 1024\n    }\n  }\n}"
      x-state: Generally available; Added in 7.12.0
      x-variations:
      - "<div>\n              <span class=\"operation-verb get\">GET</span>\n              <span class=\"operation-path\">/_logstash/pipeline/{id}</span>\n              </div>\n            "
      x-req-auth:
      - 'Cluster privileges: `manage_logstash_pipelines`

        '
      x-api: get_pipeline.logstash
      x-category: ingest
      x-codeSamples:
      - lang: Console
        source: 'GET _logstash/pipeline/my_pipeline

          '
      - lang: Python
        source: "resp = client.logstash.get_pipeline(\n    id=\"my_pipeline\",\n)"
      - lang: JavaScript
        source: "const response = await client.logstash.getPipeline({\n  id: \"my_pipeline\",\n});"
      - lang: Ruby
        source: "response = client.logstash.get_pipeline(\n  id: \"my_pipeline\"\n)"
      - lang: PHP
        source: "$resp = $client->logstash()->getPipeline([\n    \"id\" => \"my_pipeline\",\n]);"
      - lang: curl
        source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_logstash/pipeline/my_pipeline"'
      - lang: Java
        source: "client.logstash().getPipeline(g -> g\n    .id(\"my_pipeline\")\n);\n"
      x-metaTags:
      - content: Elasticsearch, Logstash
        name: product_name
    put:
      tags:
      - logstash
      summary: Create or update a Logstash pipeline
      description: 'Create a pipeline that is used for Logstash Central Management.

        If the specified pipeline exists, it is replaced.'
      externalDocs:
        description: Centralized pipeline management
        url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-put-pipeline.html
      operationId: logstash-put-pipeline
      parameters:
      - in: path
        name: id
        description: 'An identifier for the pipeline.

          Pipeline IDs must begin with a letter or underscore and contain only letters, underscores, dashes, hyphens and numbers.'
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/logstash._types.Pipeline'
            examples:
              LogstashPutPipelineRequestExample1:
                summary: Create a pipeline
                description: Run `PUT _logstash/pipeline/my_pipeline` to create a pipeline.
                value: "{\n  \"description\": \"Sample pipeline for illustration purposes\",\n  \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n  \"pipeline_metadata\": {\n    \"type\": \"logstash_pipeline\",\n    \"version\": 1\n  },\n  \"username\": \"elastic\",\n  \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n  \"pipeline_settings\": {\n    \"pipeline.workers\": 1,\n    \"pipeline.batch.size\": 125,\n    \"pipeline.batch.delay\": 50,\n    \"queue.type\": \"memory\",\n    \"queue.max_bytes\": \"1gb\",\n    \"queue.checkpoint.writes\": 1024\n  }\n}"
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json: {}
      x-state: Generally available; Added in 7.12.0
      x-variations:
      - "<div>\n              <span class=\"operation-verb put\">PUT</span>\n              <span class=\"operation-path\">/_logstash/pipeline/{id}</span>\n              </div>\n            "
      x-req-auth:
      - 'Cluster privileges: `manage_logstash_pipelines`

        '
      x-api: put_pipeline.logstash
      x-category: ingest
      x-codeSamples:
      - lang: Console
        source: "PUT _logstash/pipeline/my_pipeline\n{\n  \"description\": \"Sample pipeline for illustration purposes\",\n  \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n  \"pipeline_metadata\": {\n    \"type\": \"logstash_pipeline\",\n    \"version\": 1\n  },\n  \"username\": \"elastic\",\n  \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n  \"pipeline_settings\": {\n    \"pipeline.workers\": 1,\n    \"pipeline.batch.size\": 125,\n    \"pipeline.batch.delay\": 50,\n    \"queue.type\": \"memory\",\n    \"queue.max_bytes\": \"1gb\",\n    \"queue.checkpoint.writes\": 1024\n  }\n}"
      - lang: Python
        source: "resp = client.logstash.put_pipeline(\n    id=\"my_pipeline\",\n    pipeline={\n        \"description\": \"Sample pipeline for illustration purposes\",\n        \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n        \"pipeline_metadata\": {\n            \"type\": \"logstash_pipeline\",\n            \"version\": 1\n        },\n        \"username\": \"elastic\",\n        \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n        \"pipeline_settings\": {\n            \"pipeline.workers\": 1,\n            \"pipeline.batch.size\": 125,\n            \"pipeline.batch.delay\": 50,\n            \"queue.type\": \"memory\",\n            \"queue.max_bytes\": \"1gb\",\n            \"queue.checkpoint.writes\": 1024\n        }\n    },\n)"
      - lang: JavaScript
        source: "const response = await client.logstash.putPipeline({\n  id: \"my_pipeline\",\n  pipeline: {\n    description: \"Sample pipeline for illustration purposes\",\n    last_modified: \"2021-01-02T02:50:51.250Z\",\n    pipeline_metadata: {\n      type: \"logstash_pipeline\",\n      version: 1,\n    },\n    username: \"elastic\",\n    pipeline: \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n    pipeline_settings: {\n      \"pipeline.workers\": 1,\n      \"pipeline.batch.size\": 125,\n      \"pipeline.batch.delay\": 50,\n      \"queue.type\": \"memory\",\n      \"queue.max_bytes\": \"1gb\",\n      \"queue.checkpoint.writes\": 1024,\n    },\n  },\n});"
      - lang: Ruby
        source: "response = client.logstash.put_pipeline(\n  id: \"my_pipeline\",\n  body: {\n    \"description\": \"Sample pipeline for illustration purposes\",\n    \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n    \"pipeline_metadata\": {\n      \"type\": \"logstash_pipeline\",\n      \"version\": 1\n    },\n    \"username\": \"elastic\",\n    \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n    \"pipeline_settings\": {\n      \"pipeline.workers\": 1,\n      \"pipeline.batch.size\": 125,\n      \"pipeline.batch.delay\": 50,\n      \"queue.type\": \"memory\",\n      \"queue.max_bytes\": \"1gb\",\n      \"queue.checkpoint.writes\": 1024\n    }\n  }\n)"
      - lang: PHP
        source: "$resp = $client->logstash()->putPipeline([\n    \"id\" => \"my_pipeline\",\n    \"body\" => [\n        \"description\" => \"Sample pipeline for illustration purposes\",\n        \"last_modified\" => \"2021-01-02T02:50:51.250Z\",\n        \"pipeline_metadata\" => [\n            \"type\" => \"logstash_pipeline\",\n            \"version\" => 1,\n        ],\n        \"username\" => \"elastic\",\n        \"pipeline\" => \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n        \"pipeline_settings\" => [\n            \"pipeline.workers\" => 1,\n            \"pipeline.batch.size\" => 125,\n            \"pipeline.batch.delay\" => 50,\n            \"queue.type\" => \"memory\",\n            \"queue.max_bytes\" => \"1gb\",\n            \"queue.checkpoint.writes\" => 1024,\n        ],\n    ],\n]);"
      - lang: curl
        source: 'curl -X PUT -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d ''{"description":"Sample pipeline for illustration purposes","last_modified":"2021-01-02T02:50:51.250Z","pipeline_metadata":{"type":"logstash_pipeline","version":1},"username":"elastic","pipeline":"input {}\\n filter { grok {} }\\n output {}","pipeline_settings":{"pipeline.workers":1,"pipeline.batch.size":125,"pipeline.batch.delay":50,"queue.type":"memory","queue.max_bytes":"1gb","queue.checkpoint.writes":1024}}'' "$ELASTICSEARCH_URL/_logstash/pipeline/my_pipeline"'
      - lang: Java
        source: "client.logstash().putPipeline(p -> p\n    .id(\"my_pipeline\")\n    .pipeline(pi -> pi\n        .description(\"Sample pipeline for illustration purposes\")\n        .lastModified(DateTime.of(\"2021-01-02T02:50:51.250Z\"))\n        .pipeline(\"input {}\\n filter { grok {} }\\n output {}\")\n        .pipelineMetadata(pip -> pip\n            .type(\"logstash_pipeline\")\n            .version(\"1\")\n        )\n        .pipelineSettings(pip -> pip\n            .pipelineWorkers(1)\n            .pipelineBatchSize(125)\n            .pipelineBatchDelay(50)\n            .queueType(\"memory\")\n            .queueMaxBytes(\"1gb\")\n            .queueCheckpointWrites(1024)\n        )\n        .username(\"elastic\")\n    )\n);\n"
      x-metaTags:
      - content: Elasticsearch, Logstash
        name: product_name
    delete:
      tags:
      - logstash
      summary: Delete a Logstash pipeline
      description: 'Delete a pipeline that is used for Logstash Central Management.

        If the request succeeds, you receive an empty response with an appropriate status code.'
      externalDocs:
        description: Centralized pipeline management
        url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-delete-pipeline.html
      operationId: logstash-delete-pipeline
      parameters:
      - in: path
        name: id
        description: An identifier for the pipeline.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/_types.Id'
        style: simple
      responses:
        '200':
          description: ''
          content:
            application/json: {}
      x-state: Generally available; Added in 7.12.0
      x-variations:
      - "<div>\n              <span class=\"operation-verb delete\">DELETE</span>\n              <span class=\"operation-path\">/_logstash/pipeline/{id}</span>\n              </div>\n            "
      x-req-auth:
      - 'Cluster privileges: `manage_logstash_pipelines`

        '
      x-api: delete_pipeline.logstash
      x-category: ingest
      x-codeSamples:
      - lang: Console
        source: 'DELETE _logstash/pipeline/my_pipeline

          '
      - lang: Python
        source: "resp = client.logstash.delete_pipeline(\n    id=\"my_pipeline\",\n)"
      - lang: JavaScript
        source: "const response = await client.logstash.deletePipeline({\n  id: \"my_pipeline\",\n});"
      - lang: Ruby
        source: "response = client.logstash.delete_pipeline(\n  id: \"my_pipeline\"\n)"
      - lang: PHP
        source: "$resp = $client->logstash()->deletePipeline([\n    \"id\" => \"my_pipeline\",\n]);"
      - lang: curl
        source: 'curl -X DELETE -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_logstash/pipeline/my_pipeline"'
      - lang: Java
        source: "client.logstash().deletePipeline(d -> d\n    .id(\"my_pipeline\")\n);\n"
      x-metaTags:
      - content: Elasticsearch, Logstash
        name: product_name
  /_logstash/pipeline:
    get:
      tags:
      - logstash
      summary: Get Logstash pipelines
      description: Get pipelines that are used for Logstash Central Management.
      externalDocs:
        description: Centralized pipeline management
        url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
        x-previousVersionUrl: https://www.elastic.co/guide/en/elasticsearch/reference/8.19/logstash-api-get-pipeline.html
      operationId: logstash-get-pipeline
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  $ref: '#/components/schemas/logstash._types.Pipeline'
              examples:
                LogstashGetPipelineResponseExample1:
                  description: 'A successful response from `GET _logstash/pipeline/my_pipeline`.

                    '
                  value: "{\n  \"my_pipeline\": {\n    \"description\": \"Sample pipeline for illustration purposes\",\n    \"last_modified\": \"2021-01-02T02:50:51.250Z\",\n    \"pipeline_metadata\": {\n      \"type\": \"logstash_pipeline\",\n      \"version\": \"1\"\n    },\n    \"username\": \"elastic\",\n    \"pipeline\": \"input {}\\\\n filter { grok {} }\\\\n output {}\",\n    \"pipeline_settings\": {\n      \"pipeline.workers\": 1,\n      \"pipeline.batch.size\": 125,\n      \"pipeline.batch.delay\": 50,\n      \"queue.type\": \"memory\",\n      \"queue.max_bytes\": \"1gb\",\n      \"queue.checkpoint.writes\": 1024\n    }\n  }\n}"
      x-state: Generally available; Added in 7.12.0
      x-variations:
      - "<div>\n              <span class=\"operation-verb get\">GET</span>\n              <span class=\"operation-path\">/_logstash/pipeline</span>\n              </div>\n            "
      x-req-auth:
      - 'Cluster privileges: `manage_logstash_pipelines`

        '
      x-api: get_pipeline.logstash
      x-category: ingest
      x-codeSamples:
      - lang: Console
        source: 'GET _logstash/pipeline/my_pipeline

          '
      - lang: Python
        source: "resp = client.logstash.get_pipeline(\n    id=\"my_pipeline\",\n)"
      - lang: JavaScript
        source: "const response = await client.logstash.getPipeline({\n  id: \"my_pipeline\",\n});"
      - lang: Ruby
        source: "response = client.logstash.get_pipeline(\n  id: \"my_pipeline\"\n)"
      - lang: PHP
        source: "$resp = $client->logstash()->getPipeline([\n    \"id\" => \"my_pipeline\",\n]);"
      - lang: curl
        source: 'curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_logstash/pipeline/my_pipeline"'
      - lang: Java
        source: "client.logstash().getPipeline(g -> g\n    .id(\"my_pipeline\")\n);\n"
      x-metaTags:
      - content: Elasticsearch, Logstash
        name: product_name
components:
  schemas:
    _types.DateTime:
      description: 'A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a

        number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string

        representation.'
      oneOf:
      - type: string
      - $ref: '#/components/schemas/_types.EpochTimeUnitMillis'
    _types.Ids:
      oneOf:
      - $ref: '#/components/schemas/_types.Id'
      - type: array
        items:
          $ref: '#/components/schemas/_types.Id'
    _types.UnitMillis:
      description: Time unit for milliseconds
      type: number
    logstash._types.PipelineMetadata:
      type: object
      properties:
        type:
          type: string
        version:
          type: string
      required:
      - type
      - version
    logstash._types.Pipeline:
      type: object
      properties:
        description:
          description: 'A description of the pipeline.

            This description is not used by Elasticsearch or Logstash.'
          type: string
        last_modified:
          description: 'The date the pipeline was last updated.

            It must be in the `yyyy-MM-dd''T''HH:mm:ss.SSSZZ` strict_date_time format.'
          allOf:
          - $ref: '#/components/schemas/_types.DateTime'
        pipeline:
          externalDocs:
            url: https://www.elastic.co/docs/reference/logstash/configuration-file-structure
          description: The configuration for the pipeline.
          type: string
        pipeline_metadata:
          description: 'Optional metadata about the pipeline, which can have any contents.

            This metadata is not generated or used by Elasticsearch or Logstash.'
          allOf:
          - $ref: '#/components/schemas/logstash._types.PipelineMetadata'
        pipeline_settings:
          externalDocs:
            url: https://www.elastic.co/docs/reference/logstash/logstash-settings-file
          description: 'Settings for the pipeline.

            It supports only flat keys in dot notation.'
          allOf:
          - $ref: '#/components/schemas/logstash._types.PipelineSettings'
        username:
          description: The user who last updated the pipeline.
          type: string
      required:
      - description
      - last_modified
      - pipeline
      - pipeline_metadata
      - pipeline_settings
      - username
    logstash._types.PipelineSettings:
      type: object
      properties:
        pipeline.workers:
          description: The number of workers that will, in parallel, execute the filter and output stages of the pipeline.
          type: number
        pipeline.batch.size:
          description: The maximum number of events an individual worker thread will collect from inputs before attempting to execute its filters and outputs.
          type: number
        pipeline.batch.delay:
          description: When creating pipeline event batches, how long in milliseconds to wait for each event before dispatching an undersized batch to pipeline workers.
          type: number
        queue.type:
          description: The internal queuing model to use for event buffering.
          type: string
        queue.max_bytes:
          description: 'The total capacity of the queue (`queue.type: persisted`) in number of bytes.'
          type: string
        queue.checkpoint.writes:
          description: 'The maximum number of written events before forcing a checkpoint when persistent queues are enabled (`queue.type: persisted`).'
          type: number
      required:
      - pipeline.workers
      - pipeline.batch.size
      - pipeline.batch.delay
      - queue.type
      - queue.max_bytes
      - queue.checkpoint.writes
    _types.EpochTimeUnitMillis:
      allOf:
      - $ref: '#/components/schemas/_types.UnitMillis'
    _types.Id:
      type: string
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
      description: "Elasticsearch APIs support key-based authentication.\nYou must create an API key and use the encoded value in the request header.\nFor example:\n\n```\ncurl -X GET \"${ES_URL}/_cat/indices?v=true\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nTo get API keys, use the `/_security/api_key` APIs."
    basicAuth:
      type: http
      scheme: basic
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Elasticsearch APIs support the use of bearer tokens in the `Authorization` HTTP header to authenticate with the API.

        For examples, refer to [Token-based authentication services](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/token-based-authentication-services)'
x-tagGroups:
- name: AI & Machine Learning
  tags:
  - analytics
  - graph
  - inference
  - ml
  - ml anomaly
  - ml data frame
  - ml trained model
  - query_rules
  - text_structure
- name: Cluster Management
  tags:
  - ccr
  - cluster
  - connector
  - data stream
  - ilm
  - indices
  - rollup
  - script
  - search_application
  - searchable_snapshots
  - slm
  - snapshot
- name: Data Processing
  tags:
  - enrich
  - fleet
  - ingest
  - logstash
  - synonyms
  - transform
- name: Information & Monitoring
  tags:
  - cat
  - features
  - health_report
  - info
  - license
  - migration
  - tasks
  - watcher
  - xpack
- name: Search & Document APIs
  tags:
  - document
  - eql
  - esql
  - search
  - sql
- name: Security
  tags:
  - security