Filter by campaign

[Farsad]

Hi,

We are imported Nginx logs to elastic by Logstash to make an analytics panel in Kibana.
We need to make a filter to filter results based on campaign ids that the user started to reach our app.
As an example, a user comes to our app by "url?refid=reddit" by IP address x.x.x.x. the "?refid=reddit" get removed from the URL that passed to the browser by Nginx. user will continue using our app and answer a poll, that makes a request to our API but without "?refid=reddit". It logged into Nginx log like "/api/poll//answered". So, in this line of log, we don't know the campaign. but we have IP address of the user.

In Kibana we want to filter "/api/poll//answered" urls that started from our campaigns (e.g. reddit).

What is the best way to make it in Kibana? (or Logstash)

Thank you!

[tims (Tim Schnell)]

Hey @Farsad, this sounds like something you would have to tie together during data ingestion. Can you lookup the campaigns using the ip address from elasticsearch during ingest, and store them on the log as an array or object? Then you can filter in Kibana.