Hi,
I would like to know how to retrieve a field value from the same _source of another field, using the “scripted fields” feature of ES.
For example, I have the following _source:
{ "_index": "logstash-2016.05.17", "_type": "openldap", "_id": "AVTBKXIvwxbdH8mztObX", "_score": null, "_source": { "message": "May 17 20:59:59 openldap-master slapd[14507]: conn=16206099 op=2 BIND dn='cn=user1,ou=users,dc=example,dc=com' method=128", "@version": "1", "@timestamp": "2016-05-17T23:59:59.000Z", "type": "openldap", "host": "openldap-server", "path": "/var/log/slapd.log", "timestamp": "May 17 20:59:59", "logsource": "openldap-master", "program": "slapd", "pid": "14507", "ConnNumber": "16206099", "OpType": "BIND", "BindDN": "cn=user1,ou=users,dc=example,dc=com" }, "fields": { "@timestamp": [ 1463529599000 ] }, "sort": [ 1463529599000 ] }
I would like to query the value 16206099 in the field “ConnNumber” and retrieve the value of the field “BindDN” from the same _source entry.
Any help would be very appreciated!