Field with name for each document

Elastic Stack Kibana
1

In each entry I have IP address and I would have also name for it. I have pairs IP and name.

How can I deal with it? To have name in each document where is IP adress?

I use static lookup but this is hard to use, I don't know how update it etc.

What will be less problematic/CPU consuming etc, update static field or scripted fields?

How can I update static lookup? how should look script? can I do it some easy way with PHP API?

2

best way would be to enrich the data from ingest, just add the field and name from the start. If that is not an option, a static lookup would be less intensive, depending on how many pairs you have.
I assume this would be a list of hostnames, and for a size of 10-15 any options is fine. Once you get past the 100 the static lookup will be hard to manage and the scripted fields are going to get really big, so I would still suggest enriching the data from the start.

3

I will have more than 100, I guess like 200 or more.

You mean this? Enrich processor | Elasticsearch Guide [7.15] | Elastic

4

That will work if you have a lot of fields, yes.

5

Hmm, ok... that looks litle complicated :slight_smile:

It will work for daily indexes? I have like 3 indexes per day (3 sources for daily indexes).

And how can I automate it? It looks like a lot manual job, not like static lookup.

Is it possible to enrich by SQL query?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.