Get user.name from user.id in Entity Analytics Azure Entra ID dataset

Hello,

So now we have the entity analytics, is it on Elastic's to do to enrich certain datasets with the real user.name from the user.id ?

For example in the Azure Graph API logs only a user.id field is known. The username could be added from the entity analytics entra id dataset.

Because we need to use the Elastic Integration Logstash filter, we cannot use enrich processor, as that is unsupported. So is the only way to achieve this, by doing it in Logstash with the Elasticsearch filter plugin then?

Elasticsearch filter plugin | Logstash Reference [8.13] | Elastic

Willem

Hi!

Have you explored doing the enrichment via an elasticsearch Ingest pipeline: Enrich processor | Elasticsearch Guide [8.13] | Elastic

You could also do this enrichment at query time if you're working with ES|QL: Data enrichment | Elasticsearch Guide [8.13] | Elastic