Get from in Entity Analytics Azure Entra ID dataset


So now we have the entity analytics, is it on Elastic's to do to enrich certain datasets with the real from the ?

For example in the Azure Graph API logs only a field is known. The username could be added from the entity analytics entra id dataset.

Because we need to use the Elastic Integration Logstash filter, we cannot use enrich processor, as that is unsupported. So is the only way to achieve this, by doing it in Logstash with the Elasticsearch filter plugin then?

Elasticsearch filter plugin | Logstash Reference [8.13] | Elastic



Have you explored doing the enrichment via an elasticsearch Ingest pipeline: Enrich processor | Elasticsearch Guide [8.13] | Elastic

You could also do this enrichment at query time if you're working with ES|QL: Data enrichment | Elasticsearch Guide [8.13] | Elastic