Create elastic field alias

[sirReeall]

Hello,

Is it possible for logstash to alias fields as described in the elastic docs below?

Alias field type | Elasticsearch Guide [8.4] | Elastic

[Badger]

@sirReeall

Is it possible for logstash to alias fields as described in the elastic docs below?

Not sure what you think logstash could do related to aliases. An alias allows a different name to be used when sending a search request to elasticsearch. If logstash sends a query to elasticsearch (either an input or a filter) then I would certainly expect it to be able to use an alias. Other than that, what would you want logstash to do?

[sirReeall]

I have some existing fields that are parsed from events, I wanted to add an alias to these fields.

For example:

grok {
    match => {
      "message" => "%{GREEDYDATA:foo}"
    }
  }

I now want to add an alias bar that I can use for search.

I looked at mutate.add_field but this will add a field to the document that will not be coupled to the originally parsed field.

[Badger]

@sirReeall

I have some existing fields that are parsed from events, I wanted to add an alias to these fields.

So set the mapping of the index in elasticsearch such that bar is an alias for foo.

[sirReeall]

The ELK stack is disposable and indexes, and their settings are not persisted. Plus, I'm using datastreams to create the index rather then manually setting them up.

I was wondering if I can define alias at parse time using logstash, I'm guessing not.