Create alias on a composed field

Hi all, I'm trying to create an alias on a specific field to use the Control Visualization on two different indices.
This is my scenario:

Index1(created using Packetbeat) :
Index2 (created simple with filebeat+logstash)

I need to add as alias the value source.ip.keyword of Index1 on the field client.ip of index2.
As you can imagine, source and client are objects composed by field

so, I fixed this issue in this way:

  • I created an ingest pipeline to rename the source field used by Filebeat:

      PUT _ingest/pipeline/my_rename_pipeline
      {
        "description" : "describe pipeline",
        "processors" : [
          {
            "rename": {
              "field": "source",
              "target_field": "sourcefilebeat"
            }
          }
        ]
      }
    
  • created the alias field for the target index:

      PUT ftaudit_test
      {
        "mappings": {
          "_default_": {
            "properties": {
              "source.ip.keyword": {
                "type": "alias",
                "path": "client.ip" 
              },
              "transit_mode": {
                "type": "keyword"
              }
            }
          }
        }
      }
    
  • applied the reindex API:

      POST _reindex
      {
        "source": {
          "index": "ftaudit"
        },
        "dest": {
          "index": "ftaudit_test",
          "pipeline": "my_rename_pipeline"
        }
      }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.