Free tool

Ingest pipeline builder

Paste one real document, pick processors field by field, reorder them, check the result in your browser, then copy the PUT and _simulate requests for Kibana Dev Tools.

Runs entirely in your browser. Nothing you enter is sent anywhere.

1. Sample document

One JSON document, or NDJSON (the first non-empty line is used) The document is the _source as it arrives at the pipeline. It never leaves this page.

2. Fields

Pick a processor from a field's menu to add it to the pipeline. Drag a field onto an object (or the root) to move it, or use Move to: both add a rename processor.

Add a new field

Field path Value

3. Pipeline

Pipeline nameThe id in PUT _ingest/pipeline/<name>. DescriptionOptional.

Add a pipeline-level on_failure handler

Message to{{ _ingest.on_failure_message }}. error.message is an ECS field. Processor type to{{ _ingest.on_failure_processor_type }}. Not an ECS field; blank to leave out. Processor tag to{{ _ingest.on_failure_processor_tag }}. Blank to leave out. Pipeline name to{{ _ingest.on_failure_pipeline }}. Blank to leave out. Also send failed documents to failed-<index> (sets _index to failed-{{{ _index }}})

Metadata names from Elastic's "Handling pipeline failures" docs. When a processor without its own on_failure fails, Elasticsearch runs this handler and stops the pipeline; the document is still indexed.

Add a processor without a field

Processors, in the order they run

Drag the :: handle to reorder, or use Up and Down. Parameter names follow the elastic.co ingest processor reference (checked October 2026).

No processors yet. Read a document, then pick one from a field's menu.

4. Result in the browser

This is a JavaScript approximation, not Elasticsearch. Processors that only Elasticsearch can run (grok, date, user_agent, geoip, fingerprint) are skipped, and Painless if conditions are not evaluated. Run the _simulate request from the Output tab for the real result.

Processors with an if condition

#	Processor	In the browser

Document after the pipeline

5. Output

Read with this tool

Ingest Pipelines vs Logstash: Where to Parse Your LogsDecide where parsing belongs, ingest pipelines or Logstash, with grok vs dissect costs, on_failure patterns, the simulate API and ingest node sizing math.Elasticsearch Mapping Design for Production: Types and LimitsDesign Elasticsearch mappings that stay fast and small: text vs keyword, doc_values, index: false, dynamic templates, strict mode, flattened and field limits.Logstash Pipeline Architecture: Workers, Queues and IsolationSize Logstash workers and batches, choose memory or persistent queues, use the dead letter queue and isolate outputs with pipeline-to-pipeline patterns.Elasticsearch Index Templates, Component Templates, Data StreamsHow composable templates merge, how priority resolves conflicts, how data stream backing indices roll over, and when a plain index is the better choice.