Hello everybody!. Right now I'm facing the following situation:
I need to create a Timelion graph that displays information from different indices which represent logs taken from different sources. The structure of these indices is not normalized, meaning that not all fields are named exactly the same in all of them.
I.E: in two of my indices I have a "severity_label" field used for representing the severity of the log. As possible values for this label, I have: "Warning", "Error", "Critical" and so on.
However, in another index, these possible set of values is under a field called "level". If I want to create a Timelion graph using split, it will only work for the first two indices and I can accomplish that by writing down the following expression:
.es(index='index1, index2', split=severity_label:5)
Is there a way I can tell Timelion that I also want to include the third index but the field it should consider for that aggregation is "level" instead of "severity_label"? It should be something like:
.es(index='index1, index2,index3', split=severity_label:5, index3.level:5)