How to add new fields on document on ingestion based on value of other fields

Elastic Stack Elasticsearch
1

I have a scenario where different applications are sending different fields for the same purpose which is making getting the aggregates/query data difficult and resulting in Big query.

Here is one of the field which specifies the file path.

For example:

  1. App 1 -> Sending "FilePath" as the file path
  2. App 2 -> Sending "CurrentFilePath" as the file path
  3. App 3 -> Sending "ItemPath" as the file path

As you can see the above Apps are sending 3 different fields for the file path. Is there a way I can populate an extra field "FilePath" for App2 and App3 documents on ingestion, so that single query on field "FilePath" and aggregation on "FilePath" can work.

NOTE: When I search for documents with field "FilePath", I want to get the complete document with all properties including "FilePath" for all the apps.

I would really appreciate if someone can help me here.

2

You should be able to do this in an ingest pipeline

Send app 2 & 3 to an ingest pipeline for each that renames it's field to "FilePath".

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.