How add field on index according to another value in same index

[DVD_MNC (Davide Ioan Manco)]

Hello, everyone,
I am working on an elastic index.
I would like to add a 'status' field that is equal to 'success' if the 'code' field is equal to 0, or the 'status' field is 'fail' if the 'code' field is different from 0.

I would like to do this automatically with the arrival of my logs. I tried with a processor in ingest pipeline but failed.

Could someone give me a hand?

[stephenb (Stephen Brown)]

Hi @DVD_MNC

Something like this

PUT _ingest/pipeline/discuss_test
{
  "processors": [
    {
      "set": {
        "if": "ctx.code == 0",
        "field": "status",
        "value": "success"
      }
    },
    {
      "set": {
        "if": "ctx.code != 0",
        "field": "status",
        "value": "fail"
      }
    }
  ]
}

POST _ingest/pipeline/discuss_test/_simulate
{
  "docs": [
    {
      "_source": {
        "code": 0
      }
    },
    {
      "_source": {
        "code": 1
      }
    },
    {
      "_source": {
        "code": 3
      }
    },
    {
      "_source": {
        "code": -1
      }
    }
  ]
}

# Result
{
  "docs": [
    {
      "doc": {
        "_index": "_index",
        "_id": "_id",
        "_version": "-3",
        "_source": {
          "code": 0,
          "status": "success"
        },
        "_ingest": {
          "timestamp": "2023-10-26T04:01:33.030899373Z"
        }
      }
    },
    {
      "doc": {
        "_index": "_index",
        "_id": "_id",
        "_version": "-3",
        "_source": {
          "code": 1,
          "status": "fail"
        },
        "_ingest": {
          "timestamp": "2023-10-26T04:01:33.030925393Z"
        }
      }
    },
    {
      "doc": {
        "_index": "_index",
        "_id": "_id",
        "_version": "-3",
        "_source": {
          "code": 3,
          "status": "fail"
        },
        "_ingest": {
          "timestamp": "2023-10-26T04:01:33.030933593Z"
        }
      }
    },
    {
      "doc": {
        "_index": "_index",
        "_id": "_id",
        "_version": "-3",
        "_source": {
          "code": -1,
          "status": "fail"
        },
        "_ingest": {
          "timestamp": "2023-10-26T04:01:33.030939827Z"
        }
      }
    }
  ]
}

[DVD_MNC (Davide Ioan Manco)]

Thanks for response. I solved. Thank you so much!