Create alias on a composed field

[rschirin (Roger)]

Hi all, I'm trying to create an alias on a specific field to use the Control Visualization on two different indices.
This is my scenario:

Index1(created using Packetbeat) :
Index2 (created simple with filebeat+logstash)

I need to add as alias the value source.ip.keyword of Index1 on the field client.ip of index2.
As you can imagine, source and client are objects composed by field

[rschirin (Roger)]

so, I fixed this issue in this way:

• I created an ingest pipeline to rename the source field used by Filebeat:

    PUT _ingest/pipeline/my_rename_pipeline
    {
      "description" : "describe pipeline",
      "processors" : [
        {
          "rename": {
            "field": "source",
            "target_field": "sourcefilebeat"
          }
        }
      ]
    }
  

• created the alias field for the target index:

    PUT ftaudit_test
    {
      "mappings": {
        "_default_": {
          "properties": {
            "source.ip.keyword": {
              "type": "alias",
              "path": "client.ip" 
            },
            "transit_mode": {
              "type": "keyword"
            }
          }
        }
      }
    }
  

• applied the reindex API:

    POST _reindex
    {
      "source": {
        "index": "ftaudit"
      },
      "dest": {
        "index": "ftaudit_test",
        "pipeline": "my_rename_pipeline"
      }
    }