Fields arrange problem

[abu.sayeed]

Two event's of postfix-mail log fields are below.:

Event_1:
source: /var/log/mail.log
postfix_queueid":24C4C681F19
host: mail
program: postfix/amavis/smtp
postfix_to: jhon@gmail.com
time: 10:53:30
postfix_status: sent
postfix_delay: 2.1
postfix_relay_ip: 127.0.0.1
postfix_delay_in_qmgr: 0.01

Event_2:
source: /var/log/mail.log
postfix_queueid: 24C4C681F19
postfix_size: 8209
host: mail
time: 10:53:30
program: postfix/qmgr
postfix_from: salam@gmail.com

But I need a complete information. like from, to, status etc in kibana dashboard.

How can I do it?

I need help.
Thanks.

[Brandon_Kobel]

Hey @abu.sayeed you can add a Saved Search to your Dashboard that will be very similar to the results that you see in Discover, that will contain the fill source of the documents in Elasticsearch.

[abu.sayeed]

Thanks for reply.

From and To both field are not in same Event.

if I create like the following visualize, its ok.

But I need it. For this need help.

Thanks

[Brandon_Kobel]

@abu.sayeed if you're trying to display a result and also look up additional information from another document/index, there isn't a built-in way to do this in Kibana. Have you considered denormalizing your data on ingest to lookup the necessary fields so you have everything you need displayed in a single Elasticsearch document?