Create alias on a composed field

(Roger) #1

Hi all, I'm trying to create an alias on a specific field to use the Control Visualization on two different indices.
This is my scenario:

Index1(created using Packetbeat) :
Index2 (created simple with filebeat+logstash)

I need to add as alias the value source.ip.keyword of Index1 on the field client.ip of index2.
As you can imagine, source and client are objects composed by field

(Roger) #2

so, I fixed this issue in this way:

  • I created an ingest pipeline to rename the source field used by Filebeat:

      PUT _ingest/pipeline/my_rename_pipeline
  {
    "description" : "describe pipeline",
    "processors" : [
      {
        "rename": {
          "field": "source",
          "target_field": "sourcefilebeat"
        }
      }
    ]
  }

  • created the alias field for the target index:

      PUT ftaudit_test
  {
    "mappings": {
      "_default_": {
        "properties": {
          "source.ip.keyword": {
            "type": "alias",
            "path": "client.ip" 
          },
          "transit_mode": {
            "type": "keyword"
          }
        }
      }
    }
  }

  • applied the reindex API:

      POST _reindex
  {
    "source": {
      "index": "ftaudit"
    },
    "dest": {
      "index": "ftaudit_test",
      "pipeline": "my_rename_pipeline"
    }
  }