elasticsearch split document ingest processor

Question

elasticsearch provides the ingest mechanism to transform documents while they are indexed. The processory can transform fields, add and remove fields from indexed documents. For the rare cases it is possible to even write your own transform plugin. I cannot however find any possibilty to produce mutiple output documents for a single input document. Is this somehow possible using the ingest module in elastic? I would like to split a single document into multiple documents. Does it always have to be a one-to-one relation between the input and transformed document?

Answer 1

Ingest node can only transform documents that are indexed but not suitable for what you are trying to achieve. You need to instead look at Logstash split filter plugin and see if it works for your use case - https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html