Hi, wondering how to combine a text search field for easier searching through our cloudtrail logs in our ELK stack (5.3.0),
We'd like to have a search field called IAM-User = userIdentity.userName or userIdentity.sessionContext.sessionIssuer.userName or requestParameters.roleSessionName
Depending on which one has a value (exists), then search that field.
We're currently doing this : type:cloudtrail AND (userIdentity.userName:"app-prod" OR userIdentity.sessionContext.sessionIssuer.userName:"app-prod" OR requestParameters.roleSessionName:"app-prod")
But this gets really tedious for searching through all our other users.
Obviously I can already search on any of those names (without using the field name) and find the doc as long as the other docs don't also contain the names or parts of names in other fields.
But if I want one field I can always search on I can create a scripted field like this which uses the first of the values it finds;
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.