New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Decompress gzip fields Dissect strings »
Elastic Docs ›Fleet and Elastic Agent Guide [8.8] ›Define processors

Detect mime type

edit

Detect mime type

edit

The detect_mime_type processor attempts to detect a mime type for a field that contains a given stream of bytes.

Example

edit

In this example, http.request.body.content is used as the source, and http.request.mime_type is set to the detected mime type.

  - detect_mime_type:
      field: http.request.body.content
      target: http.request.mime_type

Configuration settings

edit

Elastic Agent processors execute before ingest pipelines, which means that your processor configurations cannot refer to fields that are created by ingest pipelines or Logstash. For more limitations, refer to What are some limitations of using processors?

Name Required Default Description

field

Yes

Field used as the data source.

target

Yes

Field to populate with the detected type. You can use the @metadata. prefix to set the value in the event metadata instead of fields.

See Conditions for a list of supported conditions.

« Decompress gzip fields Dissect strings »

On this page

Was this helpful?
Feedback