---
type: api
title: Create or update a stream
description: Creates or updates a stream definition. Classic streams can not be created through this API, only updated<br/><br/>[Required authorization] Route required privileges: manage_stream.
url: https://www.elastic.co/docs/api/doc/kibana/operation/operation-put-streams-name
resource: https://www.elastic.co/docs/api/doc/kibana/operation/operation-put-streams-name
products:
  - Kibana
---

# Create or update a stream

Authentication: required

Availability: Experimental since 9.1

- Server: `https://{kibana_url}`

## Paths

- `PUT` `/api/streams/{name}`
- `PUT` `/s/{space_id}/api/streams/{name}`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
- `name` (string · max length: 200) — required
  The name of the stream.

## Description

Creates or updates a stream definition. Classic streams can not be created through this API, only updated

## Required privileges

- Privileges: `manage_stream`

## Header parameters

- `kbn-xsrf` (string) — required
  A required header to protect against CSRF attacks

## Request body

`application/json`

Any of:
- **WiredStreamUpsertRequest**
  - `dashboards` (string[]) — required
  - `rules` (string[]) — required
  - `stream` (object) — required
    - `description` (string) — required
    - `ingest` (object) — required
      - `failure_store` (union anyOf) — required
        - **{ inherit }**
          - `inherit` (object) — required
        - **{ disabled }**
          - `disabled` (object) — required
        - **object**
          - `lifecycle` (object) — required
            - `enabled` (object) — required
              - `data_retention` (string · min length: 1) — optional
                A non-empty string.
        - **object**
          - `lifecycle` (object) — required
            - `disabled` (object) — required
      - `lifecycle` (union anyOf) — required
        - **{ dsl }**
          - `dsl` (object) — required
            - `data_retention` (string · min length: 1) — optional
              A non-empty string.
            - `downsample` (object[]) — optional
              - `after` (string · min length: 1) — required
                A non-empty string.
              - `fixed_interval` (string · min length: 1) — required
                A non-empty string.
            - `frozen_after` (string · min length: 1) — optional
              A non-empty string.
        - **{ ilm }**
          - `ilm` (object) — required
            - `policy` (string · min length: 1) — required
              A non-empty string.
        - **{ inherit }**
          - `inherit` (object) — required
      - `processing` (object) — required
        - `steps` (union anyOf[]) — required
          - **action: grok**
            Grok processor - Extract fields from text using grok patterns
            - `action` (enum) — required
              Values: `grok`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
              Source field to parse with grok patterns
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip processing when source field is missing
            - `pattern_definitions` (map string to string) — optional
            - `patterns` (string[] · min items: 1) — required
              Grok patterns applied in order to extract fields
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              - **FilterCondition**
                A basic filter condition, either unary or binary.
                Any of:
                - **{ contains, endsWith, eq, … }**
                  A condition that compares a field to a value or range using an operator as the key.
                  - `contains` (boolean | number | string) — optional
                    Contains comparison value.
                  - `endsWith` (boolean | number | string) — optional
                    Ends-with comparison value.
                  - `eq` (boolean | number | string) — optional
                    Equality comparison value.
                  - `field` (string · min length: 1) — required
                    The document field to filter on.
                  - `gt` (boolean | number | string) — optional
                    Greater-than comparison value.
                  - `gte` (boolean | number | string) — optional
                    Greater-than-or-equal comparison value.
                  - `includes` (boolean | number | string) — optional
                    Checks if multivalue field includes the value.
                  - `lt` (boolean | number | string) — optional
                    Less-than comparison value.
                  - `lte` (boolean | number | string) — optional
                    Less-than-or-equal comparison value.
                  - `neq` (boolean | number | string) — optional
                    Inequality comparison value.
                  - `range` (object) — optional
                    Range comparison values.
                    - `gt` (boolean | number | string) — optional
                      A value that can be a string, number, or boolean.
                    - `gte` (boolean | number | string) — optional
                      A value that can be a string, number, or boolean.
                    - `lt` (boolean | number | string) — optional
                      A value that can be a string, number, or boolean.
                    - `lte` (boolean | number | string) — optional
                      A value that can be a string, number, or boolean.
                  - `startsWith` (boolean | number | string) — optional
                    Starts-with comparison value.
                - **{ exists }**
                  A condition that checks for the existence or non-existence of a field.
                  - `exists` (boolean) — optional
                    Indicates whether the field exists or not.
                  - `field` (string · min length: 1) — required
                    The document field to check.
              - **{ and }**
                A logical AND that groups multiple conditions.
                - `and` (union anyOf[]) — required — recursive
                  An array of conditions. All sub-conditions must be true for this condition to be true.
                  Same options as `where` in `action: grok`
              - **{ or }**
                A logical OR that groups multiple conditions.
                - `or` (union anyOf[]) — required — recursive
                  An array of conditions. At least one sub-condition must be true for this condition to be true.
                  Same options as `where` in `action: grok`
              - **{ not }**
                A logical NOT that negates a condition.
                - `not` (union anyOf) — required — recursive
                  The root condition object. It can be a simple filter or a combination of other conditions.
                  Same options as `where` in `action: grok`
              - **{ never }**
                A condition that always evaluates to false.
                - `never` (object) — required
                  An empty object. This condition never matches.
              - **{ always }**
                A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
                - `always` (object) — required
                  An empty object. This condition always matches.
          - **action: dissect**
            Dissect processor - Extract fields from text using a lightweight, delimiter-based parser
            - `action` (enum) — required
              Values: `dissect`
            - `append_separator` (string · min length: 1) — optional
              Separator inserted when target fields are concatenated
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
              Source field to parse with dissect pattern
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip processing when source field is missing
            - `pattern` (string · min length: 1) — required
              Dissect pattern describing field boundaries
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: uri_parts**
            URI parts processor - Parse a URI into components (scheme, domain, port, path, query, fragment, ...)
            - `action` (enum) — required
              Values: `uri_parts`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
              Source field holding the URI string to parse
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip processing when source field is missing
            - `keep_original` (boolean) — optional
              If true (default), preserve the original URI string alongside the extracted parts
            - `remove_if_successful` (boolean) — optional
              If true, remove the source field after a successful parse. Source field is kept on failure.
            - `to` (string · min length: 1) — optional
              Target field / column prefix for the extracted URI components (defaults to "url"). May equal `from` — the canonical ECS shape parses the `url` field in place. Note: combining `to === from` with `remove_if_successful: true` nulls the parsed object after writing it.
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: date**
            Date processor - Parse dates from strings using one or more expected formats
            - `action` (enum) — required
              Values: `date`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `formats` (string[]) — required
              Accepted input date formats, tried in order
            - `from` (string · min length: 1) — required
              Source field containing the date/time text
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `locale` (string · min length: 1) — optional
              Optional locale for date parsing
            - `output_format` (string · min length: 1) — optional
              Optional output format for storing the parsed date as text
            - `timezone` (string · min length: 1) — optional
              Optional timezone for date parsing
            - `to` (string · min length: 1) — optional
              Target field for the parsed date (defaults to source)
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: drop_document**
            - `action` (enum) — required
              Values: `drop_document`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: math**
            - `action` (enum) — required
              Values: `math`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `expression` (string · min length: 1) — required
              A non-empty string.
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
            - `to` (string · min length: 1) — required
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: rename**
            Rename processor - Change a field name and optionally its location
            - `action` (enum) — required
              Values: `rename`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
              Existing source field to rename or move
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip when source field is missing
            - `override` (boolean) — optional
              Allow overwriting the target field if it already exists
            - `to` (string · min length: 1) — required
              New field name or destination path
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: set**
            Set processor - Assign a literal or copied value to a field (mutually exclusive inputs)
            - `action` (enum) — required
              Values: `set`
            - `copy_from` (string · min length: 1) — optional
              Copy value from another field instead of providing a literal
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `override` (boolean) — optional
              Allow overwriting an existing target field
            - `to` (string · min length: 1) — required
              Target field to set or create
            - `value` (object) — optional
              Literal value to assign to the target field
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: append**
            Append processor - Append one or more values to an existing or new array field
            - `action` (enum) — required
              Values: `append`
            - `allow_duplicates` (boolean) — optional
              If true, do not deduplicate appended values
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `to` (string · min length: 1) — required
              Array field to append values to
            - `value` (object[] · min items: 1) — required
              Values to append (must be literal, no templates)
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: remove_by_prefix**
            Remove by prefix processor - Remove a field and all nested fields matching the prefix
            - `action` (enum) — required
              Values: `remove_by_prefix`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
              Field to remove along with all its nested fields
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
          - **action: remove**
            Remove processor - Delete one or more fields from the document
            - `action` (enum) — required
              Values: `remove`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
              Field to remove from the document
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip processing when source field is missing
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: replace**
            - `action` (enum) — required
              Values: `replace`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
            - `pattern` (string · min length: 1) — required
            - `replacement` (string) — required
            - `to` (string · min length: 1) — optional
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: redact**
            Redact processor - Mask sensitive data using Grok patterns
            - `action` (enum) — required
              Values: `redact`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
              Source field to redact sensitive data from
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip processing when source field is missing (defaults to true)
            - `pattern_definitions` (map string to string) — optional
              Custom pattern definitions to use in the patterns
            - `patterns` (string[] · min items: 1) — required
              Grok patterns to match sensitive data (for example, "%{IP:client}", "%{EMAILADDRESS:email}")
            - `prefix` (string) — optional
              Prefix to prepend to the redacted pattern name (defaults to "<")
            - `suffix` (string) — optional
              Suffix to append to the redacted pattern name (defaults to ">")
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: uppercase**
            - `action` (enum) — required
              Values: `uppercase`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
            - `to` (string · min length: 1) — optional
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: lowercase**
            - `action` (enum) — required
              Values: `lowercase`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
            - `to` (string · min length: 1) — optional
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: trim**
            - `action` (enum) — required
              Values: `trim`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
            - `to` (string · min length: 1) — optional
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: join**
            - `action` (enum) — required
              Values: `join`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `delimiter` (string) — required
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string[] · min items: 1) — required
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
            - `to` (string · min length: 1) — required
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: split**
            Split processor - Split a field value into an array using a separator
            - `action` (enum) — required
              Values: `split`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
              Source field to split into an array
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip processing when source field is missing
            - `preserve_trailing` (boolean) — optional
              Preserve empty trailing fields in the split result
            - `separator` (string · min length: 1) — required
              Regex separator used to split the field value into an array
            - `to` (string · min length: 1) — optional
              Target field for the split array (defaults to source)
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: sort**
            - `action` (enum) — required
              Values: `sort`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
              Array field to sort
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip processing when source field is missing
            - `order` (enum) — optional
              Sort order - "asc" (ascending) or "desc" (descending). Defaults to "asc"
              Values: `asc`, `desc`
            - `to` (string · min length: 1) — optional
              Target field for the sorted array (defaults to source)
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: convert**
            Convert processor - Change the data type of a field value (integer, long, double, boolean, or string)
            - `action` (enum) — required
              Values: `convert`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (string · min length: 1) — required
              Source field to convert to a different data type
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip processing when source field is missing
            - `to` (string · min length: 1) — optional
              Target field for the converted value (defaults to source)
            - `type` (enum) — required
              Target data type: integer, long, double, boolean, or string
              Values: `integer`, `long`, `double`, `boolean`, `string`
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: concat**
            - `action` (enum) — required
              Values: `concat`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `from` (union anyOf[] · min items: 1) — required
              - **type: field**
                - `type` (enum) — required
                  Values: `field`
                - `value` (string · min length: 1) — required
              - **type: literal**
                - `type` (enum) — required
                  Values: `literal`
                - `value` (string) — required
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
            - `to` (string · min length: 1) — required
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: network_direction**
            - `action` (enum) — required
              Values: `network_direction`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `destination_ip` (string · min length: 1) — required
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
            - `internal_networks` (string[]) — required
            - `source_ip` (string · min length: 1) — required
            - `target_field` (string · min length: 1) — optional
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: network_direction**
            - `action` (enum) — required
              Values: `network_direction`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `destination_ip` (string · min length: 1) — required
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
            - `internal_networks_field` (string · min length: 1) — required
            - `source_ip` (string · min length: 1) — required
            - `target_field` (string · min length: 1) — optional
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: json_extract**
            JsonExtract processor - Extract values from JSON strings using JSONPath-like selectors
            - `action` (enum) — required
              Values: `json_extract`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `extractions` (object[] · min items: 1) — required
              List of extraction specifications
              - `selector` (string · min length: 1) — required
                JSONPath-like selector to extract value (e.g., "user.id", "$.metadata.client.ip", "items[0].name")
              - `target_field` (string · min length: 1) — required
                Target field to store the extracted value
              - `type` (enum) — optional
                Data type for the extracted value. Defaults to "keyword". Ensures consistent types across transpilers.
                Values: `keyword`, `integer`, `long`, `double`, `boolean`
            - `field` (string · min length: 1) — required
              Source field containing the JSON string to parse
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip processing when source field is missing
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: enrich**
            - `action` (enum) — required
              Values: `enrich`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
            - `override` (boolean) — optional
            - `policy_name` (string · min length: 1) — required
              A non-empty string.
            - `to` (string · min length: 1) — required
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: user_agent**
            User agent processor - Extract browser, OS, and device details from a user agent string
            - `action` (enum) — required
              Values: `user_agent`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `extract_device_type` (boolean) — optional
              Extracts device type from the user agent string
            - `from` (string · min length: 1) — required
              The field containing the user agent string
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip processing when source field is missing
            - `properties` (enum[]) — optional
              Specific properties to extract (defaults to all)
              Values: `name`, `os`, `device`, `original`, `version`
            - `regex_file` (string · min length: 1) — optional
              Custom regex file name containing the regular expressions for parsing the user agent string
            - `to` (string · min length: 1) — optional
              The field that will be filled with the user agent details
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: registered_domain**
            Registered domain processor - extracts domain, registered_domain, top_level_domain, subdomain from a FQDN
            - `action` (enum) — required
              Values: `registered_domain`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `expression` (string · min length: 1) — required
              The string expression containing the FQDN to parse
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `ignore_missing` (boolean) — optional
              Skip processing when expression field is missing
            - `prefix` (string · min length: 1) — required
              The prefix for the output columns. The extracted parts are available as prefix.part_name
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **action: manual_ingest_pipeline**
            Manual ingest pipeline wrapper around native Elasticsearch processors
            - `action` (enum) — required
              Manual ingest pipeline - executes raw Elasticsearch ingest processors
              Values: `manual_ingest_pipeline`
            - `customIdentifier` (string · min length: 1) — optional
              Custom identifier to correlate this processor across outputs
            - `description` (string) — optional
              Human-readable notes about this processor step
            - `ignore_failure` (boolean) — optional
              Continue pipeline execution if this processor fails
            - `on_failure` (string to object[]) — optional
              Fallback processors to run when a processor fails
            - `processors` (string to object[]) — required
              List of raw Elasticsearch ingest processors to run
            - `tag` (string) — optional
              Optional ingest processor tag for Elasticsearch
            - `where` (union anyOf) — optional
              The root condition object. It can be a simple filter or a combination of other conditions.
              Same options as `where` in `action: grok`
          - **StreamlangConditionBlock**
            - `condition` (union anyOf) — required
              - **FilterCondition**
                A basic filter condition, either unary or binary.
                - `else` (union anyOf[]) — optional — recursive
                  Same options as `steps` in `processing`
                - `steps` (union anyOf[]) — required — recursive
                  Same options as `steps` in `processing`
              - **{ and }**
                A logical AND that groups multiple conditions.
                - `else` (union anyOf[]) — optional — recursive
                  Same options as `steps` in `processing`
                - `steps` (union anyOf[]) — required — recursive
                  Same options as `steps` in `processing`
                - `and` (union anyOf[]) — required
                  An array of conditions. All sub-conditions must be true for this condition to be true.
                  Same options as `where` in `action: grok`
              - **{ or }**
                A logical OR that groups multiple conditions.
                - `else` (union anyOf[]) — optional — recursive
                  Same options as `steps` in `processing`
                - `steps` (union anyOf[]) — required — recursive
                  Same options as `steps` in `processing`
                - `or` (union anyOf[]) — required
                  An array of conditions. At least one sub-condition must be true for this condition to be true.
                  Same options as `where` in `action: grok`
              - **{ not }**
                A logical NOT that negates a condition.
                - `else` (union anyOf[]) — optional — recursive
                  Same options as `steps` in `processing`
                - `steps` (union anyOf[]) — required — recursive
                  Same options as `steps` in `processing`
                - `not` (union anyOf) — required
                  The root condition object. It can be a simple filter or a combination of other conditions.
                  Same options as `where` in `action: grok`
              - **{ never }**
                A condition that always evaluates to false.
                - `else` (union anyOf[]) — optional — recursive
                  Same options as `steps` in `processing`
                - `steps` (union anyOf[]) — required — recursive
                  Same options as `steps` in `processing`
                - `never` (object) — required
                  An empty object. This condition never matches.
              - **{ always }**
                A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
                - `else` (union anyOf[]) — optional — recursive
                  Same options as `steps` in `processing`
                - `steps` (union anyOf[]) — required — recursive
                  Same options as `steps` in `processing`
                - `always` (object) — required
                  An empty object. This condition always matches.
            - `customIdentifier` (string) — optional
      - `settings` (object) — required
        - `index.number_of_replicas` (object) — optional
          - `value` (number) — required
        - `index.number_of_shards` (object) — optional
          - `value` (number) — required
        - `index.refresh_interval` (object) — optional
          - `value` (union string | enum) — required
            Values: `-1`
      - `wired` (object) — required
        - `draft` (boolean) — optional
        - `fields` (map string to anyOf) — required
          Map values (union anyOf)
          Any of:
          - **object**
            - `description` (string) — optional
            - `format` (string · min length: 1) — optional
              A non-empty string.
            - `type` (enum) — required
              Values: `keyword`, `match_only_text`, `long`, `double`, `date`, `boolean`, `ip`, `geo_point`, `integer`, `short`, `byte`, `float`, `half_float`, `text`, `wildcard`, `version`, `unsigned_long`, `date_nanos`
          - **object**
            - `description` (string) — required
            - `format` (object) — optional
            - `type` (object) — optional
          - **type: system**
            - `description` (string) — optional
            - `type` (enum) — required
              Values: `system`
        - `routing` (object[]) — required
          - `destination` (string · min length: 1) — required
            A non-empty string.
          - `draft` (boolean) — optional
          - `status` (enum) — optional
            Values: `enabled`, `disabled`
          - `where` (union anyOf) — required
            The root condition object. It can be a simple filter or a combination of other conditions.
            Same options as `where` in `action: grok`
    - `query_streams` (object[]) — optional
      - `name` (string) — required
    - `type` (enum) — required
      Values: `wired`
- **ClassicStreamUpsertRequest**
  - `dashboards` (string[]) — required
  - `rules` (string[]) — required
  - `stream` (object) — required
    - `description` (string) — required
    - `ingest` (object) — required
      - `classic` (object) — required
        - `field_overrides` (map string to anyOf) — optional
          Map values (union anyOf)
          Any of:
          - **{ format }**
            - `description` (string) — optional
            - `format` (string · min length: 1) — optional
              A non-empty string.
            - `type` (enum) — required
              Values: `keyword`, `match_only_text`, `long`, `double`, `date`, `boolean`, `ip`, `geo_point`, `integer`, `short`, `byte`, `float`, `half_float`, `text`, `wildcard`, `version`, `unsigned_long`, `date_nanos`
          - **type: system**
            - `description` (string) — optional
            - `type` (enum) — required
              Values: `system`
      - `failure_store` (union anyOf) — required
        - **{ inherit }**
          - `inherit` (object) — required
        - **{ disabled }**
          - `disabled` (object) — required
        - **object**
          - `lifecycle` (object) — required
            - `enabled` (object) — required
              - `data_retention` (string · min length: 1) — optional
                A non-empty string.
        - **object**
          - `lifecycle` (object) — required
            - `disabled` (object) — required
      - `lifecycle` (union anyOf) — required
        - **{ dsl }**
          - `dsl` (object) — required
            - `data_retention` (string · min length: 1) — optional
              A non-empty string.
            - `downsample` (object[]) — optional
              - `after` (string · min length: 1) — required
                A non-empty string.
              - `fixed_interval` (string · min length: 1) — required
                A non-empty string.
            - `frozen_after` (string · min length: 1) — optional
              A non-empty string.
        - **{ ilm }**
          - `ilm` (object) — required
            - `policy` (string · min length: 1) — required
              A non-empty string.
        - **{ inherit }**
          - `inherit` (object) — required
      - `processing` (union anyOf) — required
        - **{ steps }**
          - `steps` (union anyOf[]) — required
            - **action: grok**
              Grok processor - Extract fields from text using grok patterns
              - `action` (enum) — required
                Values: `grok`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
                Source field to parse with grok patterns
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip processing when source field is missing
              - `pattern_definitions` (map string to string) — optional
              - `patterns` (string[] · min items: 1) — required
                Grok patterns applied in order to extract fields
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: dissect**
              Dissect processor - Extract fields from text using a lightweight, delimiter-based parser
              - `action` (enum) — required
                Values: `dissect`
              - `append_separator` (string · min length: 1) — optional
                Separator inserted when target fields are concatenated
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
                Source field to parse with dissect pattern
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip processing when source field is missing
              - `pattern` (string · min length: 1) — required
                Dissect pattern describing field boundaries
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: uri_parts**
              URI parts processor - Parse a URI into components (scheme, domain, port, path, query, fragment, ...)
              - `action` (enum) — required
                Values: `uri_parts`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
                Source field holding the URI string to parse
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip processing when source field is missing
              - `keep_original` (boolean) — optional
                If true (default), preserve the original URI string alongside the extracted parts
              - `remove_if_successful` (boolean) — optional
                If true, remove the source field after a successful parse. Source field is kept on failure.
              - `to` (string · min length: 1) — optional
                Target field / column prefix for the extracted URI components (defaults to "url"). May equal `from` — the canonical ECS shape parses the `url` field in place. Note: combining `to === from` with `remove_if_successful: true` nulls the parsed object after writing it.
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: date**
              Date processor - Parse dates from strings using one or more expected formats
              - `action` (enum) — required
                Values: `date`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `formats` (string[]) — required
                Accepted input date formats, tried in order
              - `from` (string · min length: 1) — required
                Source field containing the date/time text
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `locale` (string · min length: 1) — optional
                Optional locale for date parsing
              - `output_format` (string · min length: 1) — optional
                Optional output format for storing the parsed date as text
              - `timezone` (string · min length: 1) — optional
                Optional timezone for date parsing
              - `to` (string · min length: 1) — optional
                Target field for the parsed date (defaults to source)
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: drop_document**
              - `action` (enum) — required
                Values: `drop_document`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: math**
              - `action` (enum) — required
                Values: `math`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `expression` (string · min length: 1) — required
                A non-empty string.
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
              - `to` (string · min length: 1) — required
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: rename**
              Rename processor - Change a field name and optionally its location
              - `action` (enum) — required
                Values: `rename`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
                Existing source field to rename or move
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip when source field is missing
              - `override` (boolean) — optional
                Allow overwriting the target field if it already exists
              - `to` (string · min length: 1) — required
                New field name or destination path
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: set**
              Set processor - Assign a literal or copied value to a field (mutually exclusive inputs)
              - `action` (enum) — required
                Values: `set`
              - `copy_from` (string · min length: 1) — optional
                Copy value from another field instead of providing a literal
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `override` (boolean) — optional
                Allow overwriting an existing target field
              - `to` (string · min length: 1) — required
                Target field to set or create
              - `value` (object) — optional
                Literal value to assign to the target field
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: append**
              Append processor - Append one or more values to an existing or new array field
              - `action` (enum) — required
                Values: `append`
              - `allow_duplicates` (boolean) — optional
                If true, do not deduplicate appended values
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `to` (string · min length: 1) — required
                Array field to append values to
              - `value` (object[] · min items: 1) — required
                Values to append (must be literal, no templates)
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: remove_by_prefix**
              Remove by prefix processor - Remove a field and all nested fields matching the prefix
              - `action` (enum) — required
                Values: `remove_by_prefix`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
                Field to remove along with all its nested fields
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
            - **action: remove**
              Remove processor - Delete one or more fields from the document
              - `action` (enum) — required
                Values: `remove`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
                Field to remove from the document
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip processing when source field is missing
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: replace**
              - `action` (enum) — required
                Values: `replace`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
              - `pattern` (string · min length: 1) — required
              - `replacement` (string) — required
              - `to` (string · min length: 1) — optional
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: redact**
              Redact processor - Mask sensitive data using Grok patterns
              - `action` (enum) — required
                Values: `redact`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
                Source field to redact sensitive data from
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip processing when source field is missing (defaults to true)
              - `pattern_definitions` (map string to string) — optional
                Custom pattern definitions to use in the patterns
              - `patterns` (string[] · min items: 1) — required
                Grok patterns to match sensitive data (for example, "%{IP:client}", "%{EMAILADDRESS:email}")
              - `prefix` (string) — optional
                Prefix to prepend to the redacted pattern name (defaults to "<")
              - `suffix` (string) — optional
                Suffix to append to the redacted pattern name (defaults to ">")
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: uppercase**
              - `action` (enum) — required
                Values: `uppercase`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
              - `to` (string · min length: 1) — optional
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: lowercase**
              - `action` (enum) — required
                Values: `lowercase`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
              - `to` (string · min length: 1) — optional
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: trim**
              - `action` (enum) — required
                Values: `trim`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
              - `to` (string · min length: 1) — optional
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: join**
              - `action` (enum) — required
                Values: `join`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `delimiter` (string) — required
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string[] · min items: 1) — required
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
              - `to` (string · min length: 1) — required
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: split**
              Split processor - Split a field value into an array using a separator
              - `action` (enum) — required
                Values: `split`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
                Source field to split into an array
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip processing when source field is missing
              - `preserve_trailing` (boolean) — optional
                Preserve empty trailing fields in the split result
              - `separator` (string · min length: 1) — required
                Regex separator used to split the field value into an array
              - `to` (string · min length: 1) — optional
                Target field for the split array (defaults to source)
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: sort**
              - `action` (enum) — required
                Values: `sort`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
                Array field to sort
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip processing when source field is missing
              - `order` (enum) — optional
                Sort order - "asc" (ascending) or "desc" (descending). Defaults to "asc"
                Values: `asc`, `desc`
              - `to` (string · min length: 1) — optional
                Target field for the sorted array (defaults to source)
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: convert**
              Convert processor - Change the data type of a field value (integer, long, double, boolean, or string)
              - `action` (enum) — required
                Values: `convert`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (string · min length: 1) — required
                Source field to convert to a different data type
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip processing when source field is missing
              - `to` (string · min length: 1) — optional
                Target field for the converted value (defaults to source)
              - `type` (enum) — required
                Target data type: integer, long, double, boolean, or string
                Values: `integer`, `long`, `double`, `boolean`, `string`
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: concat**
              - `action` (enum) — required
                Values: `concat`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `from` (union anyOf[] · min items: 1) — required
                - **type: field**
                  - `type` (enum) — required
                    Values: `field`
                  - `value` (string · min length: 1) — required
                - **type: literal**
                  - `type` (enum) — required
                    Values: `literal`
                  - `value` (string) — required
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
              - `to` (string · min length: 1) — required
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: network_direction**
              - `action` (enum) — required
                Values: `network_direction`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `destination_ip` (string · min length: 1) — required
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
              - `internal_networks` (string[]) — required
              - `source_ip` (string · min length: 1) — required
              - `target_field` (string · min length: 1) — optional
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: network_direction**
              - `action` (enum) — required
                Values: `network_direction`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `destination_ip` (string · min length: 1) — required
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
              - `internal_networks_field` (string · min length: 1) — required
              - `source_ip` (string · min length: 1) — required
              - `target_field` (string · min length: 1) — optional
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: json_extract**
              JsonExtract processor - Extract values from JSON strings using JSONPath-like selectors
              - `action` (enum) — required
                Values: `json_extract`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `extractions` (object[] · min items: 1) — required
                List of extraction specifications
                - `selector` (string · min length: 1) — required
                  JSONPath-like selector to extract value (e.g., "user.id", "$.metadata.client.ip", "items[0].name")
                - `target_field` (string · min length: 1) — required
                  Target field to store the extracted value
                - `type` (enum) — optional
                  Data type for the extracted value. Defaults to "keyword". Ensures consistent types across transpilers.
                  Values: `keyword`, `integer`, `long`, `double`, `boolean`
              - `field` (string · min length: 1) — required
                Source field containing the JSON string to parse
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip processing when source field is missing
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: enrich**
              - `action` (enum) — required
                Values: `enrich`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
              - `override` (boolean) — optional
              - `policy_name` (string · min length: 1) — required
                A non-empty string.
              - `to` (string · min length: 1) — required
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: user_agent**
              User agent processor - Extract browser, OS, and device details from a user agent string
              - `action` (enum) — required
                Values: `user_agent`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `extract_device_type` (boolean) — optional
                Extracts device type from the user agent string
              - `from` (string · min length: 1) — required
                The field containing the user agent string
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip processing when source field is missing
              - `properties` (enum[]) — optional
                Specific properties to extract (defaults to all)
                Values: `name`, `os`, `device`, `original`, `version`
              - `regex_file` (string · min length: 1) — optional
                Custom regex file name containing the regular expressions for parsing the user agent string
              - `to` (string · min length: 1) — optional
                The field that will be filled with the user agent details
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: registered_domain**
              Registered domain processor - extracts domain, registered_domain, top_level_domain, subdomain from a FQDN
              - `action` (enum) — required
                Values: `registered_domain`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `expression` (string · min length: 1) — required
                The string expression containing the FQDN to parse
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `ignore_missing` (boolean) — optional
                Skip processing when expression field is missing
              - `prefix` (string · min length: 1) — required
                The prefix for the output columns. The extracted parts are available as prefix.part_name
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **action: manual_ingest_pipeline**
              Manual ingest pipeline wrapper around native Elasticsearch processors
              - `action` (enum) — required
                Manual ingest pipeline - executes raw Elasticsearch ingest processors
                Values: `manual_ingest_pipeline`
              - `customIdentifier` (string · min length: 1) — optional
                Custom identifier to correlate this processor across outputs
              - `description` (string) — optional
                Human-readable notes about this processor step
              - `ignore_failure` (boolean) — optional
                Continue pipeline execution if this processor fails
              - `on_failure` (string to object[]) — optional
                Fallback processors to run when a processor fails
              - `processors` (string to object[]) — required
                List of raw Elasticsearch ingest processors to run
              - `tag` (string) — optional
                Optional ingest processor tag for Elasticsearch
              - `where` (union anyOf) — optional
                The root condition object. It can be a simple filter or a combination of other conditions.
                Same options as `where` in `action: grok`
            - **StreamlangConditionBlock**
              - `condition` (union anyOf) — required
                Same options as `condition` in `StreamlangConditionBlock`
              - `customIdentifier` (string) — optional
        - **{ processors }**
          - `processors` (string to object[]) — required
      - `settings` (object) — required
        - `index.number_of_replicas` (object) — optional
          - `value` (number) — required
        - `index.number_of_shards` (object) — optional
          - `value` (number) — required
        - `index.refresh_interval` (object) — optional
          - `value` (union string | enum) — required
            Values: `-1`
    - `query_streams` (object[]) — optional
      - `name` (string) — required
    - `type` (enum) — required
      Values: `classic`
- **QueryStreamUpsertRequest**
  - `dashboards` (string[]) — required
  - `rules` (string[]) — required
  - `stream` (object) — required
    - `description` (string) — required
    - `field_descriptions` (map string to string) — optional
    - `query` (object) — required
      - `esql` (string) — required
      - `view` (string) — required
    - `query_streams` (object[]) — optional
      - `name` (string) — required
    - `type` (enum) — required
      Values: `query`

## Response

The stream was created or updated successfully.

## Code examples

#### Console

```console
PUT kbn:/api/streams/NAME
{
  "dashboards": [],
  "rules": [],
  "stream": {
    "description": "All error-level logs across every stream",
    "query": {
      "esql": "FROM logs* | WHERE log.level == \u0022error\u0022",
      "view": "logs.errors-view"
    },
    "type": "query"
  }
}
```

#### curl

```curl
curl -X PUT "${KIBANA_URL}/api/streams/${NAME}" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "dashboards": [],
    "rules": [],
    "stream": {
      "description": "All error-level logs across every stream",
      "query": {
        "esql": "FROM logs* | WHERE log.level == \u0022error\u0022",
        "view": "logs.errors-view"
      },
      "type": "query"
    }
  }'
```