Elasticsearch custom index mapping

I prefer pipelines because I feel they give me better control of managing messages and I enjoy finding efficient ways of writing rules and stages. I don’t use extractors at all. You can find documentation here. One thing to note in pipeline rules, they are set up in stages so that rules within a particular stage tend to run in parallel. If you have a rule that has a dependency on the results of another rule, make sure the second executing rule is in a stage that follows the initial rule. There are plenty of examples of both in the community.

You can make them very efficient where you can only apply the rule if certain criteria exist - which you can do with extractors… but using stages you can have one rule parse out fields, then in a following stage (because - dependency) You can take further actions based on the fields that were parsed out in the previous stage. I gave an example of it over here in this post.

2 Likes