{
  "text_structure.find_message_structure": {
    "documentation": {
      "url": "https://www.elastic.co/guide/en/elasticsearch/reference/8.19/find-message-structure.html",
      "description": "Find the structure of text messages"
    },
    "stability": "stable",
    "visibility": "public",
    "headers": {
      "accept": [
        "application/json"
      ],
      "content_type": [
        "application/json"
      ]
    },
    "url": {
      "paths": [
        {
          "path": "/_text_structure/find_message_structure",
          "methods": [
            "GET",
            "POST"
          ]
        }
      ]
    },
    "params": {
      "timeout": {
        "type": "time",
        "description": "Timeout after which the analysis will be aborted",
        "default": "25s"
      },
      "format": {
        "type": "enum",
        "options": [
          "ndjson",
          "xml",
          "delimited",
          "semi_structured_text"
        ],
        "description": "Optional parameter to specify the high level file format"
      },
      "column_names": {
        "type": "list",
        "description": "Optional parameter containing a comma separated list of the column names for a delimited file"
      },
      "delimiter": {
        "type": "string",
        "description": "Optional parameter to specify the delimiter character for a delimited file - must be a single character"
      },
      "quote": {
        "type": "string",
        "description": "Optional parameter to specify the quote character for a delimited file - must be a single character"
      },
      "should_trim_fields": {
        "type": "boolean",
        "description": "Optional parameter to specify whether the values between delimiters in a delimited file should have whitespace trimmed from them"
      },
      "grok_pattern": {
        "type": "string",
        "description": "Optional parameter to specify the Grok pattern that should be used to extract fields from messages in a semi-structured text file"
      },
      "ecs_compatibility": {
        "type": "enum",
        "description": "The mode of compatibility with ECS compliant Grok patterns.\nUse this parameter to specify whether to use ECS Grok patterns instead of legacy ones when the structure finder creates a Grok pattern.\nThis setting primarily has an impact when a whole message Grok pattern such as `%{CATALINALOG}` matches the input.\nIf the structure finder identifies a common structure but has no idea of meaning then generic field names such as `path`, `ipaddress`, `field1`, and `field2` are used in the `grok_pattern` output, with the intention that a user who knows the meanings rename these fields before using it.",
        "options": [
          "disabled",
          "v1"
        ],
        "default": "disabled"
      },
      "timestamp_field": {
        "type": "string",
        "description": "Optional parameter to specify the timestamp field in the file"
      },
      "timestamp_format": {
        "type": "string",
        "description": "Optional parameter to specify the timestamp format in the file - may be either a Joda or Java time format"
      },
      "explain": {
        "type": "boolean",
        "description": "Whether to include a commentary on how the structure was derived",
        "default": false
      }
    },
    "body": {
      "description": "JSON object with one field [messages], containing an array of messages to be analyzed",
      "required": true
    }
  }
}
